Facebook Business Account Hacked: Revoke Access First

bolt

Quick Answer

If you can still log in, contain the compromise first: remove unfamiliar people and partners in Business settings, secure the personal profile, review payment methods and active campaigns, and preserve screenshots. Then report through facebook.com/hacked and whichever official Meta flow matches the asset taken. If you are locked out, start at facebook.com/hacked on a device you have used before. Meta publishes no universal restoration schedule.

Why This Happens

You can still log in, but people or partners you do not recognize hold access

This is portfolio access compromise, not profile loss, and you still hold Admin, so containment is in your own hands. Meta documents that an Admin can remove people from a business portfolio and separately remove partners, and that permissions can be changed per person and per asset. Next action: work Business settings top to bottom, People and then Partners, remove everything unrecognized, then re-check People, because an attacker with Admin can add a second account that survives a password reset.

You cannot log in to the personal profile at all

Portfolio access is unreachable until the profile is back, so profile recovery is the blocking step. Meta documents facebook.com/hacked as the recovery destination and recommends using a device you have used to log into Facebook before. Next action: run that flow first. If the attacker changed the email, Meta documents that a message is sent to the previous email address with a link that reverses the email change.

The profile is fine but a Page was taken or unpublished

A Page is a separate asset with its own documented recovery path, so the business portfolio flow is the wrong queue for it. Next action: use Meta's flow for recovering a hacked Page you manage, and separately confirm in Business settings whether the Page is still owned by your portfolio or was moved out of it.

Access looks clean but there is spend you did not authorize

Unrecognized charges are not automatically a hack. Meta's unrecognized activity guidance points first at ordinary causes: reaching a payment threshold or monthly bill date, another person spending through a shared payment method or ad account, and the transaction detail behind each charge in Billing. Next action: open the Transaction ID for each charge to see the receipt, and check Ad account roles for who has access, before filing a compromise report.

You were never phished, but an admin or a connected app was

The compromised credential may not be yours. Anyone holding an Admin role can do what an Admin can do, and a third-party integration acts with the permissions it was granted. Meta documents that the unauthorized access or control of an ad account is not allowed and that permissions should be reviewed per person and per asset. Next action: audit every admin and every connected app, not just your own account, and reduce roles to the least access that still lets each person work.

Assets are still there but ownership or sharing changed

Quiet ownership changes are how a compromise outlives the password reset. A pixel shared to an unfamiliar business or a Page moved to another portfolio keeps sending value to the attacker after you regain login. Next action: record every unexpected ownership, access, or sharing change with dates before you undo it, and report those specifics through the compromised business portfolio flow. Then check account quality in Business Manager for any notice left on the affected assets.

Step-by-Step Recovery

Revoke unrecognized people and partners before anything else

Go to Business settings, then People, and remove any user you do not recognize. Then go to Partners and remove any unrecognized partner connection. Meta documents removal of people from a business portfolio and removal of partners as separate Admin actions, so doing one is not doing the other. Do this before changing your password: an attacker holding Admin may have already added a backup account that a password reset does not touch.

Change the password and log out all other sessions

In Facebook Settings, Security and Login, change the password, then use Where you're logged in to review devices and locations and log out of the sessions you do not recognize. Meta's hacked-account guidance points at that same section for spotting unrecognized logins. Turn on login alerts if they are off.

Enable authenticator-based two-factor on every account with portfolio access

Enable two-factor authentication now on every account that holds Business Portfolio access, not only yours. Prefer an authenticator app over SMS, because SIM swapping undermines SMS codes. Make authenticator-based two-factor a condition of continued Admin access for everyone else on the portfolio.

Pause campaigns, then read each charge before removing payment methods

Pause active campaigns to stop the bleed. Then, in Billing, open the Transaction ID behind each unrecognized charge to reach its receipt, which is the step Meta's unrecognized activity guidance documents. Check Ad account roles for who has access and whether a shared payment method explains the spend. Screenshot each unfamiliar payment method with dates before you remove it, because once removed it is no longer visible to reference in a report.

