1) Why attackers want your accounts
They monetize by pushing scams, stealing contacts, or extorting access back.

2) Setup checklist (do it now)
Unique, strong password in a password manager.
Enable 2FA (authenticator app/hardware key; avoid SMS if possible).
Recovery info: update email/phone; store backup codes offline.
Admin hygiene: use separate admin accounts; remove ex-staff; least-privilege roles.
Trusted devices: review sessions monthly; log out old devices.
Business Manager / Telegram Owners: centralize page/channel ownership with named admins.

3) Common takeovers in Somalia
“Policy violation” phish: fake Meta/Twitter notices → login page clone.
WhatsApp 6-digit code relay via friend/colleague account already hacked.
SIM-swap leading to password resets.
Malicious browser extensions that read cookies.

4) Red flags & link hygiene
Links that are not from facebook.com / instagram.com / twitter.com / whatsapp.com / telegram.org.
“Verify in 24h or page removed.”
Apps/extensions asking for broad permissions.
DMs asking for codes.

5) If you’re locked out
Use official recovery:
Facebook/Instagram: “Report compromised account” flow (+ ID if needed).
X: account support form; provide handle + email.
WhatsApp: email support@whatsapp.com
from the number’s email; add phone with country code.
Telegram: in-app support or recover@telegram.org.
Revoke sessions on email first (email is the master key).
Notify followers using the website or other channels.
Preserve evidence (screenshots/headers) for incident report.

6) After recovery
Rotate password + enable 2FA.
Audit connected apps & tokens; remove unknown ones.
Review admins, editors, and bots.
Publish a brief notice: “We had a security issue; ignore messages sent during [dates].”

7) Team playbook
One security focal point keeps backup codes in a secure vault.
Quarterly access review (roles, sessions, tokens).
Pre-draft incident messages to post if compromised.

8) Awareness snippets
DM Tip: “No platform will ask for your 6-digit code in a DM. If asked, it’s a scam.”
Poster: “Check the domain before you log in.”