If your Facebook ad account is hacked, remove your payment method or freeze the card immediately, stop every ad you didn’t create, delete them after taking evidence, remove any unknown users, and turn on two-factor authorization. Screenshot the fraudulent charges and ads to claim your refund. Report the hack through Meta’s official channel.
However, the process requires a step-by-step guide to understand what to do instantly and how to recover the account, prevent it in the future, and get your money back. This guide will walk you through every step.
Emergency: The First 10 Minutes, Explained
Once you know your ad account is compromised, follow these steps within the next 10 minutes.
Step 1: Kill the funding first
Go to Ads Manager > Billing & Payments > Payment Settings. Remove every payment method to stop spending. If you cannot remove the card due to the restriction, call your bank and ask them to freeze the card. Sometimes, hackers raise the spending limit to increase money flow. Stop that from the account spending limit.
Step 2: Pause the unauthorized campaigns
Go to Ads Manager and pause all the campaigns. Don’t delete them instantly since you will need them as evidence. Check the automated rules so that these cannot be turned back on the paused campaigns.
Step 3: Remove any unknown users
Go to Business Settings > People and remove any users, system, or partner you didn’t add. If you fail to remove them, chances are high that the hacker has escalated their own permission over yours. We have a section below to recover from that.
Step 4: Lock your login
Go to Settings & Privacy > Settings > Security and Login, and then change your password. Review your active sessions under ‘Where You’re Logged In’ and select Log out of all sessions. It will kick out all the users on any device. Turn on 2FA using an authenticator app instead of SMS.
Step 5: Document the damage
Screenshot everything such as the unauthorized campaigns and their spending, billing history, unfamiliar users, and activity log.
Confirm It: Are You Actually Hacked?
People often confuse a high charge and a hack. Spend two minutes before you stop everything and contact Meta support.
It’s a hack if you find:
- New admins or users.
- Campaigns you did not create.
- Change your email, password, or phone number.
- Log-in notification from an unknown device or location.
- Spending threshold raised.
It might NOT be a hack if you find:
- An old campaign reactivated through an auto-rule.
- Your partner or teammate launched something without informing you.
- A payment card is still connected to an old account.
- Billing glitch from Meta.
How to Find the Entry Point
To find out exactly what happened, visit Ads Manager > Account Activity/change history to see every change and timestamps. Cross-check it with Security and Login > Where You’re Logged In. Most of the time, the entry point is your team member’s personal FB account.
Recovery Playbooks: How to Recover the hacked ad account
Hacked looks different to different people, and finding the exact scenario is important to fix the problem.
If you still have access to your account.
This is the best-case scenario that works in your favor. It means you can get everything back.
- Follow the steps we mentioned above for the first 10 minutes. That means remove payment, unauthorized access, and suspicious app or partner access.
- Find which team member’s account is compromised. Secure their account by changing the password, enabling 2FA, and removing all the devices.
You’re locked out – email and phone were changed.
This is the main challenge of getting hacked. You cannot log in to the account and try ‘Forgot password,’ but the reset code goes to the hacker’s email and phone number. Here are the steps to follow.
- Go to facebook.com/hacked > “My login info was changed.”
- If that does not work, visit facebook.com/login/identify and follow the prompts. Prove your account with your old email, phone number, and name.
- Meta may ask to verify your account with a government-issued ID. Prepare that with a clear photo.
- Use a network and device you have used before to log into your account since recovery is easy with a recognized device.
Remember that recovery is genuinely difficult here when the hacker has changed the email and phone number.
Your account was disabled or banned for the hacker’s ads
This is the most tragic scenario for an ad account owner. Your account is hacked, and the hacker runs a policy-violating ad, leading to a ban.
To fight it:
- Request a review through Business Support Home Visit business.facebook.com/business-support-home and request a review. Only admins can request the review within the 180-day time frame.
- State clearly, ‘My account was compromised, and the ad that triggered the restriction was created by an unauthorized body, not by me.
- Attach the proof in the appeal.
- Appeal again with more proof and details if this fails.
Meta might fix the problem since it has policies for compromised accounts.
The hacker made themselves admin and demoted you.
If you can log in to your account but cannot pause the ads or remove the hacker, chances are high that the hacker stripped the permission. If you have a second admin, loop them in to remove the bad actor. If you are the only admin, file an admin dispute with Meta with proof.
