What to Do If Your Meta Ad Account Gets Hacked

Someone else spending your ad budget without your permission is one of the more stressful things that can happen to a small business's marketing. It's also more common than most advertisers expect, and speed matters more than almost anything else here.

Signs your account may be compromised

• Ads running that you didn't create, often for completely unrelated products or services

• Spend appearing far above your set budgets

• Payment methods or admin users added to your Business Manager that you don't recognize

• Login alerts from unfamiliar devices or locations

What to do immediately

1. Change your Facebook password right away, and enable two-factor authentication if it isn't already on.

2. Remove any unrecognized admins, partners, or payment methods from Business Manager.

3. Pause or turn off any campaigns you didn't create.

4. Report the account through Meta's official hacked-account and business help flows — not through a generic contact form.

5. Contact your bank or card provider about disputing unauthorized charges in parallel with Meta's process; don't wait on one to resolve the other.

Reducing the odds it happens again

• Limit how many people have admin access to Business Manager, and review that list periodically

• Never share login credentials directly — use Business Manager's partner/employee access instead

• Be cautious with unfamiliar links or files sent through ad-related "policy violation" or "copyright complaint" emails — a common phishing vector for exactly this kind of account takeover

The accounts that recover fastest are usually the ones where the owner acted within hours, not days.

If your business depends on Meta ads as a channel, treating account security as routine maintenance — not a one-time setup step — is the cheapest insurance available against this.