Work out what was taken: page, admin profile, ad account and website are four different losses
A hacked company account can mean at least four things, each with a different recovery door, so identify which before acting. The first is a compromised personal profile. Business pages usually hang off an employee's personal account; when that account is phished or its password reused elsewhere, the page goes with it. This is the most common case and the door is recovering the personal profile first. The second is a page transfer: the intruder adds themselves as an administrator and removes everyone else, so the page exists but no longer answers to you.
The third is ad account abuse. The page looks normal, but the payment method attached to it is funding someone else's advertising. Companies usually notice only when the card statement arrives, and both the platform and the card issuer must be handled; the card side is in how to dispute unauthorised card charges. The fourth is the website itself: a defaced home page, injected redirects or gambling links, planted content in the back end, or DNS records pointed elsewhere. The door here is the hosting provider and the domain registrar, not a social platform; domain-level problems are covered in what to do when a domain lapses or a site is hijacked.
The test is simple: try each login. Can the administrator still reach their profile? Are you still listed as a page admin? Does the ad account show unfamiliar campaigns or charges? Do the website back end and hosting console still open? Does the company mailbox have a forwarding rule nobody created? Write normal, lost or unknown against each item on one sheet. Every later step depends on it. Never assume only one thing is gone: an intruder holding one mailbox password will usually try it everywhere.
The first hour: protect customers, then evidence, then the accounts
First, announce on a channel you still hold. A second social account, the website if it is intact, customer chat groups, the owner's personal profile, email: use whichever remains. Three sentences are enough. This account is currently outside our control. Any payment request, transfer instruction, promotion or link it sends is not from us. Our receiving bank details have not changed, and you should call this number back before paying anything. That notice usually prevents more loss than the account itself is worth.
Second, capture evidence. Screenshot the posts, private messages and advertisements the account is sending, with the page address and the time visible. Keep every platform email about a password change, a new administrator or a new sign-in; do not delete them. If a customer has already paid, ask for their chat history and transfer receipt. These are your police file and also your proof of ownership when you appeal to the platform.
Third, freeze what can still be frozen. Block or limit the card attached to the ad account through the issuing bank. Change the password on every account that shared the compromised one, starting with email because the mailbox is the recovery route for everything else. Look for unfamiliar forwarding rules and recovery phone numbers in the mailbox. Have every administrator sign out everywhere and turn on two-step verification. Two things not to do: do not pay strangers who offer to recover the account. Such offers appear in comments and private messages the moment you ask for help publicly, and nearly all are a second fraud. And do not negotiate a ransom with whoever took the account, because payment guarantees nothing and marks the company as a target for a second demand later.
Recovery: only the platform's official route, with four kinds of proof ready
There is no shortcut to recovery. The only route is the platform's own appeal process, and anyone claiming an inside channel should be ignored. Every major platform has a dedicated help path for a hacked account or a page taken over, and it usually works best when started from a device and network that previously signed in to the account, because that helps the platform recognise the original owner. Expect to supply four kinds of proof. Identity: the original administrator's valid ID. Business existence: registration papers and permits showing that the company behind the page is real and that you run it. Connection: traces of having created or long managed the page, past ad invoices, the company email and phone attached to it. An incident account: your timeline and the platform notification emails you kept.
If the company has a business management portal or a verified business account, start there rather than from a personal profile. If you advertise regularly, the advertiser support channel tends to respond more directly. Keep the case number, answer requests for more documents, and avoid opening many duplicate cases, which can lead to them being merged or pushed back.
For a hacked website, go to the hosting provider and whoever built the site. Have them reset console and back-end credentials, restore from a clean backup and check the server for files left behind. Changing the password without removing the backdoor is the most common reason a site is hacked again within days. If the site was built by a contractor, confirm who actually owns each account. Many companies learn during an incident that the hosting, the domain and the admin login are all registered to a vendor or a former employee. Recovery time varies with the platform's review, so leave the customer warning up throughout.
When customers have already paid the impostor: how to respond and where liability sits
If a customer paid because they trusted the stolen account, the company should help rather than deflect, but should not promise compensation before the facts are clear. Ask for the chat history, the receiving account details and the transfer receipt, and tell the customer to contact their own bank or e-wallet immediately to request a hold on the transfer and on the recipient account. Speed matters most here; the order of steps is in what to do after being scammed. Then issue a written statement on company letterhead confirming that the account was outside the company's control during a stated period and that the receiving account is not a company account. The customer will need it for the police and the bank.