How to beat the Meta Support Black Hole
You need to know that Meta does not offer real humans most of the time for small or medium advertisers. It offers such services for businesses with more than $200,000 spending per month. So it is better to keep realistic expectations.
The reporting path that works
- Visit business.facebook.com/business-support-home or click the Help icon in Business Manager.
- Choose Create New Case > “It’s something else” > “Other Issues.”
- Choose the affected ad account > “Other ad account issue.”
- Use chat if online. Use email or message if chat is not available.
- Keep your Business Manager ID and Ad Account ID, screenshots of proof, dates, and your government-issued ID.
A copy-paste message/email that works
“Hi. Someone compromised my Facebook ad account. They got access to my Business Manager and added themselves as an admin. They ran some policy-violating ads using my payment method, and I had no control over that. I have secured my account, removed the users, and frozen the payment method. My Business Manager ID is [ID], ad account ID is [ID], and proofs are attached in the screenshot. Please investigate and remove any unauthorized access and reinstate my account. Process a refund for the fraudulent charge. Thank you.’
Getting Your Money Back: An Honest Guide
You might get the money back, but remember that it is not guaranteed. Follow these methods below.
When Meta will refund
- Confirmed account hack and fraudulent charges.
- Clear billing errors like charges for disapproved ads or duplicate charges.
- Balance cut even after deactivating your account.
When Meta will NOT refund.
- When you cannot prove fraudulent charges or account hack.
- Poorly performed ads.
How to get the refund path
Open your support case and provide all proof for fraud and unauthorized charges with screenshots, dates, and amounts. Meta will review everything, verify the claim, and refund you if everything goes well. Remember that Meta may issue an ad credit rather than cash back. You can politely push for a cash back.
What if you don’t get your account back or refund?
You can apply again with more proof. However, chances are low that you can recover the account if you fail the first time. In such a case, getting multiple aged ad accounts will help you continue the campaign and business promotion. Some good providers offer verified and aged ad accounts. TheSmmExpert is one of those good providers with quality service. So in case you fail to recover the account, do not give up and start fresh with an aged account.
Fake “Recovery Services” and Support Numbers
Remember that when you are desperately searching for help, you are a target of a fake support system and scam. There is no Meta phone number that you can call to recover the account. Besides, there are no Instagram, Telegram, or forums that offer official service to recover your ad account.
How to prevent your account from being hacked in the future?
Recovery is tough, and the pain you need to go through is exhausting. Follow these steps below so you don’t have to face it again.
For business owners and solo advertisers
-
- Use 2FA for your profile with an authenticator app instead of SMS.
- Turn on Facebook Protect if you are prompted to create an additional security layer.
- Set a low spending limit to reduce the damage cap.
- Use a dedicated card for ad spend. Do not use your main business checking account.
- Use a strong and unique password.
- Never click login or verify account links in SMS or emails.
- Store your Ad account ID and Business Manager ID offline to apply in the future.
For agencies and teams
-
- Keep multiple trusted admins to create a backup when one admin account is compromised.
- Add partners by your Business ID, not as individuals.
- Check the access quarterly and remove any former contractors, ex-employees, and ex-partners.
- Ensure 2FA and Facebook Protect for the entire team.
- Train your employees about phishing.
Frequently Asked Questions
How long does Meta take to respond to a hacked ad account?
You will be heard within 24-72 hours if everything goes smoothly. However, for small and medium accounts, you may need to wait several days or weeks.
Can I recover my account if the hacker changed my email and phone number?
You can recover the account through Facebook help if the hacker changed your email address and phone number. But chances are very low, and you need to have a realistic expectation.
Will Facebook refund unauthorized ad charges?
Yes, Facebook will refund the unauthorized ad charges if you provide solid evidence. However, sometimes, Meta offers an ad credit instead of cash.
My account was disabled after being hacked. Can I still get it back?
Yes, you can still get it back even if the account is disabled after being hacked. Request a review through the support system within 180 days. Provide as many proofs as possible to increase the chances.
How do I know who hacked my ad account?
You cannot find exactly who hacked your ad account. But you can see the location and device, which is not enough to identify the hacker.
Should I dispute the charge with my bank?
You can do that only if the ad account is not important to you, as it will disable it permanently.
How much can a hacker actually spend?
A hacker can spend a lot and fast, from a few hundred to a few thousand within a few hours. They will raise the spending limit and run high-budget campaigns.
