Locked out of your company's Facebook pages by two-factor authentication: how we got a hotel group's pages back

By Yair Cohen, Solicitor specialising in internet law. Case led by Filiz Kiani.

This case study is part of our social media account recovery section.

If your company has been locked out of its own Facebook pages because the phone with the authenticator app was lost, and Facebook's recovery forms lead nowhere, the pages can usually be recovered. We did it for a hotel group whose pages, Messenger inbox and customer conversations had been out of reach for months. Names and some details have been changed to protect the client; what happened, what we did and how it ended are as they were.

Locked out of a Facebook business page: what happened to the hotel group

The client is a hotel group with resorts in several European countries, the kind of business that sells most of its holidays online. Its Facebook pages were not a side project. They carried the offers, the seasonal campaigns and, through Messenger, a steady stream of guests asking about bookings, changes and refunds.

The group's digital marketing manager, who we will call Dana, administered the pages through her own Facebook profile, protected by two-factor authentication on a third-party authenticator app. One day her work phone was lost. The app went with it, and the backup codes Facebook had offered when she set it up had never been saved. From that moment nobody in the company could log in to the pages, and nobody could read or answer the messages arriving in them.

The damage built quietly. Guests wrote and heard nothing back. Some assumed the group was ignoring them; others, seeing no reply for weeks, assumed they had been blocked. Complaints came in through other channels about the silence on Facebook. By the time the company came to us, it put the fall in sales and marketing opportunities from the pages at somewhere between 60 and 70 per cent.

Why Facebook account recovery fails when the authenticator phone is lost

Facebook's account recovery process is built for an individual who has lost access to a personal profile: upload your ID, wait, try again. It is not built for a company that has lost the one profile which administered its business pages. Dana did everything the help pages asked. The system either returned an automated reply or asked for a code from the app that no longer existed. There was no way to explain to a form that a business with thousands of customers was locked out of its own shop window.

We see this pattern in most of the business lock-outs that reach us. A page is set up years earlier by one employee, security is added to that person's profile, and nobody thinks about what happens if that phone, that person or those codes disappear. The company owns the brand, the resorts and the customers, but as far as the platform's software is concerned the only person who matters is the one who can no longer log in.

The company owned the hotels, the brand and the customers. The only thing it did not own, as far as Facebook's software was concerned, was the right to log in.

The right of access: the piece of data protection law that gets a business account back

Few business owners know that the strongest tool for recovering a locked Facebook page is not in Facebook's terms at all. It is the right of access to personal data. That right belongs to people rather than companies, but a company's pages are full of people's data: the manager who looked after them and the guests who wrote in. Asserted properly on their behalf, it is a right a platform cannot switch off because a code from an app is missing. Used correctly, it turns a support ticket into a legal obligation. Used loosely, in an angry email that mixes it up with complaints about the rules, it is ignored like everything else.

So we started where we always start: with proof. Dana gave us a detailed statement of how the pages were created and used, and the company gathered the evidence that the pages were its own, from the dates they were opened and the advertising paid for through them to the company records behind the brand. With that in hand we wrote to Facebook in Dublin and, separately, to its data protection officer.

The letter did not argue about Facebook's rules. It identified the personal data sitting inside those pages and that inbox, set out the right of access to that data held by the people it belonged to, which is why the manager's statement mattered as much as the company's records, recorded that access had been asked for and not given, and gave Facebook a deadline. Each of those elements matters. A request that does not identify the data, or the legal basis, or a date by which an answer is due, gives the platform nothing it has to act on. That precision is what you are paying solicitors for, and it is the difference between a letter that is filed and a letter that is escalated.

Then came the part no client enjoys. Facebook replied from time to time, through support addresses, asking for information it already had or pointing back to the recovery forms. We answered every message and chased every fortnight. Four months passed. The pages stayed locked.

How a draft claim form forced Facebook to restore the company's pages

When a platform's support channels have gone round in circles for long enough, we stop writing to support. We prepared a claim form, the document that starts a court case, setting out the claim against Facebook and the orders the court would be asked to make, and we sent it to Facebook with a letter saying we would issue it unless Facebook restored the pages. A court can order a company to comply with a person's right of access, and Facebook's lawyers knew it.

