Protecting Your Business Account from Takeover: 2FA, Permissions and Sharing

Where do takeovers come from?

The way into a business account is usually not advanced hacking. It is a password reused from another service that was leaked, fake emails or DMs that lead you to a copycat login page, and staff sharing one password. Shared passwords end up in notes and chats, and people who have left the company often still know them.

Most takeovers happen to accounts that can be accessed with a password alone. Put the other way around, adding just one more check beyond the password stops many of these attacks.

Start with two-factor authentication

Two-factor authentication requires a code that only your smartphone or similar device can produce, in addition to the password. Even if the password leaks, someone without the code cannot log in.

As of October 2026, the main networks offer these methods.

If you can choose, pick an authentication app over text messages. If someone takes over your phone number, they can also intercept the codes sent by text. An authentication app, such as Google Authenticator or Authy, shows a 6-digit code that changes with time.

Where to keep backup codes

Once two-factor authentication is on, be sure to save the backup codes (spare codes for when you lose your phone). If you rely only on the staff member's smartphone, the company cannot get into the account when that person changes phones or leaves. Keep backup codes somewhere the company controls, such as a company safe or a password manager, not with an individual employee.

Don't share passwords

When several people run an account, the worst thing to do is share one password among everyone. You lose track of who did what and when, and the only way to cut off someone who left is to change the password.

The basic approach is to use each network's feature for giving permissions to individual people. On Facebook Pages, managing Page access lets you give each person either full control or partial access. People with full control can remove others or delete the Page, so give it to as few people as possible, while making sure at least one person always has it.

On networks like X and Instagram, where per-person permissions are limited, a management service that connects through each network's official authorization (OAuth) lets your staff post without being given the password.

Spotting fake emails and DMs

The most common way passwords get stolen is a fake email or DM that claims to be from the network. The usual signs are text that rushes you and a link to a login page: "We received a copyright complaint and will suspend your account," "Your verification badge application was approved," "We noticed unusual login activity." Business accounts really do receive messages like these, which is why staff are easily fooled.

The surest way to tell is not to click the link, and instead open the network's app or official site yourself to check. If there really is a problem, it will show in the app's notifications or settings too. If you clicked and a login page appeared, do not enter your password. If you realize you already did, change the password right away from the real app and log out other devices.

Rather than blaming people who fall for fake messages, build a setup where nothing happens even if they do. With two-factor authentication on, someone without the code cannot log in even if the password was entered.

What to check when staff change

Takeovers come not only from outside but from gaps in management. When someone leaves or moves to another role, check the following.

The best protection is to use a company email address and phone number from the start for logging in and for two-factor authentication. If they belong to an individual, the company may be unable to recover the account the moment that person is gone.

What to do if you are taken over

If you think your account may have been taken over, first check whether you can still log in. If you can, change the password right away and log out other devices. If you cannot log in, follow the account recovery steps in the network's help.

At the same time, stop scheduled posts and automatic replies and DMs, and tell followers through another channel (your website or another network) that "the account may have been taken over, so please do not click links in DMs you received." Once you have it back, review connected apps and permissions and look back at how the attacker got in. As with preventing and handling a social media crisis, write down in your operating rules ahead of time what to do so that you can act calmly.

What you can do in SNS TOWN

SNS TOWN connects to X, Instagram, Facebook and others through each network's official authorization (OAuth), so you never need to give members your network passwords. Members log in with their own SNS TOWN accounts and work within the scope set in members and roles. Remove someone from the members and they lose access immediately, with no need to change passwords on the network side.

Protection for the SNS TOWN account itself is covered in account security. It includes two-factor authentication (an authentication app plus 10 single-use recovery codes), a list of logged-in devices with log out of all, an email when someone logs in from an unfamiliar device, and a temporary lock after repeated failed logins. For each company or brand, you can also require two-factor authentication for all members.

In addition, access restriction lets you limit where a company or brand can be opened to specific IP addresses or registered devices. It is off by default, and a setting that would lock you out is not accepted when you turn it on. The full picture is explained in Security.

Frequently asked questions