Keep Your Business Facebook Page from Being Hijacked

The question we actually get

"Our page just received a warning that it violates copyright rules and will be disabled tomorrow. The message tells us to click a link and log in to appeal. Is this real?"

Almost certainly not. This exact message lands in the inboxes of Lao shops, restaurants, guesthouses, and distributors every week. For many small businesses here, the Page is the shopfront: product photos, reviews, years of messages, and the ad account. Losing it can mean weeks without orders.

Most hijacks do not use clever hacking. They reuse the same few tricks, and a simple setup blocks nearly all of them. This guide explains the tricks, the ownership and access setup that stops them, a five-minute monthly check, and what to do in the first hour if the worst happens. For most businesses with fewer than ten people touching the page, we would do this in one afternoon, because it is careful account hygiene, not expensive software.

How pages actually get hijacked

There are five routes we see again and again.

1. Fake violation warnings. A message or email claims your page broke some rule and will be deleted within 24 to 48 hours unless you appeal through their link. The pressure is the point: panic makes people click. Real platform warnings appear inside the official business tools when you log in normally, not through a link a stranger sends you.

2. Fake login pages. The link leads to a page that looks like a login screen. You type your email and password, and the attackers collect them. If you arrived through a link in a message, close it and open the app or site yourself instead.

3. Malware hidden in business files. An "invoice", "price list", "product catalogue", or job application arrives as a zip file or a program. Opening it installs software that steals saved passwords and login sessions from the computer. This route is common where one shared PC handles both sales chat and supplier files. More on that habit here: phishing awareness for staff.

4. A personal account takeover. Pages are managed through personal accounts, so whoever controls an admin's personal account controls the page. Attackers take the personal account first, then remove the real owners.

5. Old access that was never removed. A former staff member, an ex-agency, or a freelancer who helped with ads still holds full control months later. Leftover admins are one of the most common things we find when we review a page, which is why the cleanup below matters as much as any password.

The setup that prevents most hijacks

The goal is simple: the business owns the page, not any one person, and every person holds only the access they need.

Put the page under the business account. Use the platform's business management tools (often called the Business Suite or business settings area) so the page belongs to the business, not to one employee's personal profile. Confirm the page appears there as an owned asset. If the page was created long ago under a personal profile, move it into the business structure now, while everyone is calm and cooperative.

Keep at least two trusted owners. One stolen password or one lost phone and nobody can recover the page. Assign full control to two people who will stay with the business long term, ideally the owner plus one deputy.

Give staff task access, not full control. Most daily work needs only limited rights. Grant each person the smallest set of tasks that covers their job, and nothing more. The person who answers customer chat does not need the right to remove other admins. Fewer full admins means fewer doors for attackers.

Protect every admin login with two-factor checks. Every person with meaningful access must switch on two-factor authentication, and we recommend an authenticator app or a hardware security key rather than SMS codes alone, because text messages can be intercepted when a phone number changes hands. Each admin should also set a strong unique password kept in a password manager. More on the options: password policy and MFA.

Use a business email on your own domain. Register the business account with an email address on your company's own domain instead of a free mailbox tied to one person. When staff change, the business keeps the inbox. Use a mailbox that more than one owner can reach, so a password reset never depends on someone who has left.

Separate the ad payment method and cap it. Attach one payment method used only for ads, with a spending limit that matches a normal month. Review the ad charges each month alongside the access check below.

Who should be able to do what

Decide roles once, write them down, and compare the real access list against this table every month.

Nobody outside these roles needs any access, including strangers who offer to "fix" a warning. Agencies and freelancers get task access with an end date, removed the week the work ends. Anyone who leaves loses access on their last day, the same way you would collect a shop key.

The monthly 5-minute check

Put a repeating reminder on the first Monday of each month. One owner opens the access list and works through this list. It takes about five minutes.

• Count the people with full control. There should be exactly the two trusted owners, no more.
• Read every name on the list out loud. Anyone you do not recognise, or who no longer works with you, gets removed.
• Confirm each remaining person still needs their current tasks. Downgrade anything that no longer matches the job.
• Check that both owners still have two-factor authentication switched on with an app or key.
• Confirm the contact email still belongs to the business and its inbox still works.
• Glance at recent login alerts and the ad spending line for anything unfamiliar.

Write the date and the result in a notebook or shared note: "Checked 3 March, 2 owners, 3 staff, removed 1 ex-designer." If you run a second page, repeat the same five minutes there; attackers pick the page you forgot.

The first hour after a hijack

We cannot promise the platform will return the page, and anyone who guarantees recovery is selling you something, but quick action keeps the damage small either way.

1. Secure the personal accounts first. From a clean device, change every admin's personal account password and switch on two-factor authentication with an authenticator app. Attackers often keep control through the personal login even after you remove them from the page, so this step comes first. If a device may carry malware, use a different one and get the suspect machine scanned first.

2. Ask the remaining owners to remove the intruder. If any trusted owner still has access, they should remove unknown admins immediately, then re-check the list twice: intruders sometimes add a second hidden account as backup. Take screenshots of the unknown names first.

3. Use the platform's official help pages for hacked accounts. Open the help centre yourself through the app's own help section, and follow the flow for hacked accounts and pages. Never follow links from the message that started the problem, and never pay a third party that claims it can force the platform to act.

4. Warn your customers through other channels. Post from your other accounts, your shop's messaging groups, and a printed notice at the counter: "Our page is having problems today. Do not click links it sends, and do not transfer deposits to new account details until we confirm here." Most secondary damage comes from customers trusting messages the hijacker sends in your name.

5. Preserve evidence and tighten up. Save copies of the scam message, the fake link address, and the screenshots of unknown admins. Then run the full setup from the earlier sections. Rebuilding this way makes it much harder for the same trick to work twice.

Your one next step this week

Open the list of people with access to your page, count how many hold full control, and write the names down. If the number is more than two, or if anyone on the list no longer works with you, that is your starting point.

Send us that count on WhatsApp along with how many staff reply to customers each day, and tell us whether your page sits inside a business account or under someone's personal profile, and we will reply with which roles each person should hold.