Recovering or Defending a Social Media Account or Handle: A Practical Guide

Summary. This guide walks a business, a creator, or their lawyer through recovering a social media account or handle in the four situations that cause most disputes (a hacked account, an account held by a former employee or agency, an impersonating account, and a squatted handle), plus a suspension by the platform itself. It begins with the decision points that set the strategy: what kind of problem it is, who can prove ownership, what the client actually needs, and which channel will move fastest. Ten numbered steps then cover evidence capture, securing the accounts that remain, platform recovery and law enforcement for hacks, demand letters and injunctions against insiders, agency disputes, impersonation reports and lawsuits, squatted handles, and suspension appeals. A separate step addresses the other side: the employee, creator, agency, or parody account accused of holding or misusing an account. A timeline and cost table, a worked example running through each step, common mistakes, an FAQ, and practical takeaways close the guide.

At 5:40 on a Saturday morning, the owner of Larkhaven Outdoor Supply, a four-store camping retailer, wakes to a text from her bank asking whether she authorized a change to her mobile number. She did not. By 7:00 the company's TikTok account, with 380,000 followers, is posting videos promoting a cryptocurrency "Larkhaven Token," its recovery email has been changed, and the two-factor codes are going to a phone she has never seen. By noon she discovers the second problem: the Facebook page and Instagram account are fine, but she cannot change anything on them, because the agency Larkhaven fired in March, Brightline Social, still holds the only admin role and is not answering emails until its final invoice is paid. And on Monday a customer forwards a message from "Larkhaven Support," an Instagram account with the company's logo, asking for her order number and card details to process a refund she never requested.

Three problems, three different paths. The hacked TikTok account is a platform recovery problem with a law enforcement side. The agency is a contract and agency-law problem that the platform can partly solve. The fake support account is an impersonation problem that needs a platform report today and a customer warning within the hour. This guide takes each path step by step, and also covers the less common but costlier ones: the former employee who renames the account on the way out, the squatter who registers a brand's handle, and the platform that suspends the account itself.

For the doctrine behind these steps (who owns an account, why the ACPA does not cover handles, how JLM Couture changed the ownership analysis), see Social Media Account and Handle Disputes: Impersonation, Username Squatting, and Who Owns a Company Account. The task list version is the Social Media Account Ownership and Impersonation Response Checklist: A Practical Checklist, and the letters, clauses, and complaint templates are in the Social Media Account Toolkit: Ownership Policies, Platform Complaints, and Demand Letters.

The short answer

• Capture first. Before reporting anything, capture the account, posts, messages, and profile changes with URLs, numeric account IDs, and timestamps. Platforms remove evidence when they act.
• Secure what you still control. The email account and phone number behind the social account are usually the real target. Lock them down, add a carrier port-out lock, and revoke active sessions everywhere.
• Hacked accounts come back through the platform, not the courts. Use the platform's hacked-account flow and identity verification, report to law enforcement, and never pay a hacker. Courts rarely add speed.
• Insider and agency lockouts are contract problems. Assemble the ownership evidence, send a written demand that revokes access, and be ready to seek a temporary restraining order on contract and property claims under Fed. R. Civ. P. 65. Treat the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, as a supporting claim, not the lead.
• Impersonation is reported twice. File under the platform's impersonation policy and its trademark policy, warn customers, report fraud to the FTC, and sue (Lanham Act, publicity rights, state impersonation statutes) only when the platform fails and the harm is real.
• Squatted handles are a platform trademark issue. The ACPA, 15 U.S.C. § 1125(d), applies to domain names only. A registered mark makes platform complaints work. Do not pay squatters.
• Suspensions are appealed, not litigated. 47 U.S.C. § 230 and the terms of service defeat nearly every lawsuit against a platform over account decisions.
• If you are the one accused, slow down. Do not delete content or followers, do not change the account further, read your agreements, and respond in writing. Ownership is often closer than the demand letter suggests.

Before you start: five decision points

1. What kind of problem is it?

Many incidents combine two or more rows. A departing employee may also create a look-alike account. A hacker may rename the account and leave the original handle open for a squatter. Work each row in parallel, with one person owning each.

2. Who can prove ownership?

For anything other than a stranger's hack, the first question a platform, an opposing lawyer, or a judge will ask is whose account it is. Courts disagree on method. Some use a multi-factor test that looks at the account's branding, purpose, promotion, and management, as the bankruptcy court did in In re CTLI, LLC, 528 B.R. 359 (Bankr. S.D. Tex. 2015). The Second Circuit, applying New York law in JLM Couture, Inc. v. Gutman, 91 F.4th 91 (2d Cir. 2024), rejected that test and directed courts to start with who owned the account when it was created and whether a contract later transferred it. Before taking a position, gather evidence for both approaches:

• Any employment agreement, contractor or agency contract, policy acknowledgment, or purchase agreement that names social media accounts.
• Who created the account, when, with whose email and phone number, and for what purpose.
• The handle and display name history, and the account's numeric ID.
• Who paid for ads, verification, and tools.
• Whether the business linked to the account from its website and materials.
• Who had credentials and admin roles, and when.
• The platform's terms on account ownership and transfer.

