A Facebook page has no login of its own. There is no password for the page, no separate account to secure. Control runs through personal profiles and business portfolios, which means a page is only ever as safe as the weakest human attached to it. That single structural fact explains almost every way pages are lost.
The rest of this article explains how they are actually taken in 2026, which has changed significantly, what to do in the first hour after it happens, and why a grey market in paid account recovery exists at all.
Part one: how pages are actually stolen
1. The partner access request, where no password is stolen at all
This is the technique most page owners do not know about, and it is the one worth understanding first, because password hygiene does not stop it.
Business Manager lets one business share access to pages and ad accounts with another. That is a normal, legitimate workflow between a company and its agency. An attacker creates or compromises a business portfolio and sends a partner access request to your page, which it can do with nothing more than a publicly visible page ID.
Security firm WithSecure documented a refinement of this in April 2026 that is genuinely nasty. Attackers put a phishing URL inside the business profile name field. Meta interpolates that field into its own notification email templates, so the malicious link arrives inside a genuine Meta email that passes SPF, DKIM and DMARC. Email security gateways see a legitimate message from Meta, because that is exactly what it is.
If you click through and approve the request, the attacker now holds sanctioned access. It survives a password change. It appears in audit logs as an ordinary business relationship. There is nothing to revoke in the usual sense, because nothing was broken into.
Huntress tracked a related campaign running from November 2025 to June 2026, with lures including a fake Meta Agency Partner Program, urgent account deletion appeals, and free verified badge offers. One June 2026 variant used a Messenger chatbot posing as an AI partnership assistant to funnel victims to fake monetisation pages. Harvested data included passwords, MFA codes, phone numbers and photographs of passports and driving licences.
Check Point reported a campaign in November 2025 that created shell business pages for non existent companies and used Meta’s own invitation feature to send mail from the genuine facebookmail.com domain. More than 5,000 businesses were targeted, with around 40,000 phishing emails seen across its customers.
The rule that defeats all of it: never approve a partner or business access request from an email link. If you were expecting one, go to Business Settings yourself and approve it there, after confirming through a separate channel that it is real.
2. Phishing that looks like enforcement
The second family uses fear. A notice claims your page violated policy, infringed a copyright or trademark, or is scheduled for deletion, with a deadline and an appeal link.
Guardio Labs documented the largest recent example, a campaign it called AccountDumpling that compromised around 30,000 accounts. It abused Google AppSheet’s notification system, so phishing arrived from a legitimate Google address that passed all authentication checks. Guardio’s point is worth repeating: an authenticated email proves only that a platform sent it, not that it can be trusted.
The campaign ran several variants, including one where a human operator watched victim sessions live and pushed new screens to them on demand, collecting passwords, multiple rounds of two factor codes, identity documents and screenshots. Another leaned entirely on blue badge and reward lures.
Note what gets collected. Identity documents are now a standard target, and that matters enormously for the recovery section below. An attacker holding your passport scan can win Meta’s own identity based recovery process against you.
3. Infostealers and session theft, which defeat two factor authentication
If an attacker steals the session cookie from your browser, they do not need your password or your authenticator app. Authentication already happened. They replay the cookie and they are you.
Recorded Future’s 2025 analysis found 892 million credentials harvested from malware logs, of which 276 million included live session cookies, up around 30 percent across the year, averaging 87 stolen credentials per infected device.
Some of this malware is purpose built for this exact target. Palo Alto’s Unit 42 documented NodeStealer, distributed through Facebook posts offering free business resources such as spreadsheet template packs. Once running, it checks whether a Facebook Business account is logged in, reads the user ID and access token, then queries the Graph API to assess the prize: follower count, verification status, ad credit balance and prepaid status. It values the account before taking it. One variant buys a temporary mailbox, changes the victim’s Facebook email through an endpoint that does not require the password, and collects the verification code itself.
The Ducktail campaign used fake job offers aimed at marketing professionals, delivering archives branded as major clothing companies with an executable disguised by a PDF icon. It rewrote browser shortcuts so Chromium browsers auto loaded a malicious extension dressed as Google Docs Offline, then harvested Facebook session cookies and used a code generation service to defeat two factor authentication even after the stolen session expired.
A fake Meta Ads Manager extension, promoted through sponsored posts and impersonation accounts with tens of thousands of followers, produced a rare hard number when the attackers leaked their own data: 828 breached accounts, over 800 victims, 310 in the United States, and more than 180,000 dollars in compromised ad budget.
