The recovery email belongs to an ex-employee. Your business still uses the social account, but the person who receives its recovery messages no longer works with you.
That is a problem worth finding before you need to reset a password. An email address in account settings is useful only if the appropriate owner can open its inbox. The same applies to a connected phone number.
Does your recovery setup survive a staff change? Here is a practical way to check.
Check who can receive a recovery message today
Review the recovery contacts for each business social account through the platform’s official settings. Check the connected email address and phone number, then confirm who controls them.
Ask these questions:
- Can the appropriate account owner access the listed inbox?
- Is the connected phone number still active and under the right person’s control?
- Does access depend on an employee’s personal device or an outside contractor?
- If that person leaves tomorrow, is there a documented handover process?
Do not request or circulate login codes just to demonstrate access. Never put recovery codes, passwords or backup codes in a public post or a shared handover document.
Keep business recovery under appropriate business control
For business-owned accounts, use recovery contacts that the business can maintain. Secure the recovery email account itself, including its own sign-in and recovery arrangements. A social account’s recovery setup is only useful if the inbox behind it remains accessible and protected.
Personal profiles need a different boundary: the individual should retain control of their personal identity and recovery details. Give colleagues the platform’s appropriate business or Page access rather than handing over a personal login.
Include recovery contacts in staff handovers
Before an employee or agency finishes working with you, review account access together. Update outdated recovery contacts through official settings while the authorized owner still has access, and complete any verification the platform requires.
Document which business assets exist, who is responsible for them and where the access procedure is kept. Store secrets in an appropriate password manager, with access limited to authorized people. Remove former team members’ business permissions when their work ends.
This is also worth checking when someone changes their phone number, replaces a device or moves to a different role.
Already unable to receive a code?
Use the platform’s official recovery process. Having an old email address or phone number listed does not guarantee that you can change it without verifying ownership. Do not try to access a former employee’s personal inbox or share a code with someone promising a shortcut.
If the issue is a two-factor authentication prompt, read my guide to being locked out by 2FA on Facebook or Instagram. If contact details changed without your permission, start with what to do after a Facebook account is hacked.
One useful action today
Choose one important business social account and confirm who controls its recovery email and phone. Fix any outdated contacts through official settings while access still works.
Your next staff change should not be the moment you discover who gets the code.