How to Secure Your Business Social Media Accounts

A craft brewery in Prince Edward County posts its new releases on Facebook and Instagram every Thursday. One afternoon, the person who runs its social media gets an urgent message: "Your page violates our copyright policy and will be removed in 24 hours." The link leads to a page that looks exactly like Meta's. She enters her password and the code she receives by text.

Within an hour, the attacker controls her personal account, and with it the brewery's page, where she was the only admin. He removes everyone else, posts a fake crypto giveaway and launches ads charged to the company credit card. The scenario is fictional, but every step is common.

Social media is often managed "on the side," outside IT, by an employee, an intern or an agency. That's exactly what makes it an easy target. Here's how to get it back under control.

Why attackers want your social media accounts

A business page has value to a criminal, even if your company has 15 employees:

• Your audience. Your followers trust you. A fake promotion posted under your name will be believed.
• Your credit card. An ad account linked to a payment method lets attackers run fraudulent campaigns at your expense.
• Your inbox. The page's messages contain conversations with customers, sometimes including personal information.
• Your reputation. A hijacked page pushing scams can get suspended, and recovering it takes time.

The attack techniques are rarely sophisticated: fake policy violation notices, fake "Meta support," a password reused from another site, or a malicious browser extension that steals the logged-in session.

Who actually has access to what

Start by listing every account and its admins. Each platform works differently.

On Meta, full control lets someone manage all settings, add people and share assets with partners. Partial access is limited to specific tasks such as creating content, managing ads and replying to messages. Meta advises giving people only the level of access they need for their work.

On LinkedIn, a super admin can do everything, including adding or removing admins and deactivating the page. A content admin publishes posts and manages events; an analyst sees analytics only. Separate roles exist for paid media.

Settings to turn on this week

Two-factor authentication for everyone. Meta already requires it for certain business portfolios older than 90 days, and recommends making it mandatory for everyone with access. The setting lives in your portfolio settings: require it for everyone, not just admins. On LinkedIn, each admin turns on two-step verification in their own settings; LinkedIn recommends an authenticator app as the preferred method.

Skip text messages when a better option exists. Our guide to choosing MFA explains why an app or a passkey stands up better to phishing.

At least two trusted admins. Never just one, so you don't lose everything if that account is hacked or that person leaves. And not ten either: every full-access account is a way in.

Recovery emails you own. Single-login accounts should be tied to a company address (a shared communications mailbox, for example), not an intern's personal email.

Unique passwords. A business password manager lets you share a login without revealing it and change it in one click.

Third-party apps under watch. Scheduling tools and extensions connected to your accounts often keep their permissions for years. The Canadian Centre for Cyber Security recommends regularly identifying these apps and removing the ones you no longer use.

Employees, interns, agencies: managing arrivals and departures

Most "lost" pages are lost when someone leaves. A former employee stays an admin for years, or the agency from three contracts ago still has full control.

Three simple rules:

1. The company is the owner. Your Meta business portfolio and LinkedIn Page are tied to people in leadership, not only to the vendor who set them up.
2. Agencies use partner access. Meta lets you give another business access to specific assets without sharing a password. You remove that access in one click when the engagement ends.
3. Departures trigger revocation. Removing social media access belongs on your employee offboarding checklist, right next to email and VPN.

If an account gets hacked anyway

1. Use official channels. For Meta, facebook.com/hacked walks you through recovering an account or page, and Meta also offers identity verification with an optional video selfie. For LinkedIn, go through the Help Centre. Ignore "recovery experts" who message you.
2. Act from a clean account. If another admin still has access, they remove the compromised account immediately.
3. Cut off payment. Remove the card from the ad account and alert your financial institution.
4. Warn your community through your other channels: website, newsletter, another platform.
5. Assess what was exposed. Private messages, customer lists, lead forms: note what the attacker could see and document the incident.

The Canadian Centre for Cyber Security recommends planning for this scenario in a written response plan and rehearsing it before you need it.

Social media security checklist

• An up-to-date list of company accounts and their admins
• At least two trusted admins per page, and no more than necessary
• Two-factor authentication required for everyone in the Meta portfolio
• Two-step verification turned on by every LinkedIn admin
• Recovery emails owned by the company
• Unique passwords stored in a business password manager
• Third-party apps reviewed and cleaned up every quarter
• Agencies connected through partner access, revoked when the contract ends
• A written takeover procedure: who does what, and who calls whom

The bottom line

Your social media accounts are a storefront. Keeping them secure is mostly about discipline: named accounts, enforced two-factor authentication and regular reviews of who can do what. An hour of cleanup today saves weeks of trying to recover a page.

These checks are part of our cybersecurity audit: we review your cloud and social media accounts, their admins and their settings, and hand you a prioritized list of fixes. If someone is already impersonating your brand, our guide to fake websites and brand impersonation covers the takedown process.