Where do takeovers come from?
The way into a business account is usually not advanced hacking. It is a password reused from another service that was leaked, fake emails or DMs that lead you to a copycat login page, and staff sharing one password. Shared passwords end up in notes and chats, and people who have left the company often still know them.
Most takeovers happen to accounts that can be accessed with a password alone. Put the other way around, adding just one more check beyond the password stops many of these attacks.
Start with two-factor authentication
Two-factor authentication requires a code that only your smartphone or similar device can produce, in addition to the password. Even if the password leaks, someone without the code cannot log in.
As of October 2026, the main networks offer these methods.
| Network | Available methods | Official guide |
|---|---|---|
| X | Text message, authentication app, security key. Plus backup codes | How to use two-factor authentication |
| Authentication app, text message and others. Plus backup codes | Set up two-factor authentication | |
| Authentication app, text message and others | The two-factor authentication section of the Facebook Help Center |
If you can choose, pick an authentication app over text messages. If someone takes over your phone number, they can also intercept the codes sent by text. An authentication app, such as Google Authenticator or Authy, shows a 6-digit code that changes with time.
Where to keep backup codes
Once two-factor authentication is on, be sure to save the backup codes (spare codes for when you lose your phone). If you rely only on the staff member's smartphone, the company cannot get into the account when that person changes phones or leaves. Keep backup codes somewhere the company controls, such as a company safe or a password manager, not with an individual employee.
Don't share passwords
When several people run an account, the worst thing to do is share one password among everyone. You lose track of who did what and when, and the only way to cut off someone who left is to change the password.
The basic approach is to use each network's feature for giving permissions to individual people. On Facebook Pages, managing Page access lets you give each person either full control or partial access. People with full control can remove others or delete the Page, so give it to as few people as possible, while making sure at least one person always has it.
On networks like X and Instagram, where per-person permissions are limited, a management service that connects through each network's official authorization (OAuth) lets your staff post without being given the password.
Spotting fake emails and DMs
The most common way passwords get stolen is a fake email or DM that claims to be from the network. The usual signs are text that rushes you and a link to a login page: "We received a copyright complaint and will suspend your account," "Your verification badge application was approved," "We noticed unusual login activity." Business accounts really do receive messages like these, which is why staff are easily fooled.
The surest way to tell is not to click the link, and instead open the network's app or official site yourself to check. If there really is a problem, it will show in the app's notifications or settings too. If you clicked and a login page appeared, do not enter your password. If you realize you already did, change the password right away from the real app and log out other devices.
Rather than blaming people who fall for fake messages, build a setup where nothing happens even if they do. With two-factor authentication on, someone without the code cannot log in even if the password was entered.
What to check when staff change
Takeovers come not only from outside but from gaps in management. When someone leaves or moves to another role, check the following.
| What to check | Why |
|---|---|
| Permissions not removed | Whether the person who left still has admin access |
| Login email address | Whether the account was registered with the staff member's personal email |
| Two-factor authentication phone number | Whether it is the staff member's personal number |
| Connected apps | Whether you still allow access to apps you no longer use |
| Password | Change it if it was shared |
The best protection is to use a company email address and phone number from the start for logging in and for two-factor authentication. If they belong to an individual, the company may be unable to recover the account the moment that person is gone.
What to do if you are taken over
If you think your account may have been taken over, first check whether you can still log in. If you can, change the password right away and log out other devices. If you cannot log in, follow the account recovery steps in the network's help.
At the same time, stop scheduled posts and automatic replies and DMs, and tell followers through another channel (your website or another network) that "the account may have been taken over, so please do not click links in DMs you received." Once you have it back, review connected apps and permissions and look back at how the attacker got in. As with preventing and handling a social media crisis, write down in your operating rules ahead of time what to do so that you can act calmly.
What you can do in SNS TOWN
SNS TOWN connects to X, Instagram, Facebook and others through each network's official authorization (OAuth), so you never need to give members your network passwords. Members log in with their own SNS TOWN accounts and work within the scope set in members and roles. Remove someone from the members and they lose access immediately, with no need to change passwords on the network side.
Protection for the SNS TOWN account itself is covered in account security. It includes two-factor authentication (an authentication app plus 10 single-use recovery codes), a list of logged-in devices with log out of all, an email when someone logs in from an unfamiliar device, and a temporary lock after repeated failed logins. For each company or brand, you can also require two-factor authentication for all members.
In addition, access restriction lets you limit where a company or brand can be opened to specific IP addresses or registered devices. It is off by default, and a setting that would lock you out is not accepted when you turn it on. The full picture is explained in Security.
可免费试用 7 天，无需绑定信用卡。
免费开始Frequently asked questions
Won't two-factor authentication make it harder for several people to share an account?
If you run the account by sharing one password, it does get harder, because only one person can receive the code. Treat this as a reason to stop sharing the password, and move to a per-person permission feature or a management service that connects through official authorization.
I lost the phone that has my authentication app
Log in with the backup codes you saved, then set up the authentication app again on your new phone. If you do not have backup codes, follow the recovery steps in the network's help. To be ready for this, keep backup codes in a place the company controls.
I received a DM saying "your account will be suspended"
Assume that any DM or email that claims to be from a network and asks you to log in is probably fake. Do not click the link. Open the network's app or official site yourself and check whether a notification or warning really exists.
Is it okay to tell an agency our password?
Giving out a password means you cannot tell who did what, and access can remain after the contract ends. Where the network lets you give permissions to individuals, such as Facebook Pages, do that. For the rest, it is safer to use a management service that connects through official authorization, so you never have to hand over the password.
Is two-factor authentication by text message good enough?
It is far safer than not having it. But if you can choose, an authentication app is less affected by phone number takeovers. It is fine to start with text messages and switch to an authentication app once you are used to it.
