My Facebook ad account was hacked. What do I do?

If your Facebook ad account has been hacked, stop the money before anything else: call your card issuer’s fraud line and block the card on the account, then pause or cap whatever you can still reach in Ads Manager. Next, secure your own Facebook login, remove anyone you don’t recognise from your business portfolio, and report it to Meta. That order matters because owners on r/FacebookAds describe thousands of dollars spent within hours, and Meta won’t let you remove a payment method while ads are still running.

The rest of this page takes each of those steps in turn, with the menu paths Meta lists, and then covers the questions owners ask once the panic settles: will Meta refund the spend, how do I get my Page back if I was removed as admin, and how do I stop it happening again. As you type “facebook ad account hacked” into Google, it suggests “…and disabled”, “facebook business manager hacked admin removed” and “someone is running ads on my facebook account”, so those are the cases covered here. It is written for owners of trade and local service businesses who run their own ads or had someone set them up.

What should I do first if my Facebook ad account is hacked?

Work through these in order, and screenshot each screen before you change it, because Meta support and your bank will both ask for evidence.

1. Call your bank or card issuer and block the card. This is the only step that stops spend even if you are locked out. Meta only lets you remove a payment method when your ads are paused and any balance is paid, and it says to allow up to 48 hours after pausing for late ad events (remove a payment method). Ask the card issuer about its fraud dispute process while you are on the phone.
2. If you can still open Ads Manager, pause every campaign you didn’t create. Then set an account spending limit only a little above what the account has already spent. Go to Ads Manager, click Payment settings, scroll to Account spending limit, click Options, then Change. Meta says the new limit applies in about 15 minutes, and ads pause once the limit is reached (change your ad account spending limit).
3. Record the charges. In Billing and payments, open Payment activity and click each Transaction ID you don’t recognise. The receipt shows the amount, the date, the card charged and which ads the money went on (troubleshoot unrecognised activity). Save those receipts.
4. Secure your personal Facebook account. Most ad account hacks start with someone’s personal login. Visit facebook.com/hacked on a device you have used to log in before (recover a hacked account), change your password, log out of sessions you don’t recognise and turn on two-factor authentication with an authenticator app.
5. Remove people you don’t recognise. In Meta Business Suite, go to Settings, click People, click the person’s name, then Remove. You need full control of the business portfolio to do this; if you can’t see People, you don’t have it (remove people from your business portfolio).
6. Report it to Meta. Meta says to contact Meta Support immediately if you think your business portfolio is compromised (recover a hacked or compromised business portfolio). Start from Business Support Home. If you lost a Facebook Page, use the Page recovery form covered further down.

Steps 1 and 4 can happen at the same time if two people are on it. The bank call is the one people skip, usually because they assume deleting the card in Ads Manager will be quicker. It rarely is when ads are live.

How do I know if my ad account was actually hacked?

The clearest signs are campaigns you didn’t create and people you don’t know in your business settings. Meta also lists new or reactivated ad accounts, sudden jumps in spend or invoices, and posts that don’t look like your business (common signs of a compromised business account). Some things that look like a hack turn out to be billing, so match what you see to the right fix.

The last two rows come from Meta’s own page on unrecognised activity, which says you can be charged several times a month, even after ads stop, and that Meta may remove admins, pause ads or change payment methods when it sees suspicious activity (troubleshoot unrecognised activity). For the card fraud row, each Meta ad transaction has a 10-character reference number that appears on your statement after “FACEBK*” or “FACEBOOK INC.”, so you can check whether a charge belongs to your account (find your Meta ad charges on your card statement).

Will Meta refund ad spend I didn’t authorise?

Meta doesn’t publish a guaranteed refund for spend run by a hacker. Its help page asks you to contact Meta if you believe your ad account was hacked, so the claim goes through Meta support with your evidence, and separately through your card issuer’s fraud process (troubleshoot unrecognised activity).

What makes a claim easier to assess is a tidy record. Keep the Transaction IDs and receipts for every charge you dispute, screenshots of the unknown campaigns and the people list, the time you first noticed, and the case or ticket numbers from both Meta and your bank. Write down which charges were yours before the hack started, so nobody has to guess where the line falls.

One charge that worries people but isn’t spend: Meta says a recent small charge on your card is likely a temporary authorisation to check the card, which is voided straight away and should leave your statement within 3 to 5 working days (Meta ad charges on your card statement).

The hacker removed me as admin. How do I get my business back?

For a Facebook Page, submit the Facebook Page recovery form while logged in to your own account; Meta says it is the fastest way to recover a Page and that it aims to reply within a day, although some reviews take longer (recover a hacked Facebook Page). For the business portfolio and ad accounts, contact Meta Support through Business Support Home.

A few things trip owners up here, all from Meta’s Page recovery article:

• You can only submit the form if you are logged in and have recently lost access. If you can’t log in at all, start at facebook.com/hacked on a device you have used before.
• If the form won’t let you pick your Page, Meta doesn’t see that you recently lost access to it.
• If a staff member or your web person was the admin who got hacked, they need to log in and submit the form themselves.
• Once you are back in, go through the Page and the business portfolio and undo any changes you don’t recognise.

This is where having a second person with full control pays off. Meta recommends two active people with full control of a business portfolio, so that someone else still has top-level access if one account shows suspicious activity (best practices for business portfolio security). If your office manager or a trusted partner still has full control, they can remove the intruder in minutes while you wait on Meta.

