Most business accounts in Nepal are not “hacked” by clever code. Someone tricks the owner or a staff member into sharing a login code, a password or admin access. Turn on two-factor login, never share a code that arrives by SMS, and make sure more than one trusted person controls each account. That stops most takeovers before they start.
For a hotel, trekking agency, restaurant or online shop, the Facebook page and the WhatsApp number often are the business. Customers book, ask questions and send payments there. Losing them for even a week during the tourist season hurts. This guide gives you a simple setup you can finish in an afternoon.
How do business accounts in Nepal usually get taken over?
Almost always through a trick, not a technical break-in. The Cyber Bureau of Nepal Police has repeatedly warned people not to share OTPs, passwords or personal details, and not to click suspicious links. Those warnings describe exactly how most takeovers happen:
- The “code” call or message. Someone asks you to read back a six-digit code “sent by mistake” or “to verify your page”. That code is the key to your WhatsApp or Facebook account.
- Fake Meta warnings. A message says your page will be “disabled for copyright” and asks you to log in through a link. The link goes to a fake login page.
- A former staff member or agency still has admin access to your page or the email that controls it.
- One reused password that leaked from another site and also opens your email.
Once someone controls your email, they can reset almost everything else. That is why email security comes first.
Which accounts should I protect first?
Start with the account that can reset all the others. For most businesses, the order is:
- The email address used for your Facebook, Google, domain and hosting logins.
- Your personal Facebook profile that is an admin on the business page.
- The business page and its Meta business portfolio (Meta Business Suite).
- WhatsApp or WhatsApp Business on your business number.
- Google Business Profile, Instagram, TikTok and your website admin.
If you have ever wondered who actually owns your domain and hosting, our guide on domains, hosting and website security in Nepal covers that side.
How do I turn on two-factor login?
Two-factor login (2FA) means a password alone is not enough to get in. Use an authenticator app where possible, because SMS codes are exactly what scammers try to talk you out of.
| Account | Where to find it | What to turn on |
|---|---|---|
| Gmail / Google | Google Account → Security | 2-Step Verification, a recovery phone and recovery email |
| Settings → Accounts Center → Password and security | Two-factor authentication, preferably with an authenticator app | |
| Settings → Account → Two-step verification | A six-digit PIN and a recovery email | |
| Accounts Center → Password and security | Two-factor authentication |
Menu names change from time to time, so if you cannot find an item, search for “two-factor” inside the app’s settings.
Save the backup codes each service gives you. Print them and keep them somewhere safe at the office, not in a photo on the same phone.
Who should be admin on my Facebook page?
At least two trusted people, using their own personal accounts, and nobody else with full control. If only one person is admin and that account is lost, the page can be very hard to recover.
- Give full control only to the owner and one trusted partner or manager.
- Give staff and outside helpers limited task access (for example, messages or content only), not full control.
- When someone leaves, remove their access on the same day.
- Every few months, open your page settings and check the list of people with access. Remove anyone you do not recognise.
Never give your own password to a staff member or a freelancer so they can “post for you”. Add them with their own access instead. Then you can remove them cleanly.
What should I do about WhatsApp on a shared business phone?
Lock the phone, set a WhatsApp PIN, and check linked devices regularly. Many shops and hotels keep WhatsApp Business on one front-desk phone that several people use, and that is where problems start.
- Set a screen lock on the phone.
- Turn on two-step verification with a PIN only the owner knows.
- Open Linked devices in WhatsApp every week. If you see a computer or browser you do not recognise, log it out.
- If a “friend” or “regular customer” suddenly asks for an urgent payment to a new QR code, call them on a known number first. Hacked accounts are often used for exactly this. Our article on fake payment screenshots and QR scams shows how these scams look at the counter.
Your one-afternoon checklist
- Change the email password to a long, unique one and turn on 2-Step Verification.
- Add a recovery phone and recovery email you still control.
- Turn on 2FA on your Facebook profile and every admin’s profile.
- Check page access: at least two trusted admins, no ex-staff, no unknown names.
- Set a WhatsApp two-step verification PIN and add a recovery email.
- Log out of unknown linked devices and old sessions.
- Print backup codes and store them safely.
- Tell every staff member: we never share codes, and we never log in through links in messages.
- Write down who to call and what to do if an account is lost (see below).
What if an account is already hacked?
Act within minutes, not days. The sooner you start recovery, the more options you have.
- Secure your email first. Change its password from a different, clean device and log out all other sessions.
- Use the official recovery path of the platform (for Facebook, the “hacked account” help in the Meta Help Centre; for WhatsApp, re-register your number on your phone with the SMS code). Never pay anyone online who promises to “recover” your page.
- Warn your customers from another channel: your website, Google Business Profile post or a staff member’s page. Tell them not to send payments to new numbers or QR codes.
- Report it. You can report cybercrime to the Cyber Bureau of Nepal Police. Keep screenshots of messages, links and times.
- Review afterwards how it happened, and close that gap.
This is also where your own website earns its keep. Social accounts can be locked or lost, but a website you own stays online and tells customers where the real business is.
FAQ
Is SMS two-factor login still worth it? Yes, it is much better than nothing. But an authenticator app is safer, because there is no code to read out to a scammer over the phone.
Will Meta or WhatsApp ever call me and ask for a code? Treat any such call as a scam. As Nepal Police also advise, real banks, wallets and platforms do not ask you to share verification codes.
Can I use one Gmail for everything? You can, if that Gmail is very well protected with 2FA and a recovery method. Many businesses prefer a separate business email so personal accounts and business accounts do not fall together.
Does a verified page protect me from hacking? No. Verification shows who you are; it does not stop someone who has your password and code from logging in.
Want help setting this up properly?
We run businesses ourselves, so we know how much a lost page or WhatsApp number costs in a busy week. We help owners set up safe admin access, business email, backups and monitoring as part of our cloud and operations work. If you want a second pair of eyes on your accounts, contact us and tell us what you use today.