At 4:15 on a Sunday morning, the church’s Facebook page posts a photo of a stack of cash and the words:<\/p>\n\n\n\n
BLESSING GIVEAWAY!! Our church has been blessed and we are blessing 20 families with $5,000 each! Message this page NOW to claim yours. First come first served!<\/em><\/p><\/blockquote>\n\n\n\n
By the time the office administrator sees it at seven, forty-one people have messaged the page. Several are elderly members of the congregation. Two have already been told to send a small “processing fee” to release their blessing.<\/p>\n\n\n\n
Nobody at the church posted it. The page has been posting as the church since 3 a.m., because a volunteer who helps with graphics had her personal Facebook account taken over on Saturday night — and her personal account held the keys to the church’s page.<\/p>\n\n\n\n
There’s a quieter version of the same story, and it’s far more common. The person who created the page eight years ago moved to another state, drifted away, and stopped answering messages. The church cannot post, cannot edit, cannot remove anything, and cannot get it back.<\/p>\n\n\n\n
A page is not an account. It’s a thing that accounts have keys to<\/h2>\n\n\n\n
This is the concept, and once you have it the rest follows:<\/p>\n\n\n\n
A Facebook page has no login of its own. It is controlled entirely by personal Facebook accounts that hold roles on it.<\/strong><\/p>\n\n\n\n
There is no username and password for “First Baptist Church.” There is only Karen’s personal Facebook account, and Karen’s account has been granted control of the page. When Karen posts as the church, she is signed in as herself and switching hats.<\/p>\n\n\n\n
Which means one thing your board should hear plainly: the security of your church’s page is exactly the security of a handful of people’s personal Facebook logins.<\/strong> Whatever password Karen uses for her personal account, whether she reuses it on other sites, whether she has an extra step at sign-in — that is your church’s social media security posture. All of it.<\/p>\n\n\n\n
It’s an uncomfortable realization, and it’s not anyone’s fault. Nobody explained the model when the page was created in an afternoon.<\/p>\n\n\n\n
Full control, and why most helpers shouldn’t have it<\/h2>\n\n\n\n
Meta’s current model separates two very different things, and the distinction is the heart of this article.<\/p>\n\n\n\n
Full control.<\/strong> The account can do everything: post, message, run ads, change settings, add and remove other people, and delete the page. This is ownership in every practical sense.<\/p>\n\n\n\n
Partial or task-based access.<\/strong> The account can do the day-to-day work — create posts, reply to comments and messages, view insights, sometimes handle ads — but cannot change who has access, and cannot delete the page.<\/p>\n\n\n\n
Meta’s own documentation for the current pages experience describes this as Facebook access with full control versus partial control, alongside task-level permissions granted through a business portfolio. The labels get renamed periodically; the two tiers don’t.<\/p>\n\n\n\n
Almost everyone who helps with your page needs the lesser one. The student who posts event graphics does not need the ability to remove the pastor. The volunteer who answers messages does not need the ability to delete eight years of the church’s history at 4 a.m. because someone guessed her password.<\/p>\n\n\n\n
Two rules to write down:<\/p>\n\n\n\n
At least two people must have full control, and never only one.<\/strong> One is how pages get lost. Make it two people who are structurally unlikely to leave at the same time — a staff member and a long-tenured board member, not two members of the same young-adults group.<\/p>\n\n\n\n
Everyone else gets the lesser role.<\/strong> If someone needs more for a specific project, raise them, finish the project, lower them again.<\/p>\n\n\n\n
Make the organization the owner, not a person<\/h2>\n\n\n\n
Meta, Google, and TikTok all offer an organization-level container — a business portfolio or business account — which holds the asset and then grants people access to it. It’s worth setting up even though it adds a layer, because it changes the answer to one question.<\/p>\n\n\n\n
Without it: who owns this page?<\/em> Answer: Karen does, effectively.<\/p>\n\n\n\n
With it: who owns this page?<\/em> Answer: the church’s business portfolio does, and Karen has been granted access to it, which the church’s other administrators can revoke.<\/p>\n\n\n\n
That distinction is the difference between asking a departed volunteer for a favour and simply removing her access on a Monday morning. It doesn’t eliminate the underlying truth — real people still hold admin roles on the portfolio, and those personal accounts still need protecting — but it moves the asset out from under any single person.<\/p>\n\n\n\n
Set it up now, while relations are good. Doing it after someone has drifted away is the hard version.<\/p>\n\n\n\n
Instagram, YouTube and TikTok have the same shape<\/h2>\n\n\n\n
The vocabulary changes; the structure doesn’t.<\/p>\n\n\n\n
Instagram.<\/strong> Usually linked to the Facebook page and managed through the same Meta tooling, which means it inherits the same problem and the same fix. Where it’s managed separately, apply the same rule: at least two people with the top level of access, everyone else lower.<\/p>\n\n\n\n