If the evidence is weak, say so to the client now. A company that sends an aggressive demand and then loses the ownership question invites fee claims and bad publicity.

3. What does the client actually need?

Usually the goal is control of the account, quickly, with its audience intact. Damages are rarely worth pursuing: in Eagle v. Morgan, No. 11-4303, 2013 WL 943350 (E.D. Pa. Mar. 12, 2013), the plaintiff proved liability for misuse of her LinkedIn profile and recovered nothing because she could not prove damages with reasonable certainty. Decide early whether the client needs (a) the account back, (b) a look-alike removed, (c) a handle released, (d) a public correction, (e) money, or (f) a court order that will deter the next attempt. The answer drives whether to litigate at all.

4. Which channel moves fastest?

Platforms can fix almost every problem in this guide faster than a court. Each major platform has separate channels for hacked accounts, impersonation, trademark, copyright, and business support, and they do not talk to each other. Accounts that spend money on advertising, or that are enrolled in a paid verification or business program, usually get faster human review. Identify the right channel before filing anything, and note any rule against duplicate reports.

5. Who is on the team?

For a business: an owner or executive who can verify identity, the person who manages the accounts, IT or the managed service provider who controls the email domain and phones, outside counsel if a demand or lawsuit is likely, and a communications lead to warn customers. For a creator: the creator, their manager, and counsel. Name one person to own each channel and one person to keep the evidence file.

Step 1: Capture the evidence in the first hour

What to do. Capture every relevant page before reporting: the account profile (handle, display name, bio, profile and header images, follower count, creation date if shown), every post and story at issue, comments and replies, direct messages received by customers, the account's numeric ID, and any notification emails from the platform about password, email, or phone changes. For each capture, record the full URL, the date and time displayed and the time zone, the capture time, and who captured it. Use a method that records the URL and produces a hash or other integrity record, and keep native files.

Why. Platforms remove impersonating content and restore hacked accounts by wiping the attacker's changes. The evidence for a later lawsuit, a law enforcement report, or an insurance claim disappears with them. Authentication under Fed. R. Evid. 901 requires evidence that the item is what it is claimed to be, and a screenshot without a URL or a capture record invites a fight. The collection methods and declarations are in Collecting and Authenticating Messaging and Social Media Evidence: A Practical Guide, and the authentication doctrine is in Authenticating Text Messages, Chats, and Social Media Evidence: Rules 901 and 902, Metadata, and Deepfake Challenges.

Pitfalls. Do not log into a former employee's personal account to capture its contents, even if you know the password: the Stored Communications Act, 18 U.S.C. § 2701, and state law may treat that as unauthorized access. In Pietrylo v. Hillstone Restaurant Group, No. 06-5754 (D.N.J. 2009), a jury found a restaurant liable under the SCA after managers used a password obtained from an employee under pressure to read a private MySpace group. Capture what is publicly visible, and what customers forward to you.

Preserve your own records. Issue a short hold notice covering the business's emails with the employee or agency, the onboarding and offboarding records, ad invoices, analytics exports, and password-manager logs. The client's duty to preserve begins when litigation is reasonably anticipated. See Litigation Hold and Evidence Preservation Checklist: A Practical Checklist.

Timing and cost. One to three hours of staff time. Do it before anything else, but do not let it delay securing the email account in Step 2 if an attack is ongoing; one person captures while another secures.

Step 2: Secure the accounts you still control

What to do.

1. Secure the email account that receives the social account's recovery messages. Change its password from a clean device, revoke all active sessions, review forwarding rules (attackers add silent forwarding), and switch to an authenticator app or hardware key.
2. Secure the phone number. Call the mobile carrier, confirm whether a SIM change or number port occurred, restore the number, and add a port-out lock or PIN. SIM swapping, where an attacker persuades a carrier to move the victim's number to a new SIM, is one of the most common routes into social accounts. The FCC adopted rules in late 2023, in 47 C.F.R. part 52 (number ports) and 47 C.F.R. part 64, requiring wireless carriers to use secure authentication before SIM changes and number ports and to notify customers of those requests; in July 2024 the FCC deferred compliance until the rules' information-collection requirements clear federal paperwork review, so check the current status when advising a client.
3. Secure every other account that uses the same credentials or the same email, starting with the business's ad accounts, password manager, domain registrar, and payment processors. A social account compromise is often the visible part of a larger one; if the email domain itself was compromised, treat it as a security incident and read Responding to a Data Breach: The First Seventy-Two Hours.
4. Review admin roles on every platform where the business has a business portfolio, page, or brand account. Remove anyone who should not be there, and add a second trusted administrator so no single person or device is a point of failure.
5. Change shared passwords that any departed employee or agency knew, and store them in a company password manager.

