Facebook ad account hacked? What to do and set up first

If your Facebook ad account was hacked, start at facebook.com/hacked, then remove anyone you don’t recognise from your business portfolio and stop the payment method the attacker is spending. The best protection is set up before it happens: an account spending limit, a passkey or two-factor authentication, and as few people with full control as possible.

How do I know if my Facebook ad account was hacked?

Meta lists these signs for a hacked Facebook account: your email or password changed, your name or birthday changed, friend requests went to people you don’t know, or messages, posts or ads appeared that you didn’t create. When your email is changed, Meta sends a link to the old address that lets you cancel the change.

In the ad account itself, look at three places:

• Billing in Ads Manager: payments you don’t recognise. Each receipt shows why it was charged.
• Campaigns: new campaigns, or budgets raised overnight.
• Account settings, then Ad account roles: people you didn’t add.

Attackers usually go after a person first. Meta has said they often target “the personal accounts of people who manage or are connected to business pages” to run ads, so a hacked personal profile is often how an ad account is lost.

What should I do first if my ad account was hacked?

1. Get your login back at facebook.com/hacked, ideally from a device you’ve logged in on before. For a hacked Page, Meta has a separate Page recovery form and aims to reply within a day.
2. Remove people you don’t recognise from the business portfolio (Business Suite Settings, then People) and from the ad account roles. You need full control to see People at all.
3. Stop the money. The quickest way is often your bank: block the card on the account. Meta pauses ads when a payment fails, so a blocked card also stops the attacker’s ads. You’ll still owe the balance later, so tell the bank what happened.
4. Pause campaigns you didn’t create, and undo budget changes.
5. Report the unauthorised charges to Meta and to your bank, with screenshots of the campaigns and receipts.

The pitfall: removing the card inside Meta is slower than it looks. Meta only lets you remove a payment method once ads are paused and the balance is paid, and suggests allowing up to 48 hours for ad activity to finish. In an emergency, the bank is faster.

Once you’re back in, Meta’s advice is to review your Page and business portfolio, undo anything you don’t recognise, and turn on Advanced Protection.

How do I get a disabled or restricted ad account reviewed?

Hacked accounts are often disabled too, because the attacker’s ads break Meta’s rules. Meta’s ad standards say that if you believe your ad account, Page or business account “was incorrectly restricted”, you can request a review in Account Quality. A restricted account can’t advertise until the review succeeds.

Open Account Quality and look for What you can do next to the restriction. If there’s no such option, Meta isn’t offering a review for it. You need to be an admin on the ad account to ask.

Why did my ads stop after a payment failed?

Meta pauses ads when a payment fails, until the balance is paid. Common causes are a card limit, an expired card, too little money in the account, or wrong bank details. Fix it with Pay now or a new payment method in Payment settings, and ads start again. Meta suggests adding a backup payment method so one declined card doesn’t stop everything.

What should I set up before it happens?

• An account spending limit. It caps what the ad account can spend across all campaigns, and ads pause when it’s reached. It doesn’t reset by itself: use Reset in Payment settings to start again from zero with the same limit. Accounts on manual payments or prepaid funds can’t set one.
• Advanced Protection. Meta requires it for accounts in business portfolios that advertise. It checks your account and suggests a passkey, a stronger password or two-factor authentication: Accounts Center, then Password and security, then Advanced Protection. Labels may differ while Meta moves people to Meta accounts.
• A passkey or two-factor authentication on every person with access. A passkey can’t be phished like a password. Meta allows up to 5 per account.
• Two-factor authentication for the whole portfolio. People with full control can require it for admins or for everyone, in Business Suite settings.
• Fewer people with full control, and login alerts turned on, so a login from a new device sends you an email.

Here’s what a spending limit does in practice. Say you spend $30 a day on one campaign, about $900 a month. You set an account spending limit of $1,000 and reset it on the 1st of each month. If someone gets in on the 20th, with $600 already spent, the most the account can spend before ads pause is $400. A campaign spending limit wouldn’t help, because attackers create new campaigns; only the account limit covers them all.

The limit has two catches. An attacker who becomes an admin can remove it, so it works alongside few admins and Advanced Protection, not instead of them. And if you forget to reset it, your own ads pause too.

How do hackers get into ad accounts?

Mostly through people, not Meta. In 2023 Meta described attacks using fake browser extensions and apps, some built to get around two-factor authentication. In 2023 security researchers found a fake “Ads Manager” tool and Chrome extension that stole Facebook logins and cookies from around 800 victims, worth about $180,000 in ad budget. Install only extensions you trust, and remove ones you no longer use.

In December 2025 Meta said new account hacks had fallen by more than 30% worldwide. Advertisers remain a target all the same, because a working ad account with a saved card is worth money.

Running Google Ads too? The same checks apply there: see Google Ads account hacked, and what to do after a spend spike. SpendCanary watches Google Ads accounts today, and Facebook and Instagram are what we’re looking at next.

Sources

• Meta Help: Signs of a hacked account, Hacked Page recovery, Advanced Protection, Passkeys, Two-factor authentication.
• Meta Business Help: Unrecognised ad charges, Remove a payment method, People in a business portfolio, Disabled ad account, Failed payments, Account spending limit, Campaign spending limit, Require two-factor authentication.
• Meta: Ad standards, Payment Protection Policy, How Meta protects businesses from malware (2023), Account support changes (2025).
• ThreatDown (Malwarebytes): Malicious Ads Manager extension.
• The $30-a-day example and the bank tip are our own illustration and advice, not Meta figures.