For many small businesses, Facebook, Instagram and WhatsApp are the shop front, the booking line and the customer service desk. So when Meta locks an account, the impact is immediate. This month, a Melbourne travel agent described losing access to all three after Meta’s systems flagged a suspicious overseas login. Instagram came back quickly, Facebook took about three weeks through a support chatbot, and WhatsApp was still blocked weeks later, forcing her to get a new number and contact clients another way.
Her story is common, and most of the damage is preventable. Here is how to protect your business accounts, and what to do if you are locked out.
Why business accounts get locked
- Suspicious logins from new locations or devices, sometimes caused by a real hacking attempt.
- Compromised email addresses or unknown emails added to the account. In the case above, the owner later found two email addresses she did not recognise linked to her account.
- Phishing messages pretending to be Meta, warning of a policy breach and asking you to “verify” your account.
- Automated policy enforcement that flags content or ads, rightly or wrongly.
Protect your accounts this week
1. Turn on two-factor authentication everywhere
Use an authenticator app rather than SMS where possible, on Facebook, Instagram, WhatsApp and Meta Business Suite.
2. Use Meta Business Suite with more than one admin
Do not run your business page from a single personal profile. Add at least two trusted admins with their own secured profiles, so one lockout does not take the business with it.
3. Check linked emails and phone numbers
Review the contact details and login sessions on every account. Remove anything you do not recognise and update recovery details.
4. Secure the email behind the account
If your recovery email is compromised, your social accounts are too. Turn on MFA for that mailbox as well.
5. Ignore “policy violation” messages that ask you to log in
Meta will not ask for your password through a message or a link to a strange website. Check alerts directly in the app.
Make sure your website is the channel you own
We build fast, search-ready websites with bookings, enquiry forms and email capture, so your business does not depend on one platform.
Have a backup plan for customers
The most important lesson from lockout stories is that a business needs channels it controls:
- Your website with clear contact details, online booking or an enquiry form.
- An email list of customers who have opted in.
- A phone number that is not tied to one app.
- Google Business Profile, so people searching can still find and call you.
Export your customer contacts regularly, and keep a draft “we have a new number” message ready for email and your website.
If you are locked out
- Use the official recovery flow in the app or at facebook.com/hacked. Do not pay anyone who offers to “recover” accounts.
- If another admin still has access through Business Suite, use their access to secure the page.
- Secure your email account first if you think it was compromised.
- Tell customers through your other channels where to reach you.
- Keep records of everything you submit to Meta, with dates.
Should you have cyber insurance?
The same story noted research from BizCover finding 84% of small businesses do not have cyber insurance. Insurance will not get your account back, but some policies cover business interruption and response costs after a cyber incident. Read the policy carefully to see what is included.
FAQ
How long does Meta take to restore a business account?
It varies widely, from minutes for automated recovery to weeks for manual reviews. That is why backup channels matter.
Can someone help me get my account back for a fee?
Be very careful. Many “recovery services” are scams. Use Meta’s official recovery options.
Sources
- Yahoo Finance: Aussie small business owner reveals ‘absolute nightmare’ after Meta accounts banned
- Meta: Recover a hacked account
- Australian Cyber Security Centre
Related: how to stop invoice scams and business email compromise.