A hacked Facebook ad account usually announces itself in the worst possible way: a bank alert for a charge you didn't make, an email saying a new admin was added, or a campaign for sneakers or crypto running from your Page in a language you don't speak. Whoever got in wants one thing: to spend your money, or your credit line, on their ads before you notice. The good news is that most of the damage is preventable if you act in the right order. This guide gives you the first-hour checklist, the recovery path when you've been locked out, how to deal with the charges, and the settings that make a repeat much less likely.
In short: First stop the money (pause the strange campaigns, lower the account spending limit, remove or lock your card with the bank), then secure your personal Facebook profile at facebook.com/hacked, then remove every person, partner and app you don't recognize from your business portfolio. Dispute the charges with Meta and your bank, and finish by turning on two-factor authentication for everyone with access.
How to tell your ad account was hacked
Not every strange thing is a hack. A campaign that spends faster than you expected is usually a budget setting, and a sudden "account restricted" notice is often a policy issue (see what to do when your Meta ad account is restricted). These signs, on the other hand, point to someone else being inside:
- Campaigns you didn't create, often with a high daily budget, a product you don't sell and a destination that isn't your site.
- New people or partners in your business portfolio, or your own role downgraded from full control.
- Emails from Meta about a password, email or phone change you didn't make. Meta sends these to the old address too, so check your inbox and spam folder.
- Charges on your card from Meta that don't match your own spend, sometimes several smaller ones in a row as the billing threshold is hit again and again.
- You can't log in with a password that worked yesterday.
One warning before you click anything: a common way accounts get taken over is a fake message that pretends to be from Meta ("your Page will be deleted in 24 hours, appeal here"). If you're investigating a hack, type addresses into the browser yourself instead of following links in messages.
The first hour: stop the money first
When you still have access, the order matters. Securing the password is important, but every minute a hijacked campaign runs costs you real money, so start with the spend.
Step 1: Pause what you didn't create
Open Ads Manager, filter by campaigns that are active, and turn off anything you don't recognize. Don't delete them yet: you may need them as evidence when you dispute the charges. If you can't tell which campaigns are yours, pause everything. A lost day of sales is cheaper than a stranger's ads running on your card overnight.
Step 2: Lower the account spending limit
In Billing and payments, open the payment settings and set an account spending limit just above what's already been spent. Once the limit is reached, ads stop delivering for that account until it's raised. It's the closest thing Meta has to an emergency brake, and it works even if the attacker created campaigns in a corner you haven't found yet. If you've never used it, our guide to Meta ads budgets explains how it differs from campaign and ad set budgets.
Step 3: Protect the card itself
Call your bank or use its app to freeze the card connected to the ad account, or ask for a new card number. Removing the card from Meta helps, but an attacker with admin rights can add a payment method back. A frozen card can't be charged at all. Expect your own ads to stop as well; if they matter today, add a fresh card later, once the account is clean.
Step 4: Secure your personal profile
Ad accounts don't have passwords; people do. The attacker got in through someone's Facebook profile (often yours, sometimes an employee's or an agency contact's). Go to Accounts Center → Password and security and:
- Change your password to a new, long one you have never used anywhere else.
- Open Where you're logged in and log out of every session you don't recognize (or all of them).
- Check that the email addresses and phone numbers on the account are still yours, and remove any that aren't.
- Turn on two-factor authentication (more on the best method below).
If you can't do these steps because you're locked out, skip ahead to "If you've lost access".
Step 5: Clean out the business portfolio
Open your business portfolio settings (Meta Business Suite → Settings) and review, one by one:
- People: remove anyone you don't know, and anyone who no longer needs access.
- Partners: remove agencies or businesses you don't work with. A common trick is to share your ad account with the attacker's own business portfolio, so the access survives a password change.
- Ad accounts, Pages and Instagram accounts: check who has access to each one and with what permissions.
- Apps and integrations: remove anything you didn't install.
If you've lost access to your Facebook account
When the attacker has changed your password and email, you can't fix things from inside. Go to facebook.com/hacked from a device and browser you've used before. Meta recognizes known devices and locations, which helps. The flow asks what happened and lets you recover with an old password, a code sent to an email or phone you had on the account, or, in some cases, a video selfie or ID check.
While you wait:
- Warn the other admins. If someone else in your business portfolio has full control, they can pause campaigns, lower the spending limit and remove the attacker right away. This is the strongest argument for always having a second admin you trust.
- Freeze the card at your bank, even if you can't reach Meta yet.
- Tell your customers on your other channels (email list, website) not to trust messages or offers coming from your Page for now.
What if a whole business portfolio was taken over?
If you were removed from the portfolio entirely, you'll need another admin of that portfolio, or Meta's support, to get back in. Recover your personal profile first (support flows check that the person asking is a real, secured account), then use the help options in Meta Business Suite to report the compromised business. Keep a list ready: the ad account IDs, the Page names, the dates you noticed the problem and screenshots of the unknown campaigns and charges. It makes every conversation with support faster.
How to get the money back
Unauthorized ad charges are a billing question, and there are two parallel routes:
- With Meta: in Billing and payments, the payment activity shows every charge and which campaigns caused it. Meta has a process for reporting charges you didn't authorize; use it from the ad account, and include the campaign names and dates you paused.
