Step 1 — Secure the email account first
Almost every social media takeover starts at the email address, not the social account. If the attacker still controls your mailbox, every reset link you request goes to them.
- Change your email password from a device you trust.
- Turn on two-factor authentication if it is not already on — an authenticator app or hardware key, not SMS.
- Sign out all other sessions.
- Check the mailbox's forwarding rules and filters. Attackers routinely add a rule that forwards or auto-deletes security alerts, and it survives a password change.
Step 2 — Revoke sessions and connected apps
If you still have any access to the social account, revoke every active session and every connected third-party app before you do anything else. A password change alone does not always end an existing session, and an authorised app can be a permanent back door.
Step 3 — Document everything, right now
This is the step almost everyone skips, and it is the one that decides whether a case can be built later. Evidence disappears fast: the impostor edits the profile, the platform emails get buried, the posts get deleted.
- Screenshot the ban or "suspicious login" notice in full, including the date and any reference number.
- Screenshot the impostor profile, its posts, its follower count, and its URL.
- Do not delete any platform email. Forward them, unedited, to an address you control.
- Note the exact timestamps: when you last had access, when the notice arrived, when you first noticed.
- Save proof the account was yours: old posts, invoices, ad receipts, business registration, the phone number and email originally registered.
Screenshots including the URL bar and the system clock are far more useful than cropped images.
Step 4 — Use the platform's own recovery flow, once
Go through the official flow: "I can't access this account" → identity verification → video selfie or ID upload, depending on the platform. Do it carefully and completely, one time.
Do not submit the same appeal ten times. Repeat submissions are the single most common self-inflicted wound. They frequently close each other as duplicates, reset queue position, and in some systems flag the account for abuse of the appeal process. One complete, well-documented submission beats twenty desperate ones.
Step 5 — Warn your audience
From a secondary account, another platform, or your email list, tell your followers the account is compromised. Takeover attackers monetise by running investment or giveaway scams on the trust you built. A short warning limits the damage and it is also evidence of when the takeover began.
Step 6 — Contain the financial exposure
- If a business or ad account is attached, check for new ad campaigns and remove payment methods where you still can.
- Watch the card linked to the account for unauthorised charges.
- Change the password anywhere you reused the same one — attackers test credentials across services within hours.
Step 7 — Report it properly
Report the impersonating or compromised account through the platform's dedicated impersonation form, not just the in-app "Report" button. Then file a criminal complaint with the police in your country — unauthorised access to an account is a criminal offence in most jurisdictions, and the resulting case number is frequently useful in later correspondence with the platform.
Things that make it worse
- Buying a "recovery service" from a DM. See how to spot a recovery scam.
- Creating a new account with the same name. On some platforms this reads as ban evasion and can compromise the appeal on the original account.
- Deleting the impostor's content once you get access back. Preserve it first. It is your evidence.
- Waiting. Some platforms permanently purge disabled accounts after a fixed retention window. Late cases get harder, and eventually impossible.
When to bring in help
If the official flow has failed, if the automated appeal keeps returning the same template, or if the ban is for impersonation while you are the real person, the consumer route has run out. That is the point where a documented case through legal and policy channels changes the outcome — and where we can tell you honestly whether it is still winnable.