Why lockouts hit small businesses hardest

A large company has an IT team and a lawyer on call. A café, clinic, hotel or shop usually has one owner, one phone and a login set up years ago by someone who has since moved on. When access is lost, enquiries stop, ads stop, and customers may start receiving messages from an account that is no longer yours.

The good news is that platforms are taking the problem more seriously. In its December 2025 announcement (updated March 2026), Meta said new account hacks fell by more than 30% globally on Facebook and Instagram over the previous year. It also added a central support hub, better recognition of your usual devices and locations, and an optional selfie video to verify your identity during recovery.

But recovery tools can fail too. Security Affairs reported in June 2026 that a flaw in an AI-assisted Instagram recovery tool sent password reset links to email addresses that were not linked to the account. The flaw was reportedly active from about mid-April until early June 2026, and Meta disabled the tool. The report says owners with two-factor authentication turned on were protected, because a new password alone was not enough to log in. That is the lesson in one line: the basics still matter most.

1. Instagram and Facebook: reduce the single points of failure

Most social media lockouts trace back to one login, one phone number or one email inbox. Remove each of those weak points:

• Turn on two-factor authentication using an authenticator app or a passkey where offered. SMS codes are better than nothing, but an app is harder to intercept.
• Add a second trusted admin to your Facebook Page and Meta Business account — a business partner or senior manager, not a contractor who may leave.
• Check the recovery email and phone number. They should belong to the business and still work. An old employee's email is a common trap.
• Run Meta's Security Checkup and log out of devices you don't recognise.
• Remove old agencies and contractors from your business settings once their work ends.

If you are hacked, use only the recovery options inside the Facebook or Instagram app, or Meta's official help centre. Scammers often message victims within hours, offering to "unlock" the account for a fee. Do not reply, do not pay, and never give anyone your password or login codes.

2. Google Business Profile: be ready before a suspension

A suspended Business Profile can remove you from Google Maps and local search overnight. Google's help guidance on appeals sets out the official route:

• Use the Business Profile appeals tool while signed in to the Google account that manages the profile.
• Prepare evidence such as a business registration, licence, tax certificate or utility bill. The business name and address must match your profile exactly.
• Expect a review to take up to five business days, and wait for a decision before appealing again on the same issue.
• Do not create a new Business Profile for the same business. Google says this plainly.

Prevention is simpler. Make sure at least two people from your business are owners or managers on the profile. Keep your name, address and category consistent with your website and signage. Keep scanned copies of your registration documents somewhere you can find them quickly.

3. Your domain: who is the registrant?

Your domain name holds your website and, often, your email. If a former web developer registered it in their own name or their own registrar account, you may not legally control it. That leaves you exposed if they disappear, change jobs or fall out with you.

Check three things. First, the registrant name and organisation should be your business. Second, the registrar account should be one you can log in to yourself. Third, the account's contact email should be one you read. If any of these belong to someone else, ask them to move the domain into your account through the registrar's official transfer or change-of-registrant process. You should not need to share passwords for this.

4. Expired domains: the silent lockout

Domains expire more often than people think, usually because the renewal card expired or reminder emails went to an old inbox. Under ICANN's Expired Registration Recovery Policy, registrars of generic domains (such as .com) must send renewal reminders about one month and one week before expiry. After expiry, your website and email can stop working. Generic domain registries also offer a 30-day Redemption Grace Period after deletion, but restoring a name then often costs more. Some registrars may auction expired names, depending on their terms.

Country-code domains such as .in, .co.uk or .com.au follow their own registry rules, so check your registrar's terms. In every case, turn on auto-renewal, keep a valid payment card on file and renew for several years at a time if you can.

Lockout prevention checklist

Where Xuru can help

Xuru Technologies is a technology and digital marketing partner, not a platform or a law firm. We cannot override Meta, Google or a domain registrar, and nobody honest can promise that. What we do is help you use the official routes properly and set things up so a lockout is less likely to happen. We never ask for your passwords.

• Audit & Lock-down — US$149 / ₹4,999. We review your social accounts, Business Profile and domain ownership with you, and guide you through tightening them.
• Monthly Watch — US$29 / ₹999 per month. Ongoing checks on admins, renewal dates and warning signs.
• Lockout Case — US$199 / ₹7,999. Hands-on support through the official recovery or appeal process when you have already lost access.
• Multi-location businesses — from US$399 / ₹14,999.

Frequently asked questions