YouTube.<\/strong> The fix here is channel permissions, which let several named people manage the channel without anyone sharing a Google account password. The roles run from Owner and Manager — who can change permissions — down through Editor, Subtitle Editor, and Viewer, which cannot. Volunteers who upload sermons are Editors, not Owners. If your channel is still on an older Brand Account arrangement, Google now directs you to migrate it to channel permissions.<\/p>\n\n\n\n
TikTok.<\/strong> Managed through TikTok’s Business Center, where members are Admin or Standard and assets are assigned individually. Admins have full access; Standard members work only on what they’ve been given.<\/p>\n\n\n\n
In every case, the same two questions answer it: who has the level that can remove other people, and is that more than one person?<\/p>\n\n\n\n
The hygiene that actually prevents this<\/h2>\n\n\n\n
Three habits, and the first one is most of the value.<\/p>\n\n\n\n
Multi-factor authentication on every personal account that holds a role.<\/strong> Multi-factor authentication<\/strong> — MFA, or two-factor authentication — is the extra step after the password: a code, a prompt, a tap on a phone. It’s the reason a stolen or guessed password isn’t enough on its own. Microsoft’s research on account compromise puts MFA at blocking more than 99.2% of attacks, and while that figure comes from their platform, the mechanism is identical everywhere.<\/p>\n\n\n\n
Make this a condition of the role. Not a suggestion — a condition. If you hold access to the church’s page, your personal account has two-factor turned on.<\/em> Nobody has ever been offended by that request once they understood why.<\/p>\n\n\n\n
Review the role list twice a year.<\/strong> Open the list of everyone with access and read it out loud. You will find someone who left in 2022. You will possibly find a marketing agency you hired for one campaign. Pair the review with something already in the calendar so it happens.<\/p>\n\n\n\n
Remove people who have drifted away, promptly and warmly.<\/strong> This is a courtesy, not an accusation. Say it that way: we’re tidying up access; you’re not doing the graphics anymore so I’m removing you from the page — thank you again for all of it.<\/em> A volunteer who has moved on does not want to be one password breach away from being the reason your church’s page posted a scam.<\/p>\n\n\n\n
When it goes wrong<\/h2>\n\n\n\n
Recovery is slow, and often it doesn’t work.<\/strong> This is the honest part, and it’s the whole argument for the twenty minutes of prevention.<\/p>\n\n\n\n
If the only person with full control has died, moved away, or become unreachable, you are dependent on a platform support process with no phone number and no guaranteed outcome. If the account was hijacked, you’re in a queue behind an enormous volume of similar reports. Churches routinely spend months on this and end up abandoning the page and starting over — losing years of history and the audience they’d built.<\/p>\n\n\n\n
If you’re in it now: report the page as compromised through the platform’s own reporting flow, have the affected person start their personal account recovery immediately, and gather documentation showing the church’s connection to the page — the website that links to it, prior posts, anything establishing the relationship. Then, in parallel, start a new page and tell people. Waiting on recovery while your congregation has nowhere official to look is the worse of the two mistakes.<\/p>\n\n\n\n
When your page is used against your congregation.<\/strong> A hijacked church page is valuable to a scammer specifically because it carries your trust. The recurring patterns are the giveaway or “blessing” post that leads to a fee, a fake emergency appeal for a named family, a bogus link to “the new giving page,” and a cloned page — a fresh copy using your logo and photos — that messages your followers one by one.<\/p>\n\n\n\n
If it happens, do three things fast. Post from any channel you still control — website, email list, a second page, Sunday morning announcements — saying plainly what happened and what the church will never do. Report the impersonating page or post to the platform. And warn people in the specific words that work: we will never message you asking for money, gift cards, or a fee to receive anything.<\/em><\/p>\n\n\n\n
Consider printing that sentence in the bulletin regardless, before anything happens. Older members are targeted heavily — the FBI logged 201,266 complaints from victims aged 60 and over in 2025, totalling $7.748 billion. A congregation that has read that sentence in a normal week is much harder to fool in an abnormal one.<\/p>\n\n\n\n
What to do this week<\/h2>\n\n\n\n
Open your church’s Facebook page settings and look at who has access. Confirm two things: that at least two people you can reach today have full control, and that everyone else is on the lesser level. Fix whatever isn’t true. That’s fifteen minutes.<\/p>\n\n\n\n
Then send one message to everyone on that list asking them to turn on two-factor authentication on their personal account, and say why: because our page’s security is your account’s security.<\/em><\/p>\n\n\n\n
MissionDefend’s free assessment goes through the accounts, email, donation tools, and member data your organization depends on, in plain English, and gives you a baseline score plus a ranked list of what to fix first — social media access included, because it’s one of the most commonly missed.<\/p>\n\n\n\n