What to Do If Your Meta Ad Account Gets Hacked
Someone else spending your ad budget without your permission is one of the more stressful things that can happen to a small business's marketing. It's also more common than most advertisers expect, and speed matters more than almost anything else here.
Signs your account may be compromised
Ads running that you didn't create, often for completely unrelated products or services
Spend appearing far above your set budgets
Payment methods or admin users added to your Business Manager that you don't recognize
Login alerts from unfamiliar devices or locations
What to do immediately
Change your Facebook password right away, and enable two-factor authentication if it isn't already on.
Remove any unrecognized admins, partners, or payment methods from Business Manager.
Pause or turn off any campaigns you didn't create.
Report the account through Meta's official hacked-account and business help flows — not through a generic contact form.
Contact your bank or card provider about disputing unauthorized charges in parallel with Meta's process; don't wait on one to resolve the other.
Reducing the odds it happens again
Limit how many people have admin access to Business Manager, and review that list periodically
Never share login credentials directly — use Business Manager's partner/employee access instead
Be cautious with unfamiliar links or files sent through ad-related "policy violation" or "copyright complaint" emails — a common phishing vector for exactly this kind of account takeover
The accounts that recover fastest are usually the ones where the owner acted within hours, not days.
If your business depends on Meta ads as a channel, treating account security as routine maintenance — not a one-time setup step — is the cheapest insurance available against this.
Comments