Why. Platforms recover accounts by sending codes to the email and phone on file. If the attacker still controls either, recovery fails or is reversed within hours. And if the business's domain registrar is also compromised, the problem is bigger than social media; see Recovering a Hijacked Domain Name: A Practical Guide.

Pitfalls. Changing the password on an account a former employee still uses can look like a lockout if ownership is genuinely disputed. Where the account is clearly the business's (company email, company handle, company admin portfolio), secure it. Where the former employee has a colorable claim, send the written demand in Step 4 first, or at the same time.

Timing and cost. Within the first hours. Internal time; a managed service provider may bill a few hours.

Step 3: Recover a hacked account

What to do.

• Use the platform's hacked-account flow. Each major platform has one, separate from its general help center. Expect to verify identity with a selfie video, a government ID, or a code sent to the original email or phone. Business accounts may be able to verify through business documents or through an admin of the business portfolio.
• Use every available channel at once. Business support or advertiser support, verified-subscription support, and any account manager the business has. A business that spends money on ads should open an advertiser ticket.
• Notify the audience from every account you still control: the account was compromised, do not click links or send money, and the business will confirm when it is secure.
• Report to law enforcement. File a complaint with the FBI's Internet Crime Complaint Center (IC3) and a local police report. Unauthorized access to an account is a federal crime under 18 U.S.C. § 1030, and fraud schemes run through the account may be wire fraud, 18 U.S.C. § 1343. A demand for payment to return the account may be extortion under 18 U.S.C. § 875(d). The report number also helps with platforms, banks, and insurers.
• Check insurance. A cyber policy may cover response costs, forensic work, and some business interruption. Give notice early; see Directors and Officers and Cyber Insurance: Towers, Triggers, Allocation, and the Claim You Must Notice.
• Assess notification duties. If the attacker had access to customers' direct messages containing personal information, state breach-notification laws may apply, depending on the data involved.

Why. Platforms are the only party that can restore the account. Courts can order a defendant to return credentials, but a stranger who hacked an account is usually anonymous, overseas, or both, and a lawsuit adds months. The CFAA's civil remedy, § 1030(g), requires a qualifying "loss" (usually at least $5,000 in a year) and is useful mainly to recover response costs from a hacker who can be identified and found.

Pitfalls.

• Never pay. Hackers who hold accounts for ransom rarely return them, and payment marks the business as a target. If a payment is being considered at all, treat it with the care of a ransomware decision, including sanctions screening; see Ransomware and the Payment Decision: OFAC Sanctions, Reporting Duties, Insurance, and Negotiating With Attackers.
• Beware recovery scams. Accounts that reply to complaints offering to "recover your account for a fee" are themselves scams. Use only official platform channels.
• Do not create a replacement account under the same brand without labeling it. If recovery takes weeks, a temporary account may be necessary, but label it clearly as temporary and link to it from the website, or the platform may treat it as impersonation.

Timing and cost. Many recoveries take a few days; some take weeks, and a minority fail. Internal time, plus forensic costs if the compromise extends beyond social media.

Step 4: Recover an account held by a former employee or insider

This is the scenario the case law addresses most, and the one where legal process matters most.

4a. Build the ownership file. Using the evidence list in decision point 2, write a one-page ownership memo for the lawyer and the client: what the agreements say, what the creation facts are, how the account was used, and how a court applying either the multi-factor approach or the JLM Couture approach would likely see it. Include the weak points.

4b. Try the platform first, if the business can verify ownership. Where the account sits inside a company-owned business portfolio, a company administrator may be able to remove the former employee's access directly. Where the employee renamed the account and is now using it to compete or to speak as the company, the platform's impersonation or trademark channels may also apply. Platforms generally will not decide a genuine ownership dispute between an employer and an employee, so expect them to ask for a court order if the facts are contested.

4c. Send a written demand that revokes access. The letter should identify the account by its numeric ID and every handle it has used; state the basis of ownership, quoting the agreement or policy; expressly revoke any authorization the person has to access or use it; demand return of the credentials, login email, and two-factor method, restoration of the handle and display name, and preservation of all content, followers, and messages; set a short deadline (48 to 72 hours is common for an active lockout); and offer a reasonable process (for example, a video call in which the person transfers control and keeps copies of personal photos). A model is in the toolkit.

Why revocation matters: in Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058 (9th Cir. 2016), continued access after a cease-and-desist letter revoking permission was access "without authorization" under the CFAA. After Van Buren v. United States, 593 U.S. 374 (2021), which reads authorization in terms of whether a gate is up or down, a clear written revocation is the best way to put the gate down.

