Social Media Account Security for Small Businesses Guide: Admin Access, 2FA and Recovery

For many small businesses the social media accounts are the shop window, the customer service desk and the advertising budget at once, yet they are often run on one shared password that sits with whoever set them up years ago. When that login is phished, reused elsewhere or left with a former employee, the business can lose its audience, its ad spend and its reputation in an afternoon, and recovery depends on details nobody wrote down. This platform-neutral guide covers ownership, named access, sign-in protection, recovery details, leavers, third-party tools, scams, and takeover response and reporting. It is written for owners, office managers and the person who "does the socials" in businesses of roughly 1 to 50 people, and draws on UK and US government guidance and platform help pages. Platforms are listed alphabetically; the order is not a ranking.

Key takeaways

• The business owns the account, not a person: register it to a business-controlled email address and keep at least two named people with full control.
• Named access beats a shared password: where a platform offers roles or team access, give each person their own login and the lowest role they need.
• Turn on 2-step verification everywhere, starting with email: the email inbox behind an account can reset its password, so protect it first, and prefer passkeys, security keys or app prompts over text messages.
• Recovery details decide whether you get the account back: recovery email, phone number and backup codes must belong to the business and be checked at least twice a year (our recommendation).
• Platforms do not message you about "violations" with a login link: treat any urgent message about suspension, copyright or a verification badge as phishing until checked through the platform's own app or help centre.

Who should own a business social media account

A takeover hurts far more when ownership was never decided. Settle ownership first.

• Owner email: register each account to a mailbox on the business's own domain or business email service, ideally a role address such as social@ that two people can reach, rather than a person's private address. YouTube's hacked channel guidance recommends using a separate email address for YouTube rather than one shared with other accounts, which is a sensible pattern on every platform (YouTube Help).
• Two owners minimum: keep at least two trusted people, usually the owner and one deputy, with the highest level of control, so illness, holidays or a departure do not lock the business out (our recommendation).
• Agencies and freelancers: give them their own access through the platform's role or partner features, never the owner login, and record in the contract that the business keeps ownership and that access ends when the contract does.
• A simple register: keep one page listing each account, its handle, owner email, recovery phone, who holds which role and when access was last reviewed. Keep it in the business password manager.

See the Small Business Identity and Access Security Guide for the wider picture of owning business accounts.

Shared logins versus named admin roles

A shared password cannot tell you who posted what, cannot be withdrawn from one person without changing it for everyone, and usually ends up written down. Where a platform offers named access, use it.

YouTube describes granting access through channel permissions as safer than sharing your password, and recommends giving each person the lowest access they need and removing access when it is no longer needed (YouTube Help: channel permissions). That principle applies to every platform and maps to NIST SP 800-53 AC-6 Least Privilege.

Platform notes

The platforms below are the ones whose help pages we could read for this guide in November 2026. Settings change, so confirm them in each platform's current help centre.

TikTok

TikTok's best practices for TikTok for Business accounts cover a unique password, keeping a secure email address and phone number on the account for recovery, and turning on 2-step verification from User Settings, then Account Security, in TikTok Ads Manager. Managed clients are told to contact their account manager straight away if the account is compromised, and other clients to contact customer support (TikTok Business Help Center). In TikTok Business Center, an Admin member can require 2-step verification under Business Settings, Settings, Security, applied either to admins only or to all members; TikTok recommends applying it to all members (TikTok: 2-Step Verification for Business Center).

X

X's two-factor authentication options are a text message code, an authentication app that generates time-based codes, and a security key connected by USB, Bluetooth or NFC. A confirmed email address is needed to enrol, and a security key can be the only method on the account. When enrolling by text message, X shows a backup code to keep safe in case the phone is lost or the number changes (X Help Center: two-factor authentication). Before authorising a third-party app, X shows what the app can view and what it can do, with separate levels for read, write and Direct Message access, and X does not share the account password with apps (X Help Center: third-party apps).

YouTube

YouTube channel permissions offer Owner, Manager, Editor, Editor (Limited), Subtitle Editor, Viewer and Viewer (Limited) roles. People are invited from Settings, Permissions by email address, invitations expire after 30 days, and only the owner and managers can see who has access (YouTube Help: channel permissions). Because a channel sits on a Google Account, channel recovery starts with recovering the Google Account, and YouTube asks every owner and manager to secure their own Google Account too (YouTube Help: hacked channel). Google 2-Step Verification supports passkeys, security keys, Google prompts, authenticator codes and backup codes (Google Account Help: 2-Step Verification).

2-step verification and passkeys

The NCSC explains that 2-step verification (2SV) means an attacker who knows the password still cannot get in, and that email deserves it first because access to an inbox can be used to reset other passwords (NCSC: setting up 2-step verification). CISA's Secure Our World guidance makes the same point and names social media and business accounts among those to protect (CISA: Turn on MFA).

The NCSC says any 2SV is better than none, describes text messages as less secure than other options, advises setting up more than one second step, and says backup codes should be stored safely and regenerated once used. It warns against security questions as a substitute (NCSC). Google notes that texts and voice calls are more exposed to phone-number attacks than prompts (Google Account Help). For the background, see the Passkeys for Everyone Guide and the MFA backup codes and recovery codes guide.

Recovery email and phone hygiene

Recovery details are the back door. If they point to a former employee's mobile or a mailbox nobody checks, the business cannot prove it owns the account, and an attacker who changes them first wins.

• Recovery email: a business-owned mailbox protected by its own 2SV, never the same inbox that a compromised social account could already reach.
• Recovery phone: a business mobile number, with a PIN or port-out protection set with the mobile provider where offered.
• Backup codes: saved in the business password manager, not screenshotted to a personal camera roll.
• Review: check recovery details for every account at least twice a year and after any staff change (our recommendation).
• Email first: if the recovery mailbox is compromised, every account behind it is at risk. The NCSC's hacked account steps include removing unfamiliar forwarding rules and filters, which criminals use to receive copies of reset emails (NCSC: recovering a hacked account).

Password manager use

The NCSC's Cyber Aware tips recommend a strong, separate password for email, passwords built from three random words, 2SV, and a password manager to create and store passwords (NCSC: top tips for staying secure online). A shared business vault gives unique passwords, controlled sharing where a platform allows one login, and one place to remove access when someone leaves. TikTok's business guidance also stresses not reusing passwords, because a breach of another site can expose a reused one (TikTok Business Help Center). See the Password Manager Setup Guide.

Removing ex-staff and contractors

Leavers are an easy gap to miss. Build social accounts into the same leaver routine as email and payroll.

1. On or before the last day, remove the person's role or team access on every platform in the register.
2. If they knew any shared password, change it and reset the 2SV method if it was on their phone.
3. Check that their personal email or phone is not a recovery method, and replace it with a business one.
4. Remove their access to scheduling tools and the password manager vault.
5. Update the register with the date and who did it.

See the Employee Offboarding Security Checklist.

Third-party apps and scheduling tools

Scheduling and analytics tools usually connect with OAuth and keep a token that can post without a password, so the tool is itself an account to protect.

• Read the permissions: check what the app can view and do before approving, as X's help page describes (X Help Center), and grant only what the tool needs.
• Protect the tool login: turn on 2SV in the scheduling tool too, and give staff their own logins there.
• Review connected apps: each quarter, remove apps nobody uses and anything you do not recognise in each platform's connected apps or security settings (our recommendation).

The Social Platform App Tokens Guide covers app tokens in more depth, and the Consent Phishing and Illicit OAuth Grants Guide explains how fake apps trick people into granting access.

Phishing, fake support and verification scams

Attackers target business accounts with messages that look official. Common lures include a warning that the page will be suspended for a copyright or policy breach, an offer of a verification badge, a "brand partnership" that needs a login, and a fake support agent who asks for a code. MITRE ATT&CK tracks hijacked social accounts as T1586.001 and the lures as T1566 Phishing.

