Business social media accounts often grow in bits and pieces.

One employee creates the Facebook Page. Someone else connects Instagram, and an outside agency is later given access to run advertising. Your LinkedIn Page may still be tied to the employee who set it up, while the recovery phone number for another account belongs to someone who left years ago.

Everything can continue working, so nobody has a reason to check how the accounts are set up.

That changes when an employee leaves, an agency relationship ends, or someone receives a password-reset alert they didn’t request. You may then discover that nobody knows which email address owns the account, who has full control, or how the business would recover access.

A compromised social media account can be used to publish scams, send fraudulent messages, access private conversations, or spend money through a connected advertising account. Even if the problem is fixed quickly, customers may have already seen posts or messages that appeared to come from your business.

The best time to sort out ownership and access is before any of that happens.

Make a list of every account connected to your business

Start by identifying every social media account your business owns or manages.

Include the obvious company pages, but also look for regional accounts, old campaign pages, YouTube channels, advertising accounts, and profiles created for individual locations or services.

For each account, record the platform, page or profile name, public handle, business owner, current administrators, recovery email address, recovery phone number, and any connected advertising or payment account.

You should also note which agencies, contractors, scheduling tools, or other applications can publish content or read information from the account.

This list gives you somewhere to start when an employee leaves or an account behaves unexpectedly. Without it, your IT provider may have to search old emails and ask several people just to work out who can still sign in.

Keep the list somewhere approved by your business, but don’t put passwords in the document. Passwords and recovery codes belong in a business password manager.

Keep ownership under the business’s control

An employee may have created a social media account using their personal email address or mobile phone because they were the person handling marketing at the time.

That arrangement puts the business in a difficult position if the employee leaves, loses access to the email account, changes their phone number, or becomes unavailable.

Check that the main recovery email address belongs to the business and will continue to exist when staff change. The same applies to the phone number used for account recovery or security alerts.

Avoid relying on an email inbox that only one employee can access. A monitored business address, such as a dedicated marketing or social media administration account, gives the business more control. Protect that mailbox with MFA and restrict access to the people responsible for account recovery.

Where the platform allows it, have at least two carefully chosen people who can manage access. Keep that group small, but make sure the business isn’t dependent on one person who might be unavailable when help is needed.

Recovery codes should also be stored securely. If one employee keeps the only copy on their phone or in a personal password manager, the business may lose its backup access when that person leaves.

Give each person their own access

If several employees manage the same social media account, they shouldn’t all use one username and password.

Most major platforms provide ways to assign access without sharing the main login.

Facebook Pages can give people full control, partial control, or task access. LinkedIn assigns Page permissions to individual member profiles, and LinkedIn states that Pages don’t have separate usernames or passwords. X provides a Delegate feature that lets an owner assign administrator or contributor roles without sharing the account password. YouTube also offers channel permissions, allowing several people to manage a channel through their own Google accounts.

These features give each person their own way to sign in. You can remove one employee or agency without changing access for everyone else, and you have a better record of who performed each action.

Sharing one personal profile is especially risky. On LinkedIn, for example, profiles are meant to belong to individual people, and sharing login details can lead to account restrictions.

Match each person’s access to their work

Someone who creates posts may not need permission to add administrators, change recovery details, or manage payment methods.

Give each person the lowest level of access that still lets them do their job. Your social media manager may need to publish content and reply to messages, while an analyst may only need to view reports. An outside agency running advertisements shouldn’t automatically receive full control of the company page.

Be careful when assigning the highest level of access. Meta warns that a person with full control of a Facebook Page can give access to others, remove existing administrators, or delete the Page.

Review permissions whenever someone changes roles. An employee who moved out of marketing two years ago may still have access simply because nobody removed it..

Require MFA for everyone with access

A password can be stolen through phishing, malware, password reuse, or a fake login page. MFA adds another check before the account allows someone to sign in.

Require MFA for every employee, contractor, and agency account that can manage your business pages. This includes people who only post content because their individual account can still become a way into the business page.

Use the strongest method the platform supports. Security keys and passkeys offer strong protection against phishing because they check that the person is signing in to the correct website. An authentication app is another good option.

SMS and email codes still provide more protection than a password alone, but they can be exposed through phishing, email compromise, or attacks against a mobile phone account. CISA recommends that businesses use phishing-resistant MFA where possible.

Don’t approve an unexpected sign-in prompt. If an employee receives an MFA request when they aren’t signing in, they should reject it and report it to the person responsible for the account.

Protect the email account used for recovery

Your recovery email can be just as important as the social media password.

If an attacker gets into that mailbox, they may be able to reset the social media password, approve security changes, and intercept warnings from the platform. They may then change the recovery details and make it harder for you to regain access.

Cyber.gov.au specifically recommends protecting the email address linked to a social media account with MFA.