Within days the matter was no longer with support. It was with Facebook's external lawyers in Dublin, and for the first time there was a person on the other side who could read the file, ask sensible questions and make a decision. They asked for a formal statement from the company and a signed declaration from us confirming who the company was and who was entitled to the pages. We provided both. After a few more months of correspondence with the lawyers, Facebook reinstated the pages and the company had its inbox, its customers and its campaigns back.

We never had to issue the claim. The draft was enough to move the matter from a queue that is designed to say no to a desk where someone can say yes.

A support form is designed to say no. A draft claim form puts the file on the desk of someone who is allowed to say yes.

Legal advice for a business locked out of its Facebook page

The first lesson from this case is about time. Nearly a year passed between the lost phone and the restored pages, and most of that year went on routes that were never going to work. Since this case we move to the legal step far sooner, and most of the business accounts we take on now come back in weeks rather than months. If your company is locked out, the day to call is the day the forms start repeating themselves, not six months later.

The second lesson is about evidence. Everything that eventually persuaded Facebook's lawyers existed on day one: the company records, the advertising receipts, the history of the pages, a clear account from the person who looked after them. Gathering it early, and keeping a note of every attempt to recover the pages, shortens the whole process.

The third is about what not to do. Do not open a replacement page, which abandons your reviews, your followers and the history that proves ownership. Do not pay a "recovery service" found on a forum. And do not let the person who lost access leave the company without first putting their account of events in writing.

Once the pages are back, spend an hour making sure it cannot happen again: more than one administrator, each with their own two-factor set-up, the backup codes printed and kept in the office safe, and the pages held under the company's own business account rather than one employee's profile. Our guide to recovering a lost social media account explains the law in more detail, and how we recover a lost social media account when the platform says no sets out the steps we take. Other business matters are collected under business case studies.

Lawyers' thoughts about the case

What stays with us from this matter is how ordinary the cause was. No hacker, no dispute, no breach of any rule: one lost phone, and a company with resorts in several countries could not speak to its own guests for the best part of a year. The platform's systems treated a business of that size exactly as they would treat a teenager who had forgotten a password, because the systems only know how to deal with the individual profile that holds the keys.

The legal lesson is that the right of access did its job, but only once it was put in a form the other side could not treat as customer correspondence. The letter to Facebook was correct from the first day. What changed the outcome was the draft claim form, which told Facebook that the next document would be issued at court and that a judge, rather than a support agent, would be reading the file. We now reach that step far earlier than we did in 2021, and our clients' accounts come back far sooner as a result.

The practical lesson is for every business that lets one employee hold the only login. The cost of a second administrator and a printed sheet of backup codes is nothing. The cost of not having them, for this client, was close to a year of lost bookings and a legal matter it should never have needed.

Frequently asked questions

Our only administrator lost the phone with the authenticator app. Is the page gone for good?

Usually not. The page and everything in it still exist on Facebook's servers; what has gone is the ability to log in. If the recovery forms fail, a properly evidenced letter from solicitors, and if necessary a draft claim, can get the company's access restored, as it did for the hotel group in this case.

Can a company recover a Facebook page in its own name, or does it have to be the employee?

The company can act. The pages, the advertising spend and the customer conversations belong to the business, and we write on the company's behalf with the employee's statement as part of the evidence. That also protects you if the employee has since left.

How long does it take to get a business Facebook page back?

In this case nearly a year, most of it lost to the support route before we were instructed and in the months of chasing that followed. Today we move to the legal step much sooner, and most business accounts we take on are back within weeks. We tell you what to expect on the first call.

Will we have to go to court?

In our experience, rarely. The draft claim form is what moves the matter from Facebook's support queue to its lawyers, and the pages in this case came back without a claim being issued. If a platform still refused, the court can order it to comply, and we would advise you on that step before you spent anything on it.

What should we do while the page is locked?

Tell your customers through your website, email and other channels that Facebook messages are not being seen, so the silence is not read as rudeness. Keep every email and screenshot from the recovery attempts. Do not open a new page in the meantime, and do not pay anyone who promises to get the page back for a fee in cryptocurrency.