Your business Facebook page was hacked: how to get it back
Recover your own account at facebook.com/hacked, then file Meta's hacked Page form, and once you're back in, turn on 2FA and remove admins you don't know.
UB Web Developers team
If someone has taken over your business Facebook page, first recover your own Facebook account at facebook.com/hacked (opens in new tab), then ask Meta to restore the page through its hacked Page form (opens in new tab). Meta says (opens in new tab) it aims to reply within a day, but it can only act once it confirms the page was compromised.
The order matters. People manage a page through their personal accounts (Meta (opens in new tab)), so until the account that lost the page is safe again, there is nobody safe to give it back to.
How do business pages get taken over?#
The takeovers that security researchers documented in 2025 and 2026 started with a message that looked like it came from Meta.
- On 10 November 2025, Check Point (opens in new tab) reported 40,000 phishing emails sent to more than 5,000 of its customers. Attackers set up fake business pages and used Facebook's own business invitation feature, so the emails came from Meta's real facebookmail.com address. Subject lines included "Account Verification Required" and "Meta Agency Partner Invitation". The links led to fake login pages.
- On 29 April 2026, Guardio Labs (opens in new tab) described a campaign it estimates took over about 30,000 Facebook accounts, aimed at business account owners and page admins. The emails posed as Meta Support and warned of policy violations, copyright complaints or permanent disablement. The fake pages asked for passwords, two-factor codes and photos of government ID.
The pattern repeats: an official-looking message about your page or account, often with a threat or a deadline, and a link to a page that asks you to log in or "verify". Meta's phishing guide (opens in new tab) lists threats to close your account as a warning sign.
How can I tell a real Meta warning from a fake one?#
Don't trust the sender address on its own. Meta lists (opens in new tab) the domains its email comes from: fb.com, facebook.com, facebookmail.com, instagram.com, meta.com and metamail.com. But its own phishing page warns that malicious Business Manager partner requests have arrived from facebookmail.com, and the Check Point campaign used that address too.
Check inside Facebook instead:
- Open facebook.com/recent_emails/security (opens in new tab), or Accounts Center > Password and security > Recent emails. Meta lists the security emails it sent you in the past year there. If a warning isn't listed, don't act on it.
- If a message says your page broke a rule, type the Facebook or Meta Business Suite address yourself and look at the page there. Don't follow the link in the message.
- In Mongolia, you can copy a link you're unsure about, without opening it, and paste it into zalilan.113.mn (opens in new tab), a link checker from the Public Center for Combating Cyber Attacks and Breaches. The site asks anyone hit by fraud or a cyber attack to report it on the centre's website, 113.mn (opens in new tab).
Meta lists (opens in new tab) these signs that an account was taken: a changed profile picture, posts or messages you didn't write, trouble logging in, login alerts you don't recognise, and an email address or phone number you didn't change.
How do I get my page back?#
Work through Meta's routes in this order, on a phone or computer you've used to log in to Facebook before (Meta (opens in new tab)).
- Go to facebook.com/hacked (opens in new tab) and follow the steps to secure your personal account. If the attacker changed your email address, Meta sends a message to the old address with a link that reverses the change.
- Once you're in, open "Where you're logged in" in your settings and log out of every device and location you don't recognise.
- If you can't reach the email address or phone number on the account, use Meta's separate guide (opens in new tab) for that case.
- Logged in to the account that lost the page, ask for it back with the hacked Page form (opens in new tab). It asks which page you lost access to. You can only submit it if you recently lost access: if no page appears to choose, Meta's Page guide (opens in new tab) says that's because it doesn't see a recent loss of access, and suggests trying to open the page again. The same guide covers pages lost through Business Manager or Meta Business Suite.
- Watch your email for Meta's reply. Meta aims to reply within a day, "but some reviews may take longer".
If Meta removed the page for breaking its rules rather than someone hacking it, that is a different process, covered on Meta's removed Page (opens in new tab) help page.
What should I lock down once I'm back in?#
Meta's Page guide (opens in new tab) says to unlock your account if it was locked, review your page and business portfolio, undo any changes you don't recognise, and turn on Advanced Protection (opens in new tab). Meta lists page admins and business accounts that advertise among the accounts Advanced Protection is for. It requires stronger logins, such as passkeys or two-factor authentication, and scans your account for weak spots.
The Guardio report is a reminder that two-factor codes can be phished too. The protection only holds if the code goes into Facebook itself and nowhere else.
Why shouldn't the page be your only channel?#
Even when recovery goes well, the page is out of your hands until Meta's review ends, and Meta decides whether it can act. While it's gone, customers who look for you there find nothing from you, or posts under your name that you didn't write.
That is the case for keeping a website and an email list you own alongside the page, which we set out in Stop building your business on rented land. The page is still worth having. It just shouldn't be the only place your customers can reach you.
Sources#
- Meta, Recover a hacked Facebook Page that you manage (opens in new tab), Facebook Help Center
- Meta, Hacked Page recovery form (opens in new tab), Facebook Help Center
- Meta, Recover your Facebook account if you were hacked (opens in new tab), Facebook Help Center
- Meta, Check whether an email is really from Facebook (opens in new tab), Facebook Help Center
- Meta, Protect yourself from phishing on Facebook (opens in new tab), Facebook Help Center
- Meta, How two-factor authentication works on Facebook (opens in new tab), Facebook Help Center
- Meta, How to enable Advanced Protection on Facebook (opens in new tab), Facebook Help Center
- Meta, About Facebook Page access (opens in new tab), Facebook Help Center
- Check Point, New phishing campaign exploits Meta Business Suite to target SMBs (opens in new tab), 10 November 2025
- Guardio Labs, AccountDumpling: the Google-sent phishing wave hijacking 30k Facebook accounts (opens in new tab), 29 April 2026
- Public Center for Combating Cyber Attacks and Breaches, zalilan.113.mn link checker (opens in new tab)
- Public Center for Combating Cyber Attacks and Breaches, 113.mn (opens in new tab)
Frequently asked questions#
How long does Meta take to restore a hacked Facebook page?#
Meta says it aims to reply to a hacked Page report within a day, but some reviews take longer. It can only act once it confirms the page was compromised. See Recover a hacked Facebook Page that you manage (opens in new tab).
Can I get my page back if the hacker removed me as an admin?#
You can ask Meta to restore it. Its hacked Page form (opens in new tab) is for that case, but you can only submit it while logged in, and only if you recently lost access. Log in to the personal account that lost the page first, recovering it at facebook.com/hacked (opens in new tab) if you need to, then choose the page in the form. If the form won't let you choose it, Meta says (opens in new tab) that means it doesn't see a recent loss of access, and suggests trying to open the page again. Meta acts only if it can confirm the page was compromised.
How do I know if an email from Facebook or Meta is real?#
Check it inside Facebook, not in your inbox. Open facebook.com/recent_emails/security (opens in new tab), or Accounts Center > Password and security > Recent emails. A facebookmail.com sender on its own is not proof, because attackers have sent phishing through Meta's own invitation feature.
Will Meta ever ask for my password or a login code?#
Meta says it will never ask for your password in an email, and that its representatives won't ask for money or payment details over chat or email. Treat any page that asks for a password or a two-factor code after you followed a link as phishing.
What if I can't access the email or phone number on my Facebook account?#
Meta has a separate guide for that case: recover your account without your email or phone (opens in new tab).