4d. Choose the claims. If the demand fails, the realistic claims are:

4e. Move for a TRO or preliminary injunction if the account is being used against the business. The standard is Winter v. Natural Resources Defense Council, Inc., 555 U.S. 7 (2008): likely success on the merits, likely irreparable harm without relief, a balance of equities in the movant's favor, and the public interest. In Ardis Health, LLC v. Nankivell, No. 11 Civ. 5013 (S.D.N.Y. Oct. 19, 2011), the court ordered a fired social media producer to return login information for the company's websites and social media accounts, because the company's inability to control its own online presence was harm money could not repair, and the court did not need to resolve the merits to grant that relief. The record that wins has four parts: the agreement or policy naming the accounts, a declaration from the person who manages the accounts describing the lockout, evidence of ongoing harm (customer confusion, lost traffic or sales, posts made in the company's name), and a narrow proposed order that requires return of credentials and preservation of content, rather than a sweeping speech injunction. Fed. R. Civ. P. 65(b) permits a TRO without notice only on specific facts showing immediate and irreparable injury and a certification of efforts to give notice; a TRO lasts no more than 14 days unless extended for good cause; and Rule 65(c) requires security. A preliminary injunction requires notice. Detailed briefing guidance is in Preliminary Injunctions and Temporary Restraining Orders: Emergency Relief in Federal Court.

4f. Ask for expedited discovery only if needed. If the business needs to know who changed the credentials, or what was done with the account's data, a motion for expedited discovery under Fed. R. Civ. P. 26(d)(1) can accompany the injunction motion. Keep the requests narrow.

Constraints on the business. Do not demand the employee's personal account credentials: a large and growing number of states prohibit employers from requiring or requesting access to employees' personal social media, such as Cal. Lab. Code § 980. Do not frame the demand as an effort to stop the employee from criticizing the company: Section 7 of the NLRA, 29 U.S.C. § 157, protects concerted employee speech about working conditions, including on social media, NLRB v. Pier Sixty, LLC, 855 F.3d 115 (2d Cir. 2017). And do not threaten criminal charges to gain leverage in the civil dispute.

Timing and cost. A demand and negotiation: days, and a few thousand dollars in fees. A contested TRO and preliminary injunction: two to six weeks, and typically tens of thousands of dollars. Full litigation: a year or more, and rarely worth it once the account is back.

Step 5: Recover an account held by an agency or contractor

What to do.

1. Read the contract. Look for clauses on ownership of accounts, handles, content, ad accounts, and data; return of materials on termination; whether the agency may withhold deliverables for nonpayment; and dispute resolution. Look separately for a copyright assignment, because content created by an independent contractor belongs to the contractor unless assigned in writing (most social content is not within the nine categories of commissioned works that can be works made for hire under 17 U.S.C. § 101); see 17 U.S.C. § 201.
2. Separate the money from the account. If there is a genuine invoice dispute, offer to pay the undisputed amount, or to escrow the disputed amount, in exchange for immediate transfer of admin roles. Agencies are agents; an agent generally must return the principal's property at the end of the relationship and is on weak ground holding it as security unless the contract allows it.
3. Send a demand that identifies every account, page, ad account, and business portfolio, requests that the business be made the owner and primary administrator, and requests delivery of all content files and passwords. Set a short deadline and offer a joint transfer call.
4. Use the platform's business tools. Where the agency created the page inside its own business portfolio, the platform will often treat the agency as owner. Platforms have processes for a business to claim a page or account that represents it, typically requiring business documents, a matching domain email, or a trademark registration. These processes take time, so start them in parallel with the demand.
5. Escalate proportionately. A small-claims or county-court action for return of property may be faster and cheaper than federal court. A Rule 65 motion is available where the agency is actively using the accounts against the business.

Pitfalls. Firing the agency before securing admin access. Accepting a "handover" of passwords to accounts registered to the agency's email. Forgetting the ad account, which holds payment methods and audience data. And for the agency: holding accounts hostage can turn a collectible invoice into a counterclaim for conversion and lost sales; sue on the invoice instead.

Timing and cost. Days if the agency cooperates, weeks if a platform claim process is needed.

Step 6: Remove an impersonating account

What to do.

1. Capture the impersonating account and every message it has sent (Step 1).
2. Report under the impersonation policy. Provide the impersonating URL and handle, the authentic account's URL, proof of identity (government ID for a person; business documents and authority for a company), and a short description of what was copied. Impersonation reports usually do not require a trademark registration.
3. Report under the trademark policy if the account uses the business's name or logo. Give the registration number, jurisdiction, and goods or services, and describe how the account uses the mark. Many businesses file both reports.
4. Report copied photos and videos under the DMCA where the business or person owns the copyright. A takedown notice must meet 17 U.S.C. § 512(c)(3), including a statement of good-faith belief that the use is unauthorized, which requires considering fair use, Lenz v. Universal Music Corp., 815 F.3d 1145 (9th Cir. 2016), and knowing misrepresentations create liability under § 512(f). See How to File a DMCA Takedown Notice (And Respond to One).
5. Warn the audience from authentic channels: the business never asks for card details or passwords in direct messages, and here is the only official account.
6. Report fraud. Report scams to the FTC, whose Rule on Impersonation of Government and Businesses, 16 C.F.R. part 461, targets exactly this conduct, and to IC3 where money was lost. Encourage affected customers to contact their banks.
7. Follow up. If the report is rejected, resubmit with better evidence (more messages, customer complaints, a clearer comparison of the copied elements), or escalate through business or advertiser support.

