How to Protect Your Facebook Account from Hackers
If you haven’t experienced it alone, you surely know someone whose Facebook ad account got hacked. Be cautious and read before you act, especially if you receive an email requiring you to log in to the platform and take specific actions.
Real cases from Accella Digital clients inspire our article, and we hope it helps improve your security and know-how on what to do in case of a potential account takeover.
One of the most common and straightforward methods for stealing personal information is through so-called phishing attacks. Attackers usually reach out via email pretending to be a legitimate source or entity, such as a social network account executive, bank or online store owner, etc. These emails almost always follow the same structure and message: urging you to take immediate action, often requiring that you submit your personal information (email, password, bank details, login information) through an external link.
Answering their inquiry may result in losing your account access in seconds, potentially damaging your business.
Here is what the anatomy of a phishing email may look like:
- The email subject attracts attention and usually has a high open rate;
- The business name is displayed, which helps make the email look legitimate;
- The fonts and layouts are identical to the ones used in the original Facebook newsletters;
- The email contains a compelling phrase for a required action within a fixed timeframe, thus creating a sense of urgency, which increases the chances for the user to initiate the “verification” process.
Always double-check the sender’s email address. This is the quickest and easiest way to verify if the message is a scam. In case of doubt, we recommend sending any suspicious emails to be reviewed by your advertising agency or marketing specialist before taking further action. Often, scam emails warn you about disapproved ads or payment status issues and do not typically require you to enter your credentials or initiate any specific action.
Here are a few tips on how to protect your business accounts on Facebook:
1. Review Admin Access to Your Facebook Page or Ad Account and Enable Mandatory Two-Factor Authentication
The best way to safeguard against cyberattacks and malicious practices is to ensure you apply the highest level of security to your ad account, as well as review account access occasionally.
What is Two-Factor Authentication?
Two-factor authentication (2FA) is an additional layer of security where a second action from the user is required to prove their identity in addition to the regular login password.
There are several options to choose from to activate your two-factor authentication:
– Via SMS: This is the easiest and most convenient method. When Facebook detects an attempt to log in from an unfamiliar device or browser, it sends a security code via SMS.
-Security Key: A small hardware device which can be used to help keep your Facebook account secure. It is often used on top of other 2FA methods.
– Authenticator App/Code Generator: An additional application installed on your phone that generates access codes that change every few seconds.
From the image below, you can see where to navigate in your account to activate two-factor authentication.
This step is mandatory, especially when it comes down to business accounts with linked bank details. Authentication can be activated for all users in your business account.
Facebook.com/privacy/checkup/
Review Your Account Access
You should occasionally review your account access, especially if you notice any unusual activity. If you see someone you may not know has administrative access to your ad account, you should take immediate action. Otherwise, there is a risk you may have your access removed and get locked out of your account.
We also advise you to keep at most 2-3 users with admin access to your ad account.
2. Phishing Emails And How to Detect Them
Unusual Email Address
The sender’s email address contains misspellings. If you receive a message that requires your personal information or click on external links, always keep in mind to verify the sender’s address.
Suspicious External Links
If you still click the external link provided in the email, it may lead you to a page where you will be asked to enter your personal information. When you examine the web address closer, you may notice any misspellings, awkward spacing and strange email layouts.
Insecure HTTP Connections
A website should always be secured with HTTP encryption when it processes sensitive information, such as personal data and passwords. However, HTTP doesn’t guarantee security, as hackers sometimes may exploit it since data transmitted over it is sent in plain text and can be read by anyone with access to the network traffic, including cyber criminals.
3. Reach Out to Your Advertising Agency
If you are still trying to decide whether to trust a particular email, you can always contact your digital agency to help verify its legitimacy.
If you already provided your personal information upon the hacker’s request and were locked out of your account, it is essential to react promptly.
We at Accella Digital are familiar with such malicious practices and have helped our clients regain their account control.
What to Do If You’ve Been Hacked:
1. Remove Account Access to People in Case of Suspicious Activity
A swift and timely response is needed in this case. The first step is to log into your profile while you still have admin rights and remove account access for the hackers.
Earlier in the article, we mentioned where to navigate in your Facebook Business Manager to locate user access. Here is how you can remove a user:
Freeze the Credit Card Used in Your Ad Account
If you’ve already lost access to your ad account, what’s next is to contact your bank to alert them of the breach and freeze the credit card paying for your ads. This way, even if you’ve lost access to your account, you will prevent your card from getting drained of funds and the possibility of hackers running ads with stolen money.
3. Disconnect Your Business Page from Your Business Manager
Since the Business Manager is the most valuable asset for hackers, it’s important to disconnect it from your Business page. This approach applies in specific cases, so we mark it as optional. First, ensure no other suspicious profiles run as admins in your account.
4. Contact Facebook Support for Assistance
Since Facebook support receives a high volume of inquiries daily, resolving the issue may take some time. Don’t let this discourage you, as the chance to regain your account access is high.
You can contact Facebook support from here:
https://www.facebook.com/business/help/support
Hacker attacks have become more advanced and skillfully crafted in recent years. However, if we regularly monitor our ad accounts and stay alert, we can save ourselves future headaches and surf the vast waves of the Internet space smoothly and peacefully.
[/av_textblock]
