Business WhatsApp, Facebook or Instagram Hacked? Recovery Steps

First 15 minutes: what to do right now

1. 1

   Start the official recovery

   WhatsApp: open the app and re-register your number. Facebook: go to facebook.com/hacked on a device you have used before. Instagram: go to instagram.com/hacked.

2. 2

   Warn customers from another channel

   Post on your other social accounts, website and email list that the account was compromised and that you will never ask for payment or codes by message.

3. 3

   Call your bank if money is involved

   If customers or your business have already paid, call the bank's fraud line to try to stop the transfer.

4. 4

   Check your email account

   If the attacker changed your Facebook or Instagram email, your mailbox may be compromised too. Secure it first, using our business email hacked guide.

5. 5

   Take screenshots

   Capture the scam messages, unknown admins, changed details and any payment requests. You will need them for reports.

WhatsApp Business account hijacked: how to get it back

Most WhatsApp takeovers happen because someone was tricked into sharing the 6-digit registration code. CSA's WhatsApp hijacking advisory describes the usual tricks: a 'friend' who sent a code by mistake, a fake promotion asking for a 'promo code', or a voicemail with a default PIN that receives the code by voice call. In November 2025 the SPF warned of a newer variant: SMSes linking to a fake WhatsApp verification page.

• Re-register on your phone. Open WhatsApp, enter your number and the 6-digit code sent by SMS or call. According to WhatsApp's compromised account help page, this logs out all devices using your account.
• If it asks for a PIN you did not set, the attacker turned on two-step verification. WhatsApp says to wait 7 days and try again if you do not have the PIN. The attacker is still logged out once you enter the SMS code.
• If you cannot receive the SMS, contact your telco first. You need the SIM for that number in your phone.
• Check linked devices. Go to Settings, then Linked devices, and log out anything you do not recognise. The SPF advisory recommends checking this regularly.
• Restore chats only from your own backup on Google Drive or iCloud.

The SPF's mid-year figures show why customers must be warned quickly. In the first half of 2026, 391 social media impersonation cases involved scammers messaging the contacts of a compromised WhatsApp account, two thirds of that scam type (see our 1H 2026 scam statistics).

Facebook Page or Instagram business account hacked

On Facebook, a Page is controlled through the personal profiles of its admins. So the usual sequence is: a staff member's personal account is phished, the attacker adds themselves as an admin, removes everyone else and starts running ads or posting scams.

Once you are back in, open Meta Business Suite settings and review People, Partners and Ad accounts. Remove anyone you do not recognise, including agencies you no longer work with. Check the Page's email, phone, website link and WhatsApp button, since attackers often change these to their own.

What to tell customers (and a message you can copy)

Customers are the real target. A short, plain message on every channel you still control does more than a long apology.

Example: "Our WhatsApp number / Facebook Page was taken over by scammers on [date]. Please ignore any messages from it asking for payment, loans, gift cards or verification codes. We will never ask for these by message. Our official channels are [website] and [phone]. If you have sent money, call your bank and make a police report."

Pin the post, add a banner to your website, and email your customer list if you have one. When the account is back, post the same message from it so followers who only see that channel get the warning.

Where to report in Singapore

• Police: lodge a report through police e-services if money was lost or scam messages went out in your name. This record helps customers with their own bank and police reports.
• ScamShield: the ScamShield Helpline on 1799 helps check whether a message is a scam. Share the number with worried customers.
• The platform: report the account takeover in-app as well as through recovery, and report any fake pages copying yours.
• PDPC: if the attacker could see customer personal data (for example chat history with addresses or NRIC numbers), assess whether it is a notifiable data breach.

If scammers have built a separate fake page or are running ads with your brand rather than taking over your real account, follow our guide on fake ads impersonating your business.

Lock it down so it does not happen again

Most repeat takeovers use the same weak spot as the first one. Work through this list for every business account.

Our MFA set-up guide explains authenticator apps, and choosing a password manager covers sharing logins safely with staff.

Do it yourself or get help?

WhatsApp recovery is usually something you can do yourself in minutes if you still have the SIM. Facebook Page recovery is slower and depends on Meta confirming the Page was compromised, so start early and keep your evidence.

If the takeover started from a hacked mailbox, or you want someone to clean up admins, sessions and passwords across every account, Hacked Email Recovery (S$290) secures the mailbox and connected accounts. Password Manager Rollout (S$290) moves your team's logins into a shared vault with MFA so they stop living in WhatsApp chats.