When to send a letter or sue. Where the operator is known (a former employee, a competitor, a disgruntled customer), a demand letter often ends it. Where the platform has refused and the harm continues, consider:

• Lanham Act false association or infringement, 15 U.S.C. §§ 1125(a) and 1114, with injunctive relief under § 1116. A plaintiff must have a commercial injury proximately caused by the deception, Lexmark International, Inc. v. Static Control Components, Inc., 572 U.S. 118 (2014).
• Right of publicity for a person, for example Cal. Civ. Code § 3344 or N.Y. Civ. Rights Law § 51, where the fake account uses the person's name or likeness to advertise or sell.
• State impersonation statutes, such as Cal. Penal Code § 528.5, which provides a civil action for credible online impersonation of an actual person to harm, intimidate, threaten, or defraud; Tex. Penal Code § 33.07; and N.Y. Penal Law § 190.25. These are criminal statutes, so a police report or a prosecutor may be the route, and California's civil remedy applies only to impersonation of a natural person.
• A Doe lawsuit to identify an anonymous operator, with a subpoena to the platform; see Identifying an Anonymous Defendant Online: A Practical Guide.

Do not sue the platform. Section 230 protects platforms that host impersonating profiles, Carafano v. Metrosplash.com, Inc., 339 F.3d 1119 (9th Cir. 2003); Herrick v. Grindr LLC, 765 F. App'x 586 (2d Cir. 2019).

Pitfalls. Reporting a clearly labeled parody or criticism account as impersonation: platforms usually reject it, and a lawsuit invites an anti-SLAPP motion. Filing a trademark report against a business that has its own rights in the same word. Waiting to warn customers while the report is pending.

Timing and cost. Reports: an hour or two each; outcomes in hours to days for clear cases. Litigation: months.

Step 7: Recover a squatted handle

What to do.

1. Check the account's status. Is it active, dormant, or newly created? Does it use the brand's name or logo, post content, or offer to sell the handle? Capture everything, including any sale offer.
2. File a trademark report if the business has a registered mark and the account is using the handle in a way that is likely to confuse or that violates the platform's policies against squatting or selling usernames. Registration under 15 U.S.C. § 1051 (or in the relevant country) makes these reports far more effective.
3. Request release of an inactive handle where the platform has an inactive-account policy. Expect long waits and no guarantees.
4. Consider a variant. If the handle is held by someone with a legitimate claim (a person with that name, a business elsewhere), choose a variant, secure it everywhere, and move on.
5. Sue only when the handle is being used in commerce. Trademark infringement under 15 U.S.C. § 1114 or unfair competition under § 1125(a) requires use in commerce in connection with goods or services, likely to cause confusion. The ACPA does not apply to handles: its "domain name" definition in 15 U.S.C. § 1127 covers names registered with domain name registration authorities.

Pitfalls. Paying a squatter (it encourages more squatting, and buying usernames violates most platforms' terms). Filing before the business has a registration, or without proof of the business's current use. Forgetting to secure the handle on platforms the business does not use yet.

Prevention. Reserve the brand's handle on every major platform at launch and before any rebrand announcement; see Running a Rebrand: A Practical Legal Guide.

Step 8: Respond to a platform suspension or reassignment

What to do.

1. Read the notice and the cited policy. Identify whether the action was automated, triggered by a report, or the result of a policy decision.
2. Appeal through the platform's process, with a concise explanation, evidence of identity and ownership, and, if a competitor or former employee filed false reports, evidence of that.
3. Escalate through business channels: advertiser support, verified-business support, an account manager, or the platform's partner program.
4. Send a short letter to the platform's legal department where the suspension rests on a false report or an obvious error, attaching evidence and offering identity verification. Keep it factual.
5. For EU users, consider the complaint and out-of-court dispute settlement mechanisms under the EU Digital Services Act.

What does not work. Lawsuits. Courts have held that platforms' decisions to remove content or terminate accounts are protected publisher decisions under Section 230(c)(1): Riggs v. MySpace, Inc., 444 F. App'x 986 (9th Cir. 2011) (deleted profiles); Fyk v. Facebook, Inc., 808 F. App'x 597 (9th Cir. 2020) (pages unpublished and allegedly given to a competitor); Murphy v. Twitter, Inc., 60 Cal. App. 5th 12 (2021) (permanent suspension; contract and promissory estoppel claims barred). Platforms are not state actors bound by the First Amendment. Their terms include broad reservation-of-rights clauses, limitations of liability, forum selection, and in some cases arbitration agreements enforceable under the Federal Arbitration Act, 9 U.S.C. § 2. The narrow exception is a specific promise by the platform to act, which may support a promissory estoppel claim, Barnes v. Yahoo!, Inc., 570 F.3d 1096 (9th Cir. 2009); a generic statement in the terms of service is not enough.

