Social media crisis monitoring: five warning signals

Short answer

A crisis signal on social media differs from an ordinary complaint in five ways: the topic appears in several different sources within a short time, the number of posts is sharply above a normal day, the media or big portals pick it up, the subject involves health, safety, money or the law, and the criticism shifts from one customer's experience to the company's own conduct. When two or more of these appear together, the matter stops being a customer service task and becomes a leadership decision.

Why the difference matters

Two mistakes are equally expensive. The first is treating a crisis as an ordinary complaint: customer service posts a standard reply while the topic is already on news sites, and the template reply fans the flames. The second is treating an ordinary complaint as a crisis: leadership convenes, a public statement is drafted, and a small topic is amplified by the company itself. Writing down the signals in advance prevents both.

Five crisis signals

• Spread: the same topic appears in three or more different sources — a forum, news comments, public posts — within a few hours.
• Volume: mentions in the last 24 hours are several times the daily average of the last four weeks, and the growth comes from negative posts.
• Media interest: a news site, a well-known blogger or a sector portal picks up the topic; a journalist asks the company for comment.
• Gravity of the topic: claims about health, child safety, a data leak, fraud, discrimination or a breach of the law.
• Shift of target: instead of "my order was late", "this company cheats its customers" — the criticism targets the company itself, not a single case.

Not a crisis, but needs attention

Some situations feel alarming but are not crises. A jump in mentions on a campaign day is a success if the posts are positive or neutral. A single, very emotional post that does not move to other sources can be handled with the negative feedback protocol. A crisis at a competitor may touch your sector, but it is not yours — you only watch it. An old incident being reshared may need a short explanation with a link to the earlier reply.

A decision tree

1. 1Is the topic grave?Health, safety, data leak, legal — if yes, pass it to leadership and legal immediately, whatever the volume.
2. 2Does it appear in several sources?If yes, the communications lead assesses it. If no, it stays with customer service as an ordinary negative review.
3. 3Is there media interest?If there is a journalist's request or a news story, public replies use agreed wording only.
4. 4Is volume growing fast?Check again every two to three hours. If growth has stopped, lower the level; if it continues, run the full crisis protocol.

A first-hour protocol

• Gather the facts: what is being said, where, since when, in how many sources; links and screenshots of the original posts.
• Check internally: is the claim true — which customer, which branch, which date.
• Assign owners: who speaks, who approves — one person for communication, one for the facts.
• Prepare a short holding statement: we are aware, we are looking into it, we will update by this time.
• Brief the team: nobody posts public comments in their own name; questions go to one place.

Internal communication

In a crisis, internal communication matters as much as external. Staff should not learn about the topic from social media: send the team a short internal note at the same time as the first statement — what happened, what is known, what is still being checked and what to say when a customer asks. Write a two- or three-sentence ready answer for customer service and sales so that different versions are not heard on calls and in messages. Updates should come from the same channel and the same person.

What not to do

• Mass-delete comments — people keep screenshots, and the deletion becomes a story of its own.
• Blame the customer in public or reveal their personal details.
• Write "this is not true" before the facts are checked.
• Let different staff post different replies.
• Leave scheduled ad posts running — a cheerful ad during a crisis reads badly.

Illustrative example

This is an illustrative example. During an online shop's sale, a customer writes that prices were raised the day before the campaign and then "discounted". In the morning it is one forum post. By midday the same screenshots have moved to two public posts and the comments on a news site, and mentions are four times a normal day. Four of the five signals are present: spread, volume, a money topic and a shift of target to the company. The communications lead has the price history checked, issues a short statement within two hours, and publishes the result of the check in the evening.

After the crisis

A week after the crisis ends, run a short review: when did the first signal appear, when was it seen, when did it reach leadership and when was the first statement issued. The gaps between these four times show where the process slowed down. Then update the risk words and thresholds — covered in detail in reputation alert rules.

Limitations

Monitoring shows only the public part of a crisis: what is said in closed groups and private messages is not visible. A volume chart does not explain the cause; a person has to read the posts. Automatic sentiment analysis can misjudge irony and sarcasm. On legal and health matters a specialist decides; monitoring only supplies information.

Vexvon Monitoring in a crisis

Vexvon Monitoring reads every result by type (complaint, criticism, news and so on), tone, priority and the author's role — customer, media, competitor — so media pieces and urgent complaints can be separated with one filter. For each source it shows whether the search was complete, so "nothing on this site" is never confused with "this site was not fully checked". Results can go to leadership as a PDF report with links and an AI summary. There are no automatic notifications — the team starts the search and a person decides. More on the Vexvon Monitoring page.

Next step

Write the five signals and the decision tree on one page, name the owner of each step, and run a 30-minute drill with the team: take one real topic from last year and answer "what would we do if it happened today?" Other topics are in the brand monitoring section; to test it with your sector's risk words, get in touch.