The mailbox should have a unique password, MFA, and a current recovery method. Your IT provider should also check for unexpected forwarding rules, unfamiliar sign-ins, and changes to recovery details if you suspect either the email or social media account has been compromised.

Watch for fake warnings and support messages

Social media administrators regularly receive messages claiming that a page has broken a rule, used copyrighted material, lost verification, or needs to confirm its identity.

Some of these messages are phishing attempts. They send the recipient to a fake login page designed to steal a password and MFA code. Others ask the recipient to add a supposed support representative as an administrator.

Treat unexpected warnings carefully, even when they include your logo, page name, or details from a recent post.

Open the platform through its normal app or website and check the account’s support or notification area there. Don’t sign in through a link sent in a direct message, comment, or unexpected email.

Never send a password, verification code, backup code, or authentication-app code to someone claiming to provide support. Legitimate support staff shouldn’t need those details.

The April 2026 guidance from the Australian Signals Directorate tells organizations not to share passwords, registration codes, or verification codes, particularly with accounts claiming to represent a platform.

Review connected apps and scheduling tools

Your social media accounts may be connected to scheduling platforms, analytics services, competition tools, customer support systems, or advertising software.

These tools can save time, but some receive permission to publish posts, read messages, view account information, or manage advertising. If the third-party service is compromised, an attacker may be able to use the access you granted without needing your social media password.

Review connected applications in each platform’s security settings. Remove tools the business no longer uses and question any connection you don’t recognise.

For the applications you keep, check what each one can access. A reporting tool may only need analytics, while a scheduling platform may need permission to publish. It shouldn’t receive broader access without a clear reason.

CISA’s guidance on social media account protection recommends limiting third-party applications, reviewing their permissions, and protecting API keys or tokens that allow tools to act on the organisation’s behalf.

Remove access when someone leaves

Social media access should be part of your normal offboarding process.

When an employee or contractor leaves, remove their page roles, advertising permissions, delegated access, and access to connected tools. If they knew a shared password, change it and review active sessions.

Don’t assume that removing someone from one platform also removes their access everywhere else. An agency may have separate permissions for the company page, advertising account, scheduling tool, analytics platform, and shared file storage.

Check them one by one.

You should also confirm that recovery email addresses and phone numbers still belong to people who work for the business. An old phone number can become a problem if the number is later reassigned to someone else.

Check active sessions and security alerts

Most social platforms let you review devices or locations where the account is currently signed in.

Look for devices you don’t recognise, locations that don’t fit your team, and sessions that have remained active longer than expected. Remember that location information based on an IP address may be approximate, so an unfamiliar city doesn’t prove that an account has been hacked.

If something looks wrong, ask the relevant employee whether the session belongs to them. When it doesn’t, sign the device out, reset the affected credentials, and review recent activity.

Turn on alerts for new logins or security changes where the platform offers them. Send those alerts to an address that is monitored, rather than to an employee’s inbox that nobody checks when they’re away.

Pay attention to advertising and payment access

A compromised social account may also give an attacker access to advertising tools.

Review who can create campaigns, change spending limits, and manage payment methods. Remove cards or payment accounts that are no longer used, and turn on available alerts for spending or campaign changes.

If your platform separates page access from advertising access, review both. Removing someone from the public page doesn’t always remove them from the advertising account or business management system.

Ask whoever reviews company card statements to report unfamiliar social media charges promptly. A small charge may be the first sign that someone is testing whether an advertising account still works.

Decide what you’ll do if an account is hacked

Write down the recovery process before you need it. The plan should identify who will contact the platform, who will secure the linked email account, and who can approve a public statement if customers received fraudulent messages.

Keep links to the platform’s official recovery pages in your account register. That reduces the chance of an employee searching for help in a hurry and ending up on a fake support page.

If you believe an account has been compromised, use a trusted device to change the password and end unfamiliar sessions. Check whether the attacker added administrators, changed recovery details, or connected a new application.

Secure the linked email account as well. If you only reset the social media password while the attacker still controls the recovery mailbox, they may be able to take the account back.

Save screenshots and record the times of suspicious posts, messages, advertisements, and account changes. If fraudulent content was sent to customers, warn them through a channel you still control and tell them what they should ignore.

CISA recommends including compromised devices, unauthorised access, fraudulent posts, and exposed private communications in a social media incident response plan.

Review the setup regularly

Check social media ownership, administrators, connected apps, recovery details, and advertising permissions at least a few times a year.

Repeat the review whenever an employee changes roles, someone leaves, or you start or finish working with an outside agency. Security settings can also change as platforms add features, so include them in the review.

The goal is to make sure you can answer four questions without searching through old messages:

Who owns each account? Who can access it? How is that access protected? What will you do if the account is taken over?

If those answers are documented and current, recovering from a problem becomes much easier.