Social account takeover is rarely about the account. It is about the trust the account carries with its followers, which is then used to run investment fraud, crypto giveaways, or emergency money requests against people who believe they are talking to you.
How accounts are lost
- A phishing page mimicking the platform's login, often reached via a message about a copyright claim or verification.
- A code relayed by a "friend" who needs help receiving a verification message.
- Credential reuse, where a password exposed in an unrelated breach still works here.
- A malicious connected application granted access during an unrelated sign-up.
The first hour, in order
Secure the linked email address first, because whoever controls it controls recovery. Then attempt platform recovery from a device you have used before, which many platforms weight favourably. Then warn your contacts — post from another account, message directly, ask a friend to post on your behalf. Speed here directly reduces how many people are defrauded using your name.
What to check once you are back in
- Active sessions and logged-in devices — revoke everything you do not recognise.
- Connected and authorised applications, which survive a password change.
- Recovery email and phone number, which attackers change immediately.
- Added administrators or editors on business pages, a commonly missed persistence method.
- Sent messages and posts, so you know what was said in your name.
Business pages need particular attention
On business accounts, attackers add themselves as an administrator so access persists after you reset. Check the admin list explicitly, remove unknown entries, and confirm that your own account still holds full ownership rather than a reduced role.
Afterwards
Enable a passkey or hardware key rather than relying on SMS. Review which apps have access on a schedule. And accept that phishing aimed at you will continue for a while — regained accounts are frequently targeted again within weeks by the same group.