- With your bank: report the charges as fraud. Banks have their own deadlines for disputes, so don't wait for Meta's answer before calling.
A word of caution: if you dispute a charge with your bank, Meta may restrict the ad account until the dispute is resolved. That's expected. If it happens, our guide to failed and blocked Meta ad payments explains how to get billing back to normal.
A hypothetical timeline of a hack
Say you sell handmade candles and spend about $40 a day on ads. At 11 p.m. on a Friday, someone logs in with a password leaked from an old forum account and creates a campaign with a $900 daily budget promoting something you've never heard of. Meta charges your card each time the account's billing threshold is reached.
| Time | What happens if nobody is watching | What happens with the first-hour steps |
|---|---|---|
| 11 p.m. Friday | Rogue campaign starts | Rogue campaign starts |
| 11:30 p.m. | First charges hit the card | Your phone shows a login alert; you check |
| Midnight | Spend keeps climbing all weekend | Campaign paused, spending limit lowered, card frozen |
| Monday morning | Several hundred dollars spent, card maxed | A few dollars spent; you're disputing one small charge |
The numbers are made up, but the shape is real: the size of the loss depends almost entirely on how fast someone notices.
Prevention: make the next attack bounce off
Most takeovers come down to a weak or reused password, a phishing page that collected a login, or malware on a computer that stole a logged-in session. You can't control everything, but these settings close the most common doors.
Turn on two-factor authentication for everyone
Two-factor authentication means a login needs something you know (the password) and something you have (your phone or a security key). Meta explains the options in how two-factor authentication works on Facebook. In order of strength:
- A security key or passkey: the hardest to phish.
- An authentication app (codes generated on your phone): a good default.
- Text message codes: better than nothing, but vulnerable to SIM-swap scams.
Save the recovery codes Meta gives you somewhere offline. Then, in your business portfolio settings, require two-factor authentication for admins or for everyone. It's one setting, and it protects you from the weakest link on your team.
Keep roles tight
- Two admins with full control, no more. One is a single point of failure; five is five chances to be phished.
- Partial access for everyone else. An employee who writes ads doesn't need to manage billing or people.
- Agencies as partners, not as people. Share assets with your agency's business portfolio instead of adding individual freelancers to yours. When the relationship ends, you remove one partner. Agencies managing many clients face the same issue from the other side; see managing Meta ads for clients.
- Review access every few months, and the same day someone leaves your team.
Put a ceiling on the damage
- Keep an account spending limit a bit above your normal monthly spend. You'll raise it on purpose before a big sale; an attacker will hit it.
- Use a card with a modest limit or a virtual card for ads, not your main business account.
- Turn on login alerts in Accounts Center so you hear about new devices the moment they appear.
Keep the computer clean
Session-stealing malware often arrives as a fake "ad report", a pirated tool or a browser extension that asks for broad permissions. Use one browser profile for ad work, keep the extension list short, and don't open attachments that claim to be "Meta policy violations".
How Meta Ads Copilot Max fits in
Meta Ads Copilot Max is not a security product, and it can't recover a hacked account. What it does is make strange activity harder to miss. If you connect the Spend tab with a read-only Meta token, Copilot shows today's spend, yesterday, this month, your account spending limit and every campaign with its budget and spend, and it refreshes by itself every 15 minutes by default. A campaign you never created, or spend racing toward your limit, shows up there without opening Ads Manager, and Copilot raises an alert when the account spending limit is almost reached.
By design, Copilot never touches billing, payment methods or passwords, and the token it uses can only read: it can't change campaigns or spend money. That also means the recovery steps above are yours to do. After you recover an account, create a new read-only token and paste it again in Settings. If you'd like to try it, start your free 7-day trial. It requires Chrome, Tampermonkey and the Claude in Chrome extension, which is what does the clicking when you ask Copilot to create or fix campaigns.
Frequently asked questions
Will Meta refund money spent by a hacker?
Meta has a process for reporting charges you didn't authorize, and you should use it from the ad account's billing section with the details of the campaigns you paused. Report the charges to your bank as fraud at the same time, because bank dispute windows are limited. Neither route is guaranteed, which is why stopping the spend quickly matters most.
Can I still use my ad account after it was hacked?
Usually yes, once the account is secure and any billing dispute is settled. Meta may restrict the account while it reviews suspicious activity or a chargeback; if that happens, follow the restriction notice in Account Quality rather than creating a new ad account.
Is changing my password enough?
No. A password change doesn't remove people or partners the attacker added to your business portfolio, and it doesn't always end stolen sessions. Log out of unknown sessions, clean up people and partners, and turn on two-factor authentication.
How do I know which two-factor method to use?
A security key or passkey is the strongest, an authentication app is a good default, and text messages are the weakest of the three because phone numbers can be hijacked. Whatever you choose, save the recovery codes offline.
Should I create a new ad account instead of recovering the old one?
Not as a first move. A new account doesn't help if the profile that was hacked is still insecure, and opening new accounts to get around a restriction can make things worse. Secure the profile and portfolio first, then decide.
