Facebook Ad Account Hacked? 7 Steps to Recover It

An ad account is reached through the Facebook logins that have access to it, so a hack usually starts there. Someone gets into your login or another admin’s, adds themselves, runs their own ads on your card and sometimes removes you. Recovery runs in the same order: get the login back, cut off the people who shouldn’t be there, stop the spend, tell Meta, then close the gap they came through.

How do I know my ad account was hacked?

Meta lists the signs on its If your account was hacked or someone is using it without your permission and What to do if you’ve been phished on Facebook pages. The table adds where to look for each one.

The last row is easy to misread. Meta says that when it sees suspicious activity it may take action to recover an ad account, including removing admins, pausing your ads and changing your payment methods (Troubleshoot unrecognized activity on your ad account).

Is a hacked account the same as a disabled one?

No, and the fixes differ. A hack is a security problem: someone has access who shouldn’t. A disabled or restricted account is an enforcement decision, which you answer in Business Support Home. The two often arrive together, because Meta says it may restrict advertising when it suspects a business portfolio or its assets have been compromised (About advertising restrictions). Secure the account with the steps below first. If a restriction is still in place afterwards, follow what should I do first when Meta disables my ad account?

What are the 7 steps to recover a hacked ad account?

Work through them in order. Each later step needs access that the earlier ones restore.

1. Get your Facebook login back

1. Go to facebook.com/hacked on a device you have used to log in to Facebook before, as Meta recommends (Recover a hacked account).
2. Go to facebook.com/login/identify if you no longer control the account’s email or phone, find your account, select No longer have access to these? and follow the prompts (Recover your account if you can’t access your email or phone).
3. Use the link Meta sends to your previous address to reverse an email change (If your account was hacked).
4. Ask any other admin who may have been hacked to do the same on their own device.

2. Recover a Page you were removed from

If a hacker removed you from your Facebook Page, use Meta’s Page recovery form (Recover a hacked Facebook Page that you manage). Meta aims to reply within a day, and acts only if it can confirm the Page was compromised. You must be logged in and have recently lost access to submit it.

3. Remove people you don’t recognise

1. Open Settings in Meta Business Suite, select People, click the person’s name, then Remove. This needs full control of the business portfolio (Remove people from your business portfolio).
2. Open Ad account settings in Meta Ads Manager, find Ad account roles and select Remove user beside anyone unknown (Manage permissions on your ad account).
3. Review partners in your business portfolio as well, since partner access is removed separately.

If nobody left in the portfolio has full control, Meta has a request process for full control that asks for ID, proof that you own the business and a signed attestation letter.

4. Turn off ads you didn’t create

1. Select the Campaigns, Ad sets or Ads tab in Meta Ads Manager.
2. Click the toggle next to anything you didn’t create. Meta says turning ads off can take a few minutes to stop delivery (How to turn an ad on or off).
3. Turn them off rather than deleting them, so the evidence stays in the account while Meta reviews it.

5. Check charges and protect your card

1. Open Billing & payments, click Payment activity and select each Transaction ID you don’t recognise. The receipt shows which ads the money paid for (Troubleshoot unrecognized activity on your ad account).
2. Remove any card the attacker added. In Billing & payments, open Payment settings or Payment methods, click Options beside it and select Remove (Remove a payment method).
3. Pause ads first, wait up to 48 hours for late ad events, then clear the balance with Pay now. Meta only removes a card when nothing is owed. To trace each charge, see why was I charged for Facebook ads I didn’t run?

6. Report it to Meta

1. Use the “let us know” link at the end of Meta’s unrecognized activity page, which is there for people who believe their ad account was hacked.
2. Open a support case through Business Support Home, as Meta advises for compromised business accounts (What to do if you’ve been phished on Facebook).
3. Open Business Support Home if an account shows as restricted, select it under Account Overview and follow What you can do (Troubleshoot a disabled or restricted account).

Meta may ask you to confirm your identity, complete verification, secure your account or request a review.

7. Close the way they got in

1. Require two-factor authentication: in Business Suite Settings, select Business portfolio info, find Two-factor authentication under Business options and choose Everyone (Require two-factor authentication).
2. Open Security Center in Settings and act on each alert (About Security Center).
3. Remove people who haven’t logged in for 90 days, people without passkeys or two-factor authentication, and people on public email domains, as Meta recommends.
4. Keep full control to the people who need it. Meta suggests 10 or fewer, with at least 2 active.
5. Turn on peer approval, so a trusted person must review ads before they publish.
6. Download your business history from People or Business info in Settings and look for changes you didn’t make.

Points 3 to 6 come from Meta’s best practices for a more secure business portfolio.

Is two-factor authentication required for advertising?

For many accounts, yes. Meta says advertisers may have to complete two-factor authentication to publish ads, including some who target certain regions, and that it automatically requires it for some business portfolios more than 90 days old (About two-factor authentication for your business portfolio). Where it is not turned on, Meta may restrict people’s access to advertising or remove a payment method. Meta also suggests an authenticator app, saved recovery codes and more than one method, so you can’t lock yourself out.

What access should agencies and tools keep afterwards?

Re-add only what each person or tool needs, at the lowest level that does the job. A tool that only reads reports doesn’t need full control, and an agency that runs ads doesn’t need to manage your people. Should I give a Meta ads tool admin or advertiser access? walks through each level. The Facebook ad policy hub covers the restriction and review side if Meta acted on the account while it was compromised.

FAQ

How long does it take to recover a hacked Facebook ad account?

It depends on the route. Meta aims to answer the Page recovery form within a day, though some reviews take longer, and it says a review of a restricted advertising account typically takes 48 hours. To recover your own login, Meta asks you to start at facebook.com/hacked on a device you’ve used to log in before.

Will Meta refund ads a hacker ran on my card?

Meta’s help pages do not promise a refund. They tell you to report a suspected hack through the unrecognized activity page and to contact support from Business Support Home. Record the Transaction IDs and dates from Payment activity before you report, so Meta can see exactly which charges you dispute.

Can I just create a new ad account instead?

Secure the existing one first. A new ad account reached through the same compromised login is just as exposed. Meta lists creating new ad accounts to repeat violations after an account was disabled as evading enforcement (Common examples of advertising policy violations), so if the old account was restricted, use the review route.

What if I can’t log in and don’t have my email or phone?

Go to facebook.com/login/identify on a device you’ve used before, find your account by email, phone, name or username, and select No longer have access to these? Meta asks for new contact details that were never used on the account, then runs security checks before you reset your password.

Sources

Sources: Meta Business Help Center, What to do if you’ve been phished on Facebook, Troubleshoot unrecognized activity on your ad account, About advertising restrictions, Troubleshoot a disabled or restricted account, Remove people from your business portfolio, Manage permissions on your ad account, Submit a request to get full control of a business portfolio, How to turn an ad on or off, Remove a payment method, Best practices for making a business portfolio more secure, Require two-factor authentication, About two-factor authentication for your business portfolio, About Security Center, Request a review for a restricted advertising account; Facebook Help Center, Recover a hacked account, Recover a hacked Facebook Page that you manage, Recover your account if you can’t access your email or phone; Meta Help Center, If your account was hacked or someone is using it without your permission (checked 2 Oct 2026).