Your business Instagram can be stolen: how to lock down your company's social accounts
A fake message about a “copyright violation”, one hurried click, and the business profile with years of customers and content ends up in someone else's hands. Scams targeting company social accounts are exploding: here are the defences that cost nothing and the first moves if it happens.
The message that fools everyone
It arrives as a DM or an email, with the right logo and an official tone: “Your account has violated copyright. Verify your identity within 24 hours or the profile will be deactivated”. The link leads to a page identical to the real one, where you enter your credentials — and from that moment the account is no longer yours. It is the “copyright violation” phishing scheme, today the most common way business profiles get stolen, together with the “verified badge” variant and the fake support agent asking for your verification code “to assist you”.
For a business the bill is steep: years of content, hard-earned followers, customers writing in DMs — and a criminal publishing scams in your name, to your customers.
The other ways to lose an account
Phishing is not the only threat. There is the page with a single administrator, which is doomed if that person loses access (or leaves). There is the external social media manager who had everything registered under their own name and vanished with the credentials. And there is the password shared in the WhatsApp group “because it's easier” — identical to the email password, of course.
The six defences (almost all free)
- Two-factor authentication (2FA) on everything: with an authenticator app, not just SMS. It is the single step that blocks most thefts.
- Roles, not passwords: on Meta you work through Business Manager — each person with their own access and role. The shared password on WhatsApp is the original sin.
- At least two administrators, one of them inside the company. A single admin is an outage waiting to happen.
- A dedicated company email as the recovery address: not the personal one of whoever happens to manage the account.
- Printed recovery codes stored with your important documents: they are needed precisely when the phone is gone.
- One rule shared with the team: no platform ever asks for passwords or codes by message. Whoever does is a scammer, no exceptions.
If it happens: the first hours matter
First: attempt immediate recovery through the official channels (for Instagram, the “hacked account” page), which freezes the situation. Second: warn your customers right away through your other channels — website, newsletter, other social accounts — because the thief will use your name to scam them. Third: change the passwords of connected accounts (email first) and revoke active sessions. Fourth: document everything, for the police report and for the platform.
An asset like your domain
A company social profile must be treated like the domain or the bank account: an access inventory, ownership in the company's hands (never under an external personal account), active defences and an emergency plan. It costs an hour of work; losing it costs months.
In short
Company social profiles are lost to phishing (the fake “copyright violation” notice is the most common scheme), to accounts with a single administrator, to credentials registered under external collaborators and to shared passwords. The defences cost almost nothing: two-factor authentication with an authenticator app, roles assigned through Business Manager instead of shared passwords, at least two administrators with one inside the company, a company recovery email, recovery codes stored offline and the rule that no platform asks for credentials by message. If the theft happens, in the first hours: official recovery procedure, customer warnings through other channels, password changes on connected accounts and documentation for the report.
Frequently asked questions
I received a copyright violation notice: how do I know if it is real?
Platforms never ask for credentials or codes via DM or email. Real notices appear inside the app, in the official help centre notifications. A link leading to a login page is a scam until proven otherwise.
Should the external social media manager have the password?
No: on Meta you work with roles through Business Manager, and almost every platform offers delegated access. The collaborator uses their own account with the right permissions — and when the collaboration ends, you revoke the role instead of rushing to change passwords.
We lost access and the only admin is gone: is it over?
Not always: recovery procedures for businesses exist, and they are stronger if you can prove ownership (company domain in the email, documents, advertising invoices). They are slow and uncertain though: the real answer is never getting there, with a second internal admin.
At A126 we support companies through digital transformation: websites and e-commerce, custom management software, vertical micro-applications and strategic consulting. If you want to see how to apply all of this to your business, get in touch for a free consultation.
A126 Corporate Advisors — digital transformation for businesses and professionals.