Timing and cost. Days to months. Mostly internal time.

Step 9: Defending against an ownership demand or complaint

Every recovery effort has another side. The former employee, the creator, the agency, and the account accused of impersonation all have rights, and some demands overreach.

9a. The former employee or creator who receives a demand

What to do.

1. Freeze the account in its current state. Do not delete posts, remove followers, change the handle again, or post about the dispute. Deleting content after a demand can look like spoliation, and a court asked to grant an injunction will notice.
2. Read every document you signed: offer letter, employment agreement, handbook acknowledgments, social media policy, invention or work-product assignment, separation agreement. Look for language that names social media accounts specifically. Under JLM Couture, a clause assigning "works" or "designs" may cover posts but not the account itself.
3. Reconstruct the creation facts. When did you open the account, with what email and phone, under what name, and for what purpose? Was it before the job started? Did you use it for personal content? Under the property-first approach, these facts can decide ownership in your favor; under the multi-factor approach, the business's use of the account weighs against you.
4. Separate what is clearly yours. Personal photos, personal accounts opened before the job, and your own name and likeness are generally yours. A business is not entitled to your personal account, and many states bar employers from demanding access to it.
5. Respond in writing, on time. A short response that states your position, proposes a process (for example, a split in which the business takes the account and you keep copies of personal content, or you keep a personal account and the business gets the handle), and preserves your defenses usually works better than silence.
6. Assess the claims against you. A CFAA claim requires access after authorization ended and a qualifying loss; continued use of an account you believe you own, before any revocation, is a weak CFAA case. A trade secret claim requires non-public information and reasonable secrecy measures. Contract and conversion claims depend on the documents and state law.

Pitfalls. Renaming the account to your own name and pivoting it to a competitor is the fact pattern most likely to produce an injunction. Using the employer's logo or name after leaving invites a Lanham Act claim. And responding with insults gives the business a declaration exhibit. Responses to aggressive letters in general are covered in Responding to a Cease and Desist Letter: A Practical Guide.

9b. The agency owed money

Document the invoice, the services delivered, and the contract's terms on ownership and termination. If the contract does not give a right to withhold accounts, transfer admin access to the client and sue on the invoice. Keep copies of creative work the agency owns (where there is no assignment) and state that position in writing. An agency that withholds accounts without a contractual basis risks counterclaims that exceed the invoice.

9c. The account accused of impersonation or infringement

1. Check the label. Parody, fan, and commentary accounts generally must say so clearly in the name and bio. Fix the labeling before appealing.
2. Appeal the platform's decision with an explanation of why the account is not confusing, citing its labeling and content.
3. For DMCA removals, consider a counter-notice under 17 U.S.C. § 512(g), which leads the platform to restore the material in 10 to 14 business days unless the complainant files suit. A counter-notice is a sworn statement under penalty of perjury and consents to jurisdiction, so file one only with a good-faith belief that the removal was a mistake or misidentification. See Responding to a DMCA Takedown with a Counter-Notice: A Practical Checklist.
4. Assess speech defenses if sued. Expressive and critical uses of a brand name are often protected, although after Jack Daniel's Properties, Inc. v. VIP Products LLC, 599 U.S. 140 (2023), the heightened Rogers test does not apply where a mark is used as a source identifier for the defendant's own goods. Many states' anti-SLAPP statutes may apply to state-law claims.

Step 10: Close out and prevent the next one

What to do. Once the account is back:

• Rotate all credentials, remove stale admins, and set up two-factor authentication with company-controlled methods.
• Move every account into a company-owned business portfolio or brand account with at least two administrators.
• Document the incident: timeline, evidence file, costs (useful for a CFAA "loss" calculation or an insurance claim), and lessons learned.
• Adopt or update the social media account policy and the account clauses in employment, contractor, agency, and influencer agreements. Name the accounts. The toolkit has a policy, an agency clause, and a credential handover protocol.
• Add social media accounts to the offboarding checklist. See the Employee Departure Trade Secret Protection Checklist: A Practical Checklist.
• Register the main marks, and claim the brand's handle on every major platform.
• For influencer campaigns, confirm disclosures comply with the FTC's Endorsement Guides, 16 C.F.R. part 255, and do not buy followers or engagement, which the FTC's rule on consumer reviews and testimonials, 16 C.F.R. part 465, prohibits in commercial settings where the buyer knew or should have known they were fake.

Why. Every case in this area involved a business that had not decided, in writing, who owned its accounts and who held the keys. The fix costs an afternoon.