4. Going after the person, not the page
Because pages have no independent login, compromising an admin’s personal profile is often enough. A security specialist quoted in local US reporting named weak and reused passwords as the most common root cause, which is a useful corrective: the sophisticated techniques above sit on top of a very mundane base rate.
5. SIM swapping, and why SMS codes are the weakest option
The FBI’s 2024 Internet Crime Report recorded 982 SIM swap complaints with roughly 26 million dollars in reported losses. A Princeton study found an 80 percent first attempt success rate against major US carriers. NIST has downgraded SMS for high assurance use. Move to an authenticator app or a hardware key, while understanding that neither stops the cookie replay described above.
Part two: warning signs
Before anything is lost
- Partner access or portfolio invitations you did not initiate, especially mentioning agency programmes, verified badges, monetisation or deletion appeals.
- Policy violation, copyright or deletion deadline notices, including ones that genuinely arrive from Meta domains.
- Verification codes you did not request, which means someone already has your password.
- Recruiter or brand collaboration approaches carrying attachments or archives.
- Sender names using lookalike characters from other alphabets.
- Losing mobile signal unexpectedly, which can indicate a SIM swap in progress.
After
- New admins or people with full control, or your own role quietly downgraded.
- Unknown entries under Business settings in People, Partners or System users.
- Ad campaigns you did not create, new payment methods, unexplained charges. For many victims this is the first symptom they notice.
- Changed email, phone or two factor settings, and sessions you do not recognise.
- Your page restricted or suspended because the attacker ran violating ads on it.
Part three: prevention that actually matches the attacks
-
Never approve access from an email link
The single highest value habit on this list. Navigate to Business Settings yourself.
-
Audit the Partners tab, not just page roles
Sanctioned access compromise hides here, and almost nobody looks. Put a quarterly review in the calendar alongside People and System users.
-
Use the strongest authentication available
Hardware key first, then passkeys, which Meta rolled out for Facebook and Messenger in 2025, then an authenticator app. SMS last. Save your backup codes somewhere offline.
-
Own the page through a business portfolio, not a personal profile
This is the structural fix. It separates the asset from one individual’s account.
-
Keep at least two independent admins
On separate devices, with separate recovery emails. A single compromise or a single lockout should not be fatal.
-
Practise device hygiene, because it is the only defence against cookie theft
No cracked software, no free template archives from social ads, no password protected RAR files from a stranger. Audit your browser extensions and check your browser shortcuts for injected arguments. Use a separate browser profile for Business Manager.
-
Treat any malware infection as total
If a device is compromised, the correct response is to revoke every session everywhere, not to change a password.
-
Build your evidence pack before you need it
Business portfolio ID, page ID, ad account IDs, advertising invoices, screenshots of your current role map. Collect them today, not during the incident.
Part four: what to do when the page is gone
-
Secure the personal profile first
Change the password, log out of all sessions, re establish two factor authentication. Chasing the page while the attacker still holds the profile is pointless.
-
Screenshot everything before changing anything
People, Partners, System users, pages, ad accounts, billing and the current role map. This becomes your evidence.
-
Check Partners and System users
Not just page roles. Removing an unknown person while leaving a partner relationship or a system user in place solves nothing.
-
Stop the bleeding
Pause unauthorised campaigns, remove unfamiliar payment methods, contact your bank or card issuer.
-
File once, properly
Use facebook.com/hacked for the compromised account flow and Business Support Home for asset disputes. Include the asset IDs. Reports with company documents but no page or ad account IDs are a common failure mode.
-
Do not open parallel cases
Multiple reports from different profiles with inconsistent timelines actively harm your chances.
How likely is recovery, honestly
Nobody publishes reliable figures. The only quantified independent estimate we could find came from a security specialist working these cases, who described it as close to a coin flip, with some clients never recovering and one case taking nearly nine months. That is one expert’s estimate rather than a study, and it should be read as such.
Meta announced in December 2025 that new account hacks had fallen by more than 30 percent globally and that the relative success rate of hacked account recovery had risen by more than 30 percent in the United States and Canada. Both are Meta’s own unaudited figures, and the phrase relative success rate is doing a lot of work.
Does Meta Verified help
Meta Verified for business advertises direct access to support agents, and it plausibly shortens the queue. But we found no evidence that any tier guarantees recovery of a hijacked page, and no measured data on hacked case outcomes. One published hands on test reported impressions of faster support without response times or ticket data, and did not test a hacked account at all. Note also that verified badge offers are themselves one of the most common phishing lures, and that genuine Meta Verified is a paid flow you start inside Facebook, never something offered to you by email.