Should I just open a new ad account?

Not until you have secured the login that was hacked. If the weak point was your personal Facebook account, a reused password or a device with malware, a new ad account sits behind the same door. Owners on r/FacebookAds also report accounts being disabled after a hack, and starting fresh around a restriction carries its own risks, which our guide to a Facebook ad account restricted covers in detail. Get access back and request a review first.

How do hackers get into small business ad accounts?

Meta names phishing, credential theft and password attacks as the common methods, and says compromises usually happen when an individual’s account is hacked or accessed through malware or a phishing scam (compromised business portfolio). So the way in is usually a person’s login, and these are the gaps that let it happen.

• Fake warning messages. A message claiming your Page or ad account will be disabled, with a link to “appeal”. Our post on why a Facebook ad was rejected explains what real review notices look like, and they don’t arrive as DMs asking you to log in through a link.
• Old access nobody removed. Meta says bad actors target inactive users and ad accounts that haven’t run ads in the last year (business portfolio security). A former employee or an agency you left two years ago is exactly that.
• No two-factor authentication. Meta treats users without passkeys or two-factor authentication as a security risk and suggests removing them until they set it up.
• Malware on a shared computer. The office PC everyone logs in from is a common weak spot, and Meta suggests scanning and cleaning the devices of everyone with access.

How do I stop it happening again?

Lock down who can get in and cap what anyone can spend. This checklist follows Meta’s security recommendations, most of which you can see in one place under Security Centre in your business portfolio settings (best practices for business portfolio security).

• Every person in the business portfolio uses two-factor authentication or a passkey. Use an authenticator app, back it up and save your recovery codes, so a lost phone doesn’t lock you out.
• Remove anyone who hasn’t logged in for 90 days, especially people with full control.
• Keep two trusted people with full control, and no more than you need. Meta’s own ceiling is ideally ten or fewer, which for a small business is far too many.
• Review users with email addresses that aren’t tied to your business. Meta recommends removing them. If your own team works from personal Gmail addresses, at least make sure every one of those addresses belongs to someone you can name.
• Close ad accounts you no longer use. Meta notes that ad accounts can’t be deleted from a portfolio, only closed or removed.
• Set an account spending limit as a ceiling, so even a successful hack can only spend so much before ads pause.
• Turn on peer approval. In Meta Business Suite, go to Settings, Security Centre, Peer approval, and click Manage next to Ad account security. Ads that meet the conditions you set then need a trusted user’s approval before they publish (add another review with peer approval). One limit to know: ads published by someone with full control skip the second review, which is another reason to keep full control to two people.
• When an agency or freelancer stops working with you, remove them from the portfolio the same day.

Common mistakes after a hack, and what to do instead

• Trying to delete the card in Ads Manager first. It won’t come off while ads run or a balance is owed. Call the bank first, then tidy up in Ads Manager.
• Changing everything before taking screenshots. Once you have removed the hacker’s campaigns and users, your evidence is harder to show. Screenshot, then change.
• Paying a stranger who promises a “Meta contact”. People post in r/facebook offering to pay for a real Facebook Business Support contact. Anyone who replies offering one for a fee is not Meta. Use only the recovery routes linked from facebook.com and the Business Help Center.
• Only fixing your own login. If another admin’s account was the way in, the hacker can come straight back. Check everyone with access.

If a hack has left your ads in a mess, with campaigns you don’t trust, access you aren’t sure about and a budget you can’t account for, our Meta Ads management team can audit who has access, set up the security settings above and rebuild campaigns that bring in calls and booked jobs. We manage your first two months free; you fund your own ad budget.

FAQ

Why is there a FACEBK charge on my bank statement?

Meta ad charges appear as “FACEBK*” or “FACEBOOK INC.” followed by a 10-character reference number. Match that number with Payment activity in your Billing and payments. If it isn’t there and you have no other ad account, treat it as card fraud and call your card issuer.

How long does Meta take to answer a Page recovery request?

Meta says it aims to reply within a day and updates you by email, but some reviews take longer. It can only act if it can confirm the Page was compromised, so describe what changed and when.

Can my ads be hit if someone else on my account is hacked?

Yes. Meta says a Page can be taken over when you or another admin is hacked or scammed. That is why every person with access, including staff and outside help, needs two-factor authentication.

Will turning on two-factor authentication lock me out?

Not if you set up more than one method. Meta suggests an authenticator app that you back up, saved recovery codes, and keeping your phone number current in your Facebook settings.

Sources: 1. Troubleshoot unrecognised activity on your ad account (Meta Business Help Center). 2. Recover a hacked or compromised business portfolio (Meta Business Help Center). 3. Best practices for making a business portfolio more secure (Meta Business Help Center). 4. Remove a payment method from your Meta ad account (Meta Business Help Center). 5. Change your ad account spending limit (Meta Business Help Center). 6. Remove people from your business portfolio (Meta Business Help Center). 7. Find your Meta ad charges on your credit card statement (Meta Business Help Center). 8. Add another review of your ads with peer approval (Meta Business Help Center). 9. Recover a hacked Facebook Page that you manage (Facebook Help Center). 10. Recover a hacked account (Facebook Help Center).