Timeline and cost overview

Costs vary widely with the market, the platform's responsiveness, and whether the other side has a lawyer. Treat these as planning ranges, not quotes.

Worked example: Larkhaven Outdoor Supply

Decision points. Larkhaven's owner, Priya Nandakumar, and outside counsel sort the three problems on Saturday afternoon: a hack (TikTok), an agency lockout (Facebook and Instagram), and an impersonation (the fake support account). Priya owns the hack response, the marketing coordinator, Theo, owns platform reports, and counsel owns the agency. Ownership is not seriously in doubt for any of them: the TikTok account was opened in Larkhaven's name with a company email, and the agency contract, signed in 2022, says the client owns "all social media accounts, pages, and handles created for Client" but says nothing about the admin roles.

Step 1. Theo captures the TikTok profile and the scam videos, the fake support account and three customer messages, and the Facebook and Instagram admin settings showing Brightline as the only admin. He logs URLs, account IDs, and capture times, and saves the platform's notification emails about the password and email changes.

Step 2. Priya's phone carrier confirms a SIM change at 5:12 a.m. She restores the number and adds a port-out PIN. IT changes the password on the company email account, revokes sessions, and finds a forwarding rule the attacker added to send TikTok messages to an outside address. They delete it, enable a hardware key, and check the domain registrar and the payment processor, which are clean.

Step 3. Using the restored email, Priya starts TikTok's hacked-account recovery and submits identity verification. Larkhaven posts a warning on Instagram stories (Theo still has a limited role that lets him post, though not change settings) and on its website: the token is a scam, and Larkhaven never sells cryptocurrency. Priya files an IC3 complaint and a police report. TikTok restores the account on Tuesday and removes the scam videos; Larkhaven's evidence file preserves them.

Step 4. Not needed here. Had a former employee renamed the account, counsel would have sent a demand revoking access and prepared a TRO motion on the contract and conversion claims, with the TikTok registration records as evidence.

Step 5. Counsel reads the Brightline contract: the client owns the accounts, Brightline must return "all Client materials" on termination, and there is no right to withhold for nonpayment. The disputed invoice is $4,200. Counsel sends a letter on Monday that quotes the ownership clause, offers to pay the undisputed $2,700 immediately and to place the $1,500 balance in escrow pending resolution, and demands that Brightline make Larkhaven's business portfolio the owner of the page and Instagram account, add Priya as admin, and deliver all creative files, by Wednesday. In parallel, Theo starts the platform's process for a business to claim its page, using Larkhaven's business documents and trademark registration. Brightline transfers the roles on Wednesday; the parties settle the invoice for $3,600. Larkhaven also asks for, and receives, a written assignment of the copyright in the photos Brightline produced, for which it would otherwise have had only an implied license.

Step 6. On Monday, Theo files impersonation and trademark reports for the fake "Larkhaven Support" account with the customer messages attached. Larkhaven emails its customer list a warning. Priya reports the scheme to the FTC under the Impersonation Rule. Instagram removes the account on Tuesday; two more appear in the following month and are removed within a day each because Theo now has a template report.

Step 7. While the TikTok account was compromised, the attacker changed its handle, and a squatter grabbed @larkhaven. TikTok's restoration returns the original handle to the account, and Theo files a trademark report against a second look-alike, @larkhaven_official, which is idle. It takes three weeks, but the platform releases it.

Step 8. Not needed.

Step 9. Not applicable, though counsel notes that if Brightline had claimed ownership of the photos, Larkhaven would have needed to stop using them or license them.

Step 10. Larkhaven moves every account into its own business portfolios with two admins, adopts an account ownership policy, adds an account clause and credential protocol to every agency and employment agreement, and reserves its handle on two platforms it does not yet use. Total outside legal cost: a few hours of counsel time. The incident report records about 40 hours of internal time, which Larkhaven submits under its cyber policy.

Common mistakes

1. Reporting before capturing. The platform's fix erases the evidence.
2. Recovering the social account while the attacker still controls the email or phone. Recovery is reversed within hours.
3. Paying a hacker or a squatter. Neither reliably delivers, and both encourage repeat attacks.
4. Leading with a CFAA claim against a former employee. Without access after written revocation and a documented loss, it is a weak claim that invites an early motion.
5. Logging into a former employee's personal account. It creates SCA and state-law exposure.
6. Demanding an employee's personal account credentials or using the dispute to silence criticism. It violates state password-privacy laws and risks NLRA liability.
7. Letting the agency own the business portfolio. Admin roles, not passwords, are what the platform recognizes.
8. Suing the platform. Section 230 and the terms of service will almost certainly defeat the claim.
9. Reporting parody as impersonation. It rarely works and can backfire publicly.
10. On the defense side, deleting content or followers after a demand. It looks like spoliation and makes an injunction more likely.