Part five: the paid recovery market, and why it exists
Because the official route fails so often, a market grew to fill the gap. This part is uncomfortable, and it is worth publishing anyway.
The Globe and Mail investigated brokers who claim contacts inside Meta able to submit requests through an internal appeals tool intended for employees helping friends and family. Payment is in cash or cryptocurrency and is split between the broker and the insider. Prices its interviewees paid ranged from around 600 dollars to 2,500 dollars, with restoration sometimes in hours. Of eleven users interviewed, nine regained access: four paid brokers, two paid the hackers’ ransoms, two received free insider help and one got results by going public.
The hardest number in this area comes from a federal prosecution, in which around 120 fraudulent reinstatement requests were filed and 93 succeeded.
This is not a fringe phenomenon. Reporting on leaked documents found that use of Meta’s internal appeals tool grew from roughly 22,000 requests in 2017 to more than 50,000 in 2020, and that around two dozen employees and contractors were disciplined or fired for taking bribes or hijacking accounts, with payments reportedly reaching 7,000 dollars.
Meta’s position is that account recovery services violate its policies and put users at risk. It has sued several brokers, with outcomes including settlements, a guilty plea to extortion and money laundering, and a deferred prosecution agreement for a former security contractor.
Where these services are advertised. The Globe and Mail named SWAPD among the channels where unban services were promoted, alongside Instagram and Telegram. SWAPD hosts a category where third party members advertise Facebook and Instagram recovery, with threads promising recovery within 72 hours and prices up to several hundred dollars. It is worth reading SWAPD’s own terms alongside those listings: its warranty section excludes hacked properties and recovered profiles from cover entirely, states that all sales are final, and places the burden of risk on the buyer. In other words the platform hosts the listings while disclaiming any warranty on the category.
We should disclose that SWAPD and ViralAccounts are related businesses to this site. We are naming them here because leaving them out of an article on this subject would be the dishonest choice, not the polite one.
What paying a broker actually means. You may be funding bribery of platform staff. You are violating Meta’s policies, which puts the account you just recovered at risk. You are handing business documents and identity records to an anonymous vendor. And Guardio’s research notes that stolen accounts are sometimes monetised through recovery services, meaning the same ecosystem can sit on both sides of the transaction. The legitimate looking alternatives, firms with professional websites and no published success rates, concede in their own small print that restoration is not guaranteed.
Part six: how big is this problem
Nobody publishes a count of hijacked Facebook pages. Every number available is a proxy, and that gap is itself the story.
In March 2024, 40 state attorneys general wrote to Meta about account takeovers. New York’s complaints went from 73 in 2019 to 783 in 2023, with 128 in January 2024 alone. Year on year increases included Vermont at 740 percent and North Carolina at 330 percent. The letter asked Meta for five years of takeover figures. Its most quoted line is that the attorneys general refuse to operate as Meta’s customer service representatives.
Separately, the FTC recorded social media originated scam losses rising from 261 million dollars in 2020 to roughly 2.1 billion in 2025, with Facebook accounting for the highest reported losses of any platform. That figure covers scams generally rather than page theft specifically, so do not read it as a hijacking total.
The short version
- Pages have no login of their own, so secure the people and portfolios that control them.
- Never approve an access request from an email link. Audit the Partners tab quarterly.
- Session cookie theft defeats two factor authentication and passkeys alike, so device hygiene is not optional.
- Attackers now collect identity documents, which lets them win Meta’s own recovery process.
- Assemble your evidence pack before an incident. Asset IDs matter more than company paperwork.
- File one well evidenced case rather than several.
- Treat paid recovery brokers as a last resort with real legal, financial and account risk attached.
Sources
WithSecure on Business Manager template injection, April 2026 · Huntress on Meta Business Manager phishing, July 2026 · Check Point via The Register, November 2025 · Guardio Labs, AccountDumpling · Palo Alto Unit 42 on NodeStealer · Kaspersky Securelist on Ducktail · Malwarebytes on the fake Ads Manager extension · Recorded Future 2025 Identity Threat Landscape · FBI IC3 2024 · Meta newsroom, December 2025 · The Globe and Mail on account recovery brokers · Multistate attorneys general letter, March 2024 · FTC social media scam spotlight · SWAPD terms of service.
Thinking of selling?
We give free valuations with no obligation. Send us the page URL and a representative replies with a figure, usually within one business day. Looking to buy instead? Register as a buyer.
