Business account hacked? How to get it back and protect your customers

Signs someone else is in your account

• Customers tell you they received strange messages from you, often asking for money, a code or a click on a link.
• You receive emails about a password change, a new sign-in or a new device that you did not make.
• Your profile name, picture, bio, recovery email or phone number has changed.
• You are suddenly signed out and your usual password no longer works.
• Posts, comments or messages appear that nobody on your team wrote.
• On WhatsApp, your linked devices list shows a computer or browser you do not recognise.

One of these on its own may have an innocent reason, such as a colleague signing in on a new laptop. Two or more together, or any message to customers asking for money, means you should act straight away.

The first hour: an order of work

Work through this list in order. The early steps stop the damage spreading, and the later ones get you back in.

1. Pause all sending in Spaces under Settings, Pause everything. Every message, post, comment, scheduled message and routine stops at once, while reading keeps working.
2. Secure your email first. Most platforms send recovery links there, so whoever controls the inbox can control everything else. Change its password and turn on two-step sign-in.
3. Use each platform's own recovery route to get back into the affected account, as set out below.
4. Once you are in, change the password, sign out every other session or device, and check the recovery email and phone are yours.
5. Turn on two-step sign-in on every account that does not have it yet.
6. Warn customers who may have received a fake message, in short, personal replies.
7. Check your Spaces workspace: members, AI agents and keys, and the audit log.

Write down what you find and when. If you need to report the incident to a platform, a bank or the police, a simple timeline helps.

Getting back in, platform by platform

Every platform has its own recovery route and they change from time to time, so use the help pages in each app for the current steps. In outline:

Spaces cannot recover an account on any platform. It never holds your social media passwords, because you sign in through each platform's own page or scan a QR code for WhatsApp, so there is nothing in Spaces that an attacker could use to get in, and nothing Spaces could use to get you back in either.

What Spaces does while this is going on

When a platform notices a takeover, it often signs out every session, asks for a security check or restricts the account. Each of those pauses sending from that account in Spaces, and your agent is told why.

Pausing everything yourself is still the safest first step, because it does not depend on the platform noticing anything. Nothing goes out until you choose Resume sending in Settings, or ask your AI agent to resume.

Warning customers without causing panic

If the attacker messaged customers, the people they reached need to hear from you. Keep it short, plain and personal, and only write to people who were actually contacted or who ask. Names and details are examples.

Hi Marcus, it is Jo from Northside Physio. Someone got into our account yesterday and sent a few messages asking for payment. That was not us, and please do not pay or click any link in it. We have the account back now. Sorry for the trouble, and thank you for letting us know.

Resist the urge to send the same warning to everyone at once. The same cold message sent to many people. Spaces refuses copy-paste blasts. A mass message from an account that has just been recovered also looks suspicious to the platform. A note on your website, your other profiles and in replies to anyone who asks will reach most people.

If anyone has already paid a scammer, tell them to contact their bank straight away. You cannot fix that from your side, but a quick warning gives them the best chance.

Checking your Spaces workspace afterwards

If the email you use to sign in to Spaces was part of the takeover, check the workspace too. It only takes a few minutes.

1. Change your Spaces password, and add an authenticator app under Security in your dashboard settings if you have not already.
2. Look at the members of the workspace and remove anyone you do not recognise.
3. Look at your AI agents and their keys. Pause or remove any you did not set up, and create fresh keys for the ones you keep if you think a key was seen.
4. Read the audit log. It records member changes, agent access changes, pauses, account links and disconnections, and hand-overs, with who did it and when.
5. Check each connected account in the dashboard. Reconnect any that show as needing attention, using your own sign-in.

The owner of a workspace can also require two-step sign-in for everyone in it, so that a stolen password on its own is no longer enough to get in.

Reconnecting and building back up

A recovered account has just been through a lot in the platform's eyes: password changes, new devices, perhaps a burst of strange messages. Give it a quiet few days before your agent starts anything new.

When you reconnect an account in Spaces, the warm-up starts again. On WhatsApp, for example, new chats build up like this, and guidance says to wait up to 24 hours after reconnecting before starting any. Messages are always at least 10 seconds apart.

Replies to people who write in are never held back by the warm-up, so you can answer worried customers from the first day.

Example: sorting it out with your agent

Your agent can help you find out who was affected and draft the replies. Names and details are examples.

To work this way, ask your AI agent to hold replies as drafts, and nothing goes out until you approve it.

How to make it less likely next time

• Turn on two-step sign-in everywhere, starting with the email inbox behind your accounts.
• Use a different, long password for each account, kept in a password manager.
• Never give a code that arrives on your phone to anyone, even someone who says they are from the platform.
• Be wary of messages about copyright strikes, verification badges or account problems that ask you to sign in through a link.
• Keep the recovery email and phone on each account up to date, and owned by the business rather than one staff member.
• Give people on your team their own Spaces sign-in with the right role, rather than sharing one.

Notes to give your AI agent

Security rules:
- Never ask anyone for a password, a sign-in code or a recovery code, and never pass one on.
- If a customer says they got a strange message from us asking for money, tell them not to pay or click anything, and tell me straight away.
- If Spaces says an account needs reconnecting, stop and tell me. Do not ask me to reconnect it through a link someone sent.
- After an account is recovered, reply to people who write in, and start no new conversations until I say so.
- Hold every reply as a draft for my approval until I tell you otherwise.

Who you message

Summing up

Pause sending, secure your email, then use each platform's own recovery route to get back in. Sign out other sessions, turn on two-step sign-in, warn the customers who were contacted in short personal messages, and check your Spaces members, agents and audit log.

Spaces never holds your platform passwords and stops sending from any account the platform signs out or restricts, but recovering the account is something only you can do with the platform itself.

Pricing

Plans from $19 a month

Can Spaces get my hacked account back?

No. Recovery goes through each platform's own sign-in and help pages, and only the account owner can do it. Spaces never holds your platform passwords, so it has no way in either.

Could someone have got into my account through Spaces?

Spaces never asks for or stores your social media passwords, so a Spaces sign-in on its own does not give anyone your Instagram or LinkedIn password. Check the audit log and your agents' keys anyway, and turn on two-step sign-in for your Spaces account.

What should I do first?

Pause all sending in Spaces, then secure the email inbox behind your accounts. Whoever controls the inbox can usually reset everything else, so get that back first.

Should I message all my customers to warn them?

Usually not all at once. Write to the people who were actually contacted, and put a short note on your website and other profiles. A mass message from a just-recovered account can look like more spam.

Will the platform restrict my account after a hack?

It might, or it might ask for a security check, especially if the attacker sent lots of messages. If it does, follow the steps in the app yourself. Spaces keeps sending paused on that account until it is reconnected.

Do I need to reconnect my accounts in Spaces?

If the platform signed you out or you changed the password, the account may show as needing attention. Reconnect it with your own sign-in. The warm-up starts again, and replies to people who write in are never held back.

How do I stop it happening again?

Turn on two-step sign-in on every account, use a password manager, and never share codes that arrive on your phone. Keep recovery details owned by the business, and give each team member their own sign-in.

Someone on my team clicked a fake link. What now?

Treat it as a possible takeover. Change that person's passwords, sign out other sessions, turn on two-step sign-in and check for changes to recovery details. Then check their access in Spaces and pause any key they used if in doubt.