Frequently asked questions

How long does it take to get a hacked account back? Often a few days through the platform's recovery flow, sometimes weeks, and occasionally never. Securing the email and phone first, and using business or advertiser support channels, improves the odds.

Will the police or FBI recover my account? Usually not directly. Law enforcement reports document the crime and help with platforms, banks, and insurers, and they contribute to investigations of larger schemes. Recovery itself runs through the platform.

My former employee says the account is personal. Who wins? It depends on the documents and the creation facts, and on whether the court uses a multi-factor test or the JLM Couture property-first approach. A clause naming social media accounts is the strongest evidence for the business; personal creation details are the strongest for the employee.

Can I get a court order fast? Yes, if the account is being used against the business and the evidence of ownership is strong. A TRO can issue within days under Rule 65; a preliminary injunction typically takes weeks.

Can the agency keep my accounts until I pay? Not unless the contract allows it, and even then the agency risks counterclaims. Offer to pay the undisputed amount or escrow the balance in exchange for immediate transfer.

What if the impersonator is in another country? Platform reports work the same way. Lawsuits are harder: personal jurisdiction, service, and enforcement all become difficult, so the platform and law enforcement channels matter more.

Can I force a platform to give me an inactive handle that matches my trademark? No. Platforms may release inactive handles or act on trademark reports, but they have discretion, and a court cannot easily compel them. Choose a variant if the handle is not released.

I run a parody account and was reported. What should I do? Make sure the name and bio clearly say it is a parody, appeal with an explanation, and, if sued, assess speech defenses and any anti-SLAPP statute that applies.

Key takeaways

• Identify the scenario (hack, insider, agency, impersonation, squatter, suspension) and run parallel tracks with a single owner for each.
• Capture evidence before anyone reports anything, and secure the email and phone before recovering the account.
• Use platforms for speed; use law enforcement for hacks and fraud; use courts for insiders who will not return accounts.
• Send a written demand that revokes access before suing, and lead with contract and property claims.
• Report impersonation under both the impersonation and trademark policies, and warn customers the same day.
• The ACPA does not cover handles; registrations make platform complaints work.
• Do not sue platforms over suspensions.
• If you are accused, preserve the account as it is, read your documents, and respond in writing.
• Fix the paperwork afterward: name the accounts in every agreement, and hold credentials in company systems.

This document is general information, not legal advice for any particular situation; the law changes, and the facts matter.

Related Documents

Related Articles

• Social Media Account and Handle Disputes: Impersonation, Username Squatting, and Who Owns a Company Account: the doctrine and case law behind every step.
• Social Media Law Basics: the wider framework, including Section 230 and influencer rules.
• Section 230 and Platform Liability: What the Statute Actually Says and Where It Stops: why platforms are rarely liable for impersonation or suspensions.
• Authenticating Text Messages, Chats, and Social Media Evidence: Rules 901 and 902, Metadata, and Deepfake Challenges: making the evidence file admissible.
• Preliminary Injunctions and Temporary Restraining Orders: Emergency Relief in Federal Court: the standards for the credential-return motion.
• Ransomware and the Payment Decision: OFAC Sanctions, Reporting Duties, Insurance, and Negotiating With Attackers: why paying an attacker is a legal decision, not just a business one.

Related Guides

• Collecting and Authenticating Messaging and Social Media Evidence: A Practical Guide: capture methods and declarations for Step 1.
• Identifying an Anonymous Defendant Online: A Practical Guide: unmasking an anonymous impersonator.
• Recovering a Hijacked Domain Name: A Practical Guide: when the attacker also took the domain.
• Running a Rebrand: A Practical Legal Guide: securing handles before a name change.
• Responding to a Cease and Desist Letter: A Practical Guide: the recipient's side of a demand.
• Enforcing Trademarks Against Online Sellers and Platforms: A Practical Guide: platform trademark programs in more depth.

Related Checklists

• Social Media Account Ownership and Impersonation Response Checklist: A Practical Checklist: the steps in this guide as check-off tasks.
• Employee Departure Trade Secret Protection Checklist: A Practical Checklist: offboarding that prevents lockouts.
• Responding to a DMCA Takedown with a Counter-Notice: A Practical Checklist: the defender's DMCA route.
• Litigation Hold and Evidence Preservation Checklist: A Practical Checklist: preserving the client's own records.

Related Toolkits

• Social Media Account Toolkit: Ownership Policies, Platform Complaints, and Demand Letters: the demand letter, complaint templates, policy, and handover protocol.
• Online Trademark Enforcement Toolkit: Platform Notices, Test Purchase Records, and Contributory Liability Demands: additional platform notice forms.
• Fraud Response Toolkit: Freeze Requests, Dispute Letters, Reports, and Recovery Steps: helping customers who lost money to an impersonation scam.
• John Doe Litigation Toolkit: Early Discovery Motions, Platform Subpoenas, and Motions to Quash: forms for identifying an anonymous operator.