Liability has no one-line answer. In principle the fraudster answers for the fraud. But where a company had no basic security for a long time, failed to warn customers promptly once it knew, or lost customer personal data in the same incident, the room for a negligence argument grows. That is why the first-hour notice and the evidence matter: they are the core of showing the company took reasonable care. If customer records were exported during the takeover, run the separate assessment in the customer data breach response guide to decide whether notification is required.
Three rules for external communication. State facts only and name no suspect. Do not argue amounts or blame with affected customers in public comment threads; move each conversation to a private one-to-one channel. Route every reply through one person. Many companies lose their reputation not through the takeover but through how they treated the customers who were hurt by it. For negotiations over compensation and shared responsibility, consult a licensed lawyer.
Reporting and the paper trail: who to report to, what to bring, what it achieves
A company account taken over and used for fraud is a cybercrime, reportable to the police anti-cybercrime unit or the National Bureau of Investigation's cybercrime division. Bring the company's registration documents with the authorised representative's ID and authorisation letter, the address of the compromised account with proof that you managed it, the timeline, the screenshots and platform emails, and whatever you have from affected customers including the receiving account details. A tidy file is accepted faster. How to fix electronic evidence so that it is usable is covered in the cybercrime reporting guide.
Keep expectations realistic. A complaint does not mean a quick arrest, and intruders are often abroad. It does serve three practical purposes. It gives you an official record that supports your appeal to the platform, a bank's decision to freeze a recipient account, and your explanation to customers and partners. If the recipient account is in the Philippines, coordination between investigators and banks can sometimes stop funds that have not yet moved, and earlier is better. And if someone keeps using your company name later, the record shows you declared the problem and acted on it at the outset.
Separately from the criminal complaint, if someone has opened a fake page or site under your company name, report the impersonation directly to the platform and keep the report reference. If content posted by the intruder harmed a third party who then approaches the company, show the complaint record and your public notice. Watch your own statements too: publicly accusing a competitor or a former employee without firm proof can make the company the defendant in a cyber libel case. The safest wording describes what happened to the account and what the company has done about it, and leaves the question of who was responsible to the investigators.
After recovery: move every account from a person's name to the company's
When a foreign-owned company loses its social accounts, the root cause is usually ownership rather than technology: the page was created from an employee's private profile, only that person knows the password, and it is tied to their private phone number. The first job after recovery is to bring ownership home. Register or take over each platform's business management portal with a company-domain email address. Keep at least two administrators, one of them the owner or an authorised officer. Require two-step verification for every administrator and keep printed backup codes locked in the office. Use company recovery addresses and numbers, never personal ones.
Second, write a digital asset register: domain, hosting, website back end, company mail, each social page, ad accounts and payment tools, with the registered holder, who has access, the expiry date and the recovery method against each. On the day anyone leaves, work down the list and revoke access. Third, agree the simplest possible emergency procedure: who to call, who may publish a warning and where the template is kept. Fourth, back up the website regularly and store the backup somewhere other than the host.
Yixing Travel Consultancy (SEC Registration No. CS202009551, Bureau of Immigration Accredited Agency No. CA-202624381-1) offers compliance retainer services to foreign-owned companies in the Philippines, including organising corporate documents and the digital asset register, preparing the business identity papers a platform appeal requires, assembling the complaint file and timeline, and connecting you with licensed counsel. We are not a cybersecurity firm and do not perform forensics or intrusion analysis. What we can do is make sure the company papers are complete when you explain yourself to a platform, the police and your customers. For your specific case consult a licensed lawyer; this article is not legal advice.
Frequently Asked Questions
Our company Facebook page was hacked. What should we do first?
Someone messaged offering to recover the account for a fee. Should we use them?
The hacker wants payment to give the account back. Should we pay?
A customer paid money to the stolen account. Is the company liable?
How long does recovery take?
Gambling links keep reappearing on our website after we change the password. Why?
A former employee created the page on a private profile and refuses to hand it over. What now?
Let’s talk through your situation — free
Every company is different. Leave your details and a Chinese-speaking advisor will get back within 1 business day with practical, industry-specific guidance and a transparent quote.
Get help with Compliance & Retainer → Free consultation