You’ve just discovered your Facebook ad account has been hacked? It feels like a disaster, especially when your whole business runs on your campaigns. Take a breath: it’s a genuine nightmare, but there are concrete ways to get back into your Facebook Ads account and lock your operation down again. In this guide we’ll walk you through recovering a hacked ad account step by step, and how to stop it from happening twice.
Spotting the signs of a hacked Facebook Ads account
Before you panic, make sure your ad account really has been compromised. Some signs leave no doubt and should put you on alert right away.
The most obvious ones: ads you never created, abnormal spending, or changes to your payment settings. You might also get notifications about suspicious activity on your account, or find you can no longer get into your Business Manager.
Other red flags include changes to your business information, unknown admins added to your pages or ad accounts, and automated messages going out from your pages without your say-so. If you notice any of that, it’s time to move fast.
Sometimes attackers are subtler and simply edit your existing campaigns to redirect the traffic to their own sites. That’s why checking your stats and your account activity regularly matters so much.
The first moves, right now
The moment you suspect your Facebook Ads account has been hacked, every minute counts. First job: secure your personal Facebook account, because that’s usually the door attackers come through to reach your ad accounts.
Change your Facebook password immediately, from a device you trust. Use a complex, unique password you’ve never used anywhere else. Then check the active sessions in your security settings and log out every device you don’t recognize.
Turn on two-factor authentication right away if it isn’t on already. That extra layer makes an attacker’s life considerably harder. Prefer an authenticator app over SMS codes, which can be intercepted.
Next, check the payment methods attached to the ad account. If you spot unauthorized transactions, call your bank immediately to block the card and report the fraud. And remove your credit cards from the account temporarily while you sort the problem out.
Using Meta’s official recovery tools
Meta offers several tools built specifically to help people recover hacked accounts. Your first stop is the help page dedicated to compromised accounts.
Start with the account recovery tool at facebook.com/hacked. It walks you through the steps to secure your account and report the suspicious activity. Do this from a device you trust.
For ad accounts specifically, open your Business Manager and go to the account quality tool. That section shows the status of each of your ad accounts and lets you request a review. If your account was disabled as a result of the hack, this is where you appeal.
Don’t hesitate to use the contact form for security issues. Be precise in describing the problem and give every relevant detail: roughly when the hack happened, what suspicious activity you saw, and anything else that helps Meta’s teams understand the situation.
Building a solid case
Recovering a hacked ad account usually means proving who you are and that the account is yours. The more complete and professional your file, the faster you get access back.
Gather your identity documents: ID card, passport, driver’s license. For business accounts, add your official paperwork — certificate of incorporation, articles of association, or anything else proving you’re the legal representative of the company.
Keep screenshots of every piece of suspicious activity you observed. That visual evidence can be decisive in showing the account really was compromised. Include the history of your legitimate campaigns too, to show how you normally use the account.
If you have invoices or receipts from past ad spend, add them to the file. They prove a history of legitimate use and can speed the verification up.
Getting through to Meta support
Meta support can feel impossible to reach, but there are ways to improve your odds of a fast, useful answer. It comes down to how you present the problem.
Write clearly and professionally. Keep the emotion out of it, however maddening the situation is. Open with a short summary of the problem, then lay the events out in order. Use precise, technical language where it’s appropriate.
Be patient but persistent. Support teams handle an enormous number of requests every day. If you’ve had no answer within 48 hours, follow up politely. Sometimes rephrasing the problem is enough to get things moving.
Use every channel available: contact forms, support chat when you can get it, even Meta Business’s official social accounts. Each channel has its own response time, and working several at once can speed things up.
Securing your account once you’re back in
Getting back into your ad account isn’t the end of the job. You need serious security in place so a second break-in doesn’t happen.
Change every password immediately: personal Facebook account, Business Manager, and every connected service. Use a password manager to generate unique, complex passwords for each one. It feels like a chore, but it’s essential.
Go through every access and permission in your Business Manager. Remove anyone you don’t recognize and check the role assigned to each person. Make sure only people you trust hold admin rights on your ad accounts.
Turn on every security notification available. Set your account to alert you when someone logs in from a new device, when payment settings change, or when new campaigns are created. Those alerts let you react fast if anyone tries again.
Preventing the next hack: good habits
The best defense against hacking is still prevention. A few simple habits will cut the odds of your accounts being compromised again.
Build a routine of regular checks. At least once a week, look at your ad account activity, review recent logins and watch your spend. That vigilance is what lets you catch suspicious activity early.
Train your team on security basics. A lot of hacks come down to human error: clicking a dodgy link, reusing a weak password, sharing sensitive information. A well-trained team is your first line of defense.
Use professional security tools. Invest in a decent antivirus, use a VPN on public networks, and consider keeping a browser dedicated solely to your professional Facebook work.
Back up what matters: contact lists, ad creatives, campaign settings. If anything goes wrong, those backups get you running again much faster.
What if recovery fails?
Unfortunately, sometimes no amount of effort brings the ad account back. In that case you need alternatives to keep advertising.
Creating a new Business Manager is an option, but handle it carefully. Meta has sophisticated detection that can tie your new account to the compromised one. Follow the official procedures to the letter and be transparent about your situation.
Consider bringing in a professional who specializes in Facebook account recovery. Some experts have built real expertise here and occasionally succeed where individual attempts fail. Watch out for scams, though: always check references and never pay up front.
Look at temporary alternatives too. Google Ads, LinkedIn Ads or other platforms can keep your business visible while you sort Facebook out. That diversification may even pay off long term.
Frequently asked questions
How long does it take to recover a hacked Facebook Ads account?
Recovery times vary enormously with the complexity of the case and how responsive Meta support is. In the best cases it takes a few days, but some situations run for several weeks. The key is to submit a complete file from the start and to stay patient while following up regularly.
Can I get back the money the attackers spent on my account?
Meta does have a refund policy for unauthorized ad spend, but it isn’t automatic. You have to report the fraudulent transactions quickly and provide evidence of the hack. A refund isn’t guaranteed and depends on Meta’s assessment. Contact your bank as well to dispute the charges.
My account has been hacked several times — what now?
Repeated hacks usually point to a deeper security problem. Check whether your computer is infected with malware, change every password, and consider bringing in a cybersecurity expert. It’s also possible your personal information was exposed in a data breach.
Should I create a new Business Manager if I can't recover the old one?
Creating a new Business Manager is possible, but you need to declare it to Meta. Use the official channels to explain your situation and ask for permission. Opening a new account without reporting the old one can count as a terms of service violation and get you suspended for good.
How do I know my account is really secure after recovery?
Watch it closely for several weeks after you get back in. Check active sessions, setting changes and advertising activity regularly. Turn on every security notification available. If you see even the smallest suspicious thing, act immediately.