Hacked or stolen account recovery

Why this is not the same as a block

A block is a decision by the platform that you dispute. A hack is someone else controlling your property, and here the platform is on your side, provided you approach it correctly.

The difference is practical, and it costs people their accounts. An appeal and a compromise report travel through different channels. An appeal says “your decision about my content is wrong”, and you get one. A compromise report says “this account was under someone else's control”; it is a separate procedure and it does not spend your appeal.

The trap is that the appeal is the first thing the interface offers. The block screen leads straight to it, and someone in a panic presses that button within minutes. I handled a case where an appeal was filed while the account was still under someone else's control: the platform refused it and closed the right to any further review. Access was recovered later, but the blocking decision was no longer open to review.

So the first thing to do when you suspect a hack is the compromise report, not the appeal. Platforms usually respond to a compromise report within 30 to 60 minutes.

Four scenarios people come with

• The straightforward takeover. Password, email and phone changed, you cannot log in at all. The most visible one and, oddly, not the hardest: recovery procedures are designed for exactly this.
• The silent takeover. The password works, the login goes through, the interface is where it always was, but the option to add people has disappeared, your role has changed from administrator to employee, and an unfamiliar profile has appeared in the admin list. You can see everything and change nothing. These are found latest, because nothing raises an alarm.
• A business structure takeover. What was taken is not a personal profile but access to a business portfolio, a Page or an ad account. Often through an invitation someone accepted without looking, or through a former contractor whose access was never revoked.
• Lost access with nobody at fault. A lost phone with two-factor authentication, an unreachable mailbox, an employee who left and held everything. Not a hack in the strict sense, but the procedures are close and people arrive with it just as often.

What happens if you act in the wrong order

• An appeal filed instead of a compromise report. The single review attempt is used up, and sometimes it is spent by the attacker in order to keep control.
• Account recovery confused with review of the block. These are two independent processes. You can fully verify your identity, get the login back and still be looking at the same restriction screen.
• New accounts created “while we sort this out”. To the platform this looks like circumventing the restriction and carries the problem over to connected assets.
• Time lost. While the attacker is inside, they change the linked details, spend the budget, message people in your name and add administrators of their own. Every hour works against you.

How I work

1. 1Enquiry and the first hours. You describe what happened and what is still under your control: email, phone, your role in the business portfolio. If the situation is live, I tell you the first action to take straight away, without waiting for the work to start.
2. 2Initial assessment. Free, within three hours. I work out how access was obtained, what has already been changed and which procedure applies: account recovery, a compromise report, proving rights to a business asset, or a combination. I tell you what can realistically be recovered and what cannot. If there is no chance, I say so here and that is the end of it.
3. 3Regaining control. I file through the correct channels in the correct order, handle the correspondence and any additional verification steps, and track the deadlines.
4. 4Closing the hole. Part of the work rather than an add-on: a recovery without it is pointless, because they will come in the same way again. Changing the linked details, two-factor authentication with backup codes, a review of administrators and partner access, removing stray payment methods, separating personal and business assets.

When I take a case and when I do not

• I take it on. You own the account, or you are authorised by the company that owns it and can show that.
• I take it on. At least one element of control survives: the email, the phone, a role in the portfolio, the company documents.
• I take it on. The case is recent, or the relevant procedures are still open.
• I do not. Establish who is behind the takeover. That is done by law enforcement through an official procedure, not by a contractor. Anyone offering it as a service is either lying or working illegally.
• I do not. Recover an account for someone who is not its owner.
• I do not. Cases where ownership cannot be shown at all: no access to the email, the phone or the documents, and nothing linking you to the account.

How it usually starts

Understanding the way in helps both with the recovery and with the protection afterwards.

Most often it is an email that looks like a message from platform support, frequently in your own language and congratulating you on a verified status or a blue badge. The link leads to a form hosted on a legitimate domain, which is why the email clears your spam filter. Whatever you enter, including your two-factor code, is used by an operator on the other side immediately, while the code is still valid. Less than an hour passes between the click and the loss of the account.

The second common way in is not an email but permissions: somebody accepted an invitation into the business portfolio without understanding it, or a former contractor still has access that everyone forgot about.

About the DSA, honestly

For moderation disputes in the EU there is a route beyond the platform: an internal complaint, then an independent certified out-of-court dispute settlement body.

For a hack that route does not work, and it is better to know that in advance.

I took it to the end and received a written answer from the legal lead of a certified body: account compromise cases are a security matter rather than a moderation dispute, and fall outside the scope of Articles 20 and 21 of the DSA. The reasoning is that the applicant is not disputing that the content broke the rules; they are saying a criminal posted it. For a moderation body there is no dispute to settle.

The practical conclusion is simple: with a hack, everything is decided inside the platform's own procedures and in the first hours. There is no external authority that will make up for lost time.

Pricing and terms

The €180 covers everything: the compromise report, running the procedure through to a result, restoring owner rights, and the protection afterwards, meaning two-factor authentication with backup codes, a review of administrators and partner access, and separating personal and business assets. Nothing is paid upfront, and nothing is paid if the account cannot be recovered. Complex cases are quoted separately: a takeover of a business portfolio with several assets, multiple ad accounts, or restoring rights through company verification. I will tell you that at the free assessment, before any work starts. Contract and proper invoice from SolveOne EOOD, company number 208821652. For EU companies the invoice is issued under the VAT reverse charge mechanism. Passwords, SMS codes and access to your email are not needed and will never be requested. The work goes through the platforms' own procedures and through access roles you revoke with one click.

FAQ

Related