Assemble the evidence checklist Meta's flows actually ask for

Meta does not publish a single consolidated document checklist for a business compromise, so gather what its separate flows request and keep the rest on file. For the profile, facebook.com/hacked runs identity confirmation and Meta recommends a previously used device. For the portfolio, prepare the business portfolio ID, the affected ad account IDs, and a dated log of each unauthorized action: people and partners added, payment methods added, campaigns created, and any Page, pixel, or asset moved or shared. For billing, prepare the Transaction ID and receipt for each disputed charge plus the last four digits of the payment method, which is the level of detail Meta's unrecognized charge reporting works from. Screenshots should show the timestamp and the URL.

Report the compromise through the flow that matches the object

Work out which of four objects was actually taken before you file, because each has its own documented flow and they are separate queues. A hacked personal Facebook profile is recovered at facebook.com/hacked, where Meta recommends a device you have logged in from before and where an emailed link lets you reverse an unauthorized email change. A hijacked Business Portfolio, formerly Business Manager, goes through Meta's separate business portfolio compromise flow, with its access fixed in Business settings by removing people and removing partners. A compromised ad account inside a portfolio you still control is a billing and access problem, handled through Meta's unrecognized activity path in Billing and Ad account roles rather than through profile recovery. A hacked Page you manage has a fourth flow of its own. Filing in the wrong queue stalls a case. Submit only the records the flow requests and monitor the status it shows.

Audit every asset for ownership and sharing changes

Check whether Pages were unpublished, removed from your portfolio, or transferred elsewhere; whether pixels or catalogs were shared with businesses you do not recognize; and whether apps were connected. Meta documents permissions as configurable per person and per asset, so an asset can be exposed even when the person list looks correct. Record every unexpected change and report it rather than assuming a silent fix.

Handle a rejected report or an unrecovered account without circumventing enforcement

Meta does not publish a restoration schedule, a success rate, or an appeal ladder for a compromise case, and it does not document what follows a rejected report. Treat that silence as the answer: follow whatever next action the flow displays, and keep the case reference. What not to do: building a new Business Portfolio, profile, or identity to route around a decision. Meta states its Account Integrity policy covers accounts created or repurposed to evade a previous account or entity removal, including those assessed to have common ownership as previously removed accounts, and accounts otherwise used to evade its enforcement actions or review processes. Rebuild on assets you legitimately own instead.

Close the access path before restoring full operations

Before resuming spend, remove every admin who no longer needs access, revoke third-party app permissions that are not actively used, check each admin's email account for signs of the original phish, and confirm authenticator-based two-factor everywhere. Consider a dedicated browser profile or device for portfolio access. If an agency holds infrastructure for you, get ownership, access, billing, recovery, and offboarding terms in writing; no arrangement guarantees continuity, and assuming isolation is how one compromise becomes two.

Appeal Template

Copy this template and fill in the bracketed sections with your specific information. Customize it — don't send it as-is.

descriptionAppeal Letter Template

Subject: Compromised Business Portfolio Report — [BUSINESS_PORTFOLIO_ID]

Dear Meta Support Team,

I am reporting unauthorized access to the business portfolio [BUSINESS_PORTFOLIO_ID] associated with [BUSINESS_NAME].

Incident details:
- Date discovered: [DATE]
- Business portfolio ID: [BUSINESS_PORTFOLIO_ID]
- Ad accounts affected: [ACCOUNT_IDS]
- Payment method affected: [CARD TYPE, LAST FOUR DIGITS]

Unauthorized actions, with dates:
- [People or partners added — name/email — date]
- [Payment methods added — date]
- [Campaigns created — campaign name — date]
- [Pages, pixels, or assets moved or shared — asset — destination — date]

Disputed charges, from Billing:
- [Transaction ID] — [date] — [amount as shown on the receipt]
- [Transaction ID] — [date] — [amount as shown on the receipt]

Containment already completed:
- Removed unrecognized people from Business settings on [DATE]
- Removed unrecognized partners from Business settings on [DATE]
- Changed password and logged out other sessions on [DATE]
- Enabled authenticator-based two-factor authentication on [DATE]
- Paused all campaigns and removed unrecognized payment methods on [DATE]

I am requesting review of the unauthorized access and of the assets moved without authorization.

Attached:
- Screenshots of the unauthorized people, partners, campaigns and charges, with timestamps
- Billing receipts for each Transaction ID listed above
- Business registration or incorporation documents
- Government-issued ID

Please respond to [YOUR EMAIL].

[YOUR NAME]
[YOUR TITLE]
[COMPANY NAME]
[DATE]

