Former business partner locked you out of the company Instagram account? How we got a festival company's account back

By Yair Cohen, Solicitor specialising in internet law

This case study is part of our social media account recovery section.

If a former business partner, shareholder or employee has changed the password on your company's Instagram account and locked everyone else out, the account can be returned to the company without a court case. We did it for an events company whose festival account had been taken by a departing shareholder, by proving to Meta who the account belonged to. Names and some details have been changed to protect the client; what happened, what we did and how it ended are as they were.

Locked out of the company Instagram account by a former business partner: what happened

The client is a company that stages festivals and outdoor events on a private country estate owned by its director's family. It found its feet during the pandemic, when it put on socially distanced festivals with guests in their own tents, outdoor dining and film nights under the sky. Its Instagram account was where the next event was announced, where tickets were sold and where the audience it had built over two difficult years lived.

One of the shareholders, who we will call Rachel, had been looking after the company's social media. The relationship broke down. She had run up debts in the company's name, which the director ended up paying personally, and the other owners discovered that she was organising festivals at other venues without telling them, in breach of her agreement with the company. The shareholders removed her.

By then she had already acted. The Instagram password had been changed, the account's email had been switched to her personal address, and every other owner was blocked out. The company could see its own account, its own followers and its own name on screen, and could do nothing with any of it.

Why Instagram's hacked-account route does not help when an insider changed the login

Instagram's recovery tools are built for a stranger breaking in. They assume the real owner still controls the email or phone number on the account, or can prove identity with a selfie video that matches the photos on the profile. None of that fits a company account that was set up by one person, with that person's details, and is now held by that same person against the company's wishes. To Instagram's systems, Rachel looked like the account holder. The company looked like the intruder.

We see this more than people expect. A founder leaves, a marketing freelancer is let go, a partner falls out with the others, and it turns out that the account everyone thought belonged to the business was registered to the person who has just walked out of the door with the login. The platform's forms cannot resolve a dispute about who owns a business. People can.

To Instagram's systems the departing shareholder looked like the account holder, and the company that had built the audience looked like the intruder.

Proving the company owns the Instagram account: the letter and witness statement to Meta

Getting an account back from an insider is an exercise in evidence, and the evidence has to be put in a form a lawyer at the platform can act on. A message saying "she stole our account" goes nowhere. A witness statement from the director, backed by documents, is something Meta's legal team can rely on if it is ever asked why it handed the account over.

So we built the file: the company's records, showing who owned the business and that Rachel had been removed as a shareholder and when, and the evidence that the account had been created for the company and used for its festivals on its estate. The director set this out in a witness statement with the documents attached, and we sent it with a solicitors' letter to Meta, which operates Instagram.

Two things carry a letter like this. The first is ownership: the account was a company asset, created for the company's business and holding its customer relationships, and a removed shareholder has no right to keep control of it. The second is the law that sits behind that: a person who carries on operating a company's account after her authority to do so has ended may be committing an offence under the Computer Misuse Act 1990, which is not a position a platform wants to be seen to be protecting. The law here is not obscure, but it has to be put correctly, with the ownership proved first and the legal consequence second. A letter that leads with threats and follows with no evidence is ignored.

How Meta's lawyers returned the Instagram account to the company

Meta did not answer the letter from its support channels. It instructed its legal representatives to deal with the matter, which is what a properly evidenced letter is designed to make happen, and from there the conversation was between lawyers rather than with a form. The outcome was the one the company had asked for: the Instagram account was returned to the company.

It took a few months from instruction to return. No claim was issued, and the company did not have to negotiate with the person who had locked it out or depend on her goodwill to get its own property back.

The company did not have to negotiate with the person who had locked it out, or depend on her goodwill, to get its own property back.

Legal advice for a business whose partner or employee has taken the social media account

Move early, before the person who holds the account changes anything else or starts posting. The sooner we write, the shorter the history we have to unpick, and the less chance there is of the account being renamed, emptied or used against you. Ask us on the day you find out, not after a month of messages to the person asking nicely.

Gather the paperwork that shows the business owns the account: company records, the agreement with the person who looked after it, invoices for advertising paid through it, screenshots of the account being used for the business over time. Decide early who in the business will sign the witness statement, because it is that person's account of events, under a statement of truth, that carries the file.

Do not start a public argument on the account or elsewhere, and do not set up a replacement account unless you have no choice, because a new account starts from zero and weakens the argument that the old one is yours. Where the person is reachable and relations allow, a solicitors' letter to them directly can end things quickly; where they are not, the route through the platform's lawyers, as in this case, does not depend on them at all.

Once the account is back, hold it under the company's own business account with at least two administrators from the company, recovery details on a company email address, and two-factor codes that do not live on one person's phone. Our guide to recovering a lost social media account explains the law in more detail, and how we recover a lost social media account when the platform says no sets out the steps we take. A hotel group's case, where the lock-out came from a lost phone rather than a departing insider, is told in locked out of your company's Facebook pages by two-factor authentication, and other business matters are collected under business case studies.

Lawyers' thoughts about the case

This matter is a reminder that the biggest risk to a company's social media account is usually not a hacker on another continent. It is a person inside the business who was trusted with the login and who leaves on bad terms. The account had been treated as "Rachel's" because she set it up and looked after it, and by the time anyone looked at who actually controlled it, the relationship had already broken down.

The legal lesson is that ownership of an account is proved, not asserted. Meta's lawyers were able to act because the director's statement and the documents behind it left no real room for doubt about whose account it was and when Rachel's authority had ended. Had we written without that file, we would have been one more voice in a dispute between former partners, and the platform would have left the account where it was.

The practical lesson is for every small company that lets one person hold the keys. An account that sells your tickets is as much a company asset as the till. It belongs in the company's name, on a company email, with more than one person able to get in. The cost of arranging that is an afternoon. The cost of not doing it, for this client, was a season's marketing in someone else's hands and a legal matter it should never have needed.

Frequently asked questions

A former partner changed the password on our company Instagram account. Can we get it back without going to court?

Usually, yes. In this case the account came back through a solicitors' letter and a witness statement to Meta, with no claim issued. Court is the fallback if a platform will not act, and we would advise you on that before you spent anything on it.

Does it matter that the account was set up in her name?

It makes the platform's forms useless, but it does not decide ownership. An account created for a business, used for its events and paid for by it is the business's asset whoever typed in the email address on day one. The documents that show that history are what win the argument.

Is it a crime for someone to keep control of a company account after they have left?

It may be. Operating a computer system without authority is an offence under the Computer Misuse Act 1990, and a former insider whose permission has been withdrawn can fall within it. We raise that with the platform where the facts support it, but the account comes back on the strength of the ownership evidence rather than on threats.

How long did it take?

A few months from instruction to the account being returned, most of it waiting for Meta to move the file from support to its lawyers. We tell you what to expect on the first call, and in most matters of this kind the account is back within weeks.

Should we write to the person ourselves first?

If the relationship allows a civil conversation, a direct approach can work, but keep it short and in writing. If it has already broken down, as it had here, a message from you tends to harden positions and gives them warning. Speak to us first and we will tell you which route fits.