Social Media Takeover: The Recovery
The parent's Facebook account starts posting giveaways they never made, and friends start getting messages asking for money or gift cards. That is an account takeover, and it is one of the fastest ways a scammer reaches everyone the parent knows. This page is the family's takeover response: spotting it in the first hour, getting the account back, and locking down the accounts the scammer will try next.
The one-line rule: the moment a parent cannot log in, or friends report strange messages, treat it as a takeover and act in order: secure the email first, then the social account, then the bank. The FTC identity theft guide is clear that stolen personal information gets used fast, so speed and order matter.
How takeovers happen
Most takeovers are not clever hacking; they are reused passwords. A password the parent used on an old site shows up in a breach, and the scammer tries it against Facebook, Instagram, and email. The password leak check guide explains how to find out if a parent's passwords are already in circulation. Some takeovers also start with a phishing message, which the phishing inspection guide covers.
The first-hour checklist
- Secure the email. The scammer usually changes the account password through the recovery email. If the parent can still reach their email, change that password first and sign out all devices. The email account security guide has the full order.
- Recover the social account. Use the platform's official hacked-account recovery flow and follow its identity checks. Do not pay anyone who offers to recover the account for a fee; that is a second scam.
- Tell the parent's friends. Post a warning as soon as access is back, or have a family member message the inner circle: ignore money requests and links sent in the last day. The scammer is using the parent's trust, and the accounts compromised guide has the wording.
- Check for stolen information. If the scammer saw messages with account numbers or the parent gave up information, report identity theft at IdentityTheft.gov and place a fraud alert or credit freeze through the FTC's steps in the identity theft response guide.
Locking down the accounts the scammer tries next
- Unique passwords everywhere. A family password vault makes this realistic; the passwords and accounts guide shows the setup.
- Two-factor authentication. Turn it on for email, banking, and social accounts. The two-factor authentication guide picks the easiest option for a parent.
- Current recovery contacts. Make sure the recovery email and phone number on each account are ones the family can reach, which is also the backbone of the 2 a.m. emergency access plan.
Related guides
- One account compromised: what to do first
- Checking if passwords were leaked
- Identity theft response
- Two-factor authentication made simple
- The family password vault
Sources & verification
This page is checked against the standards in our editorial policy, preferring government sources. Reviewed August 2026:
- Federal Trade Commission: What To Know About Identity Theft (retrieved August 2026)
Found an error? Report it: we log and correct material mistakes publicly.
Quick answers
Common questions, answered plainly. The details match the sources above.
How do I know my parent's social media account was taken over?
Signs include the parent being unable to log in, a changed password or email, posts or messages the parent did not write, and friends reporting strange money requests or links. Act in the first hour: secure the email first, then recover the social account.
What should the parent do about friends who got scam messages?
Post a warning as soon as access is restored, and have close family directly tell the inner circle to ignore money requests, gift card asks, and links sent from the account in the last day. The scammer is trading on the parent's trust.
Does an account takeover mean identity theft?
Not always, but it can be. If the scammer saw account numbers, statements, or personal information in the account, report identity theft at IdentityTheft.gov and consider a fraud alert or credit freeze. The FTC's identity theft guide covers the decision.
Found an error? Report it.