CISA lists urgent or emotional language, requests for personal or financial information, untrusted shortened links and slightly wrong addresses as signs of phishing, notes that good grammar is no longer a reliable sign because AI can produce polished messages, and advises contacting the company through its verified website rather than any link or number in the message (CISA: Recognize and report phishing). The NCSC adds that scammers create fake accounts or hack real ones, that verified badges, account age and follower counts are worth checking but followers can be bought, and that fake accounts should be reported to the platform (NCSC: social media, how to use it safely). See the How to Spot a Phishing Email Guide and the Impersonation Scams Guide.

What to do if an account is taken over

The NCSC's recovery steps for small organisations, adapted here for business social media, are the backbone of a response (NCSC: recovering a hacked account):

1. Use the platform's recovery process. Go to the platform's own help pages, not a search result or a "recovery service" offering help in comments. On YouTube, recover the Google Account first; the hacked channel guidance says support covers incidents within the past 9 months (YouTube Help). TikTok business clients contact their account manager or customer support (TikTok).
2. Secure the recovery email. Check it for forwarding rules and filters and remove any you did not set.
3. Change passwords on the account and anywhere the same password was used.
4. Sign out all devices and apps, then remove unknown roles, team members and connected apps.
5. Turn on or reset 2SV with a business-held method.
6. Undo changes: delete posts or ads the attacker created and check ad spend and payment methods.
7. Tell customers through another channel, such as the website or email list, that recent messages from the account should be ignored.
8. Check bank and card statements linked to ad accounts, contacting the bank only through official channels.
9. Report it (see below), and record what happened for the post-incident review.

If the account cannot be recovered, the NCSC suggests creating a new one and telling contacts that the old one is abandoned. The Social Media Account Takeover Playbook gives a fuller incident template, and the Small Business Incident Response Guide covers the wider response.

Where to report

Report Fraud and the Scotland 101 route are given in the NCSC's hacked account guidance (NCSC); the phone number and 4 December 2025 launch date are from Report Fraud.

Measuring whether it is working

Our suggested quarterly measures: 2SV coverage across social and email accounts (target 100 percent), owner logins on passkeys or security keys where offered, days from a leaver's exit to access removal (target 0 to 1), and recovery details confirmed within the last six months.

Common failure patterns

• The account belongs to one person: it was set up on a personal email and the business cannot recover it when that person leaves or is targeted.
• A shared password that never changes: former staff and agencies keep working logins for years.
• Recovery phone on a personal mobile: the number is changed or ported and the business loses its recovery route.

Framework mapping

Practitioner checklist

• List every business social account in a register with owner email, recovery phone, roles and last review date.
• Move each account to a business-owned email address and keep two named owners.
• Replace shared passwords with named roles wherever the platform offers them; put any remaining shared logins in a password manager.
• Turn on 2SV for every social account and the email accounts behind them, using passkeys or security keys for owners where available.
• Save backup codes in the business password manager and set up a second 2SV method.
• Add social accounts and scheduling tools to the leaver checklist and remove access on the last day.
• Review roles, recovery details and connected apps every quarter.
• Brief staff that platforms will not ask for codes or logins through messages, and agree a way to check suspicious requests.
• Keep the takeover steps and reporting contacts (Report Fraud, Police Scotland 101, platform help centres) where the team can find them.

Standards and references

• NCSC: Social media, how to use it safely
• NCSC: Recovering a hacked account
• NCSC: Setting up 2-step verification
• NCSC: Top tips for staying secure online (Cyber Aware)
• NCSC: Small Business Guide
• CISA: Turn on multifactor authentication
• CISA: Recognize and report phishing
• TikTok: Best practices for securing your TikTok for Business account
• TikTok: 2-Step Verification for Business Center
• X Help Center: Two-factor authentication
• X Help Center: Third-party apps
• YouTube Help: Channel permissions
• YouTube Help: Hacked channel
• Google Account Help: 2-Step Verification

Related NHI Mgmt Group resources: Social Media Account Takeover Playbook · Small Business Cybersecurity Basics Guide · Social Platform App Tokens Guide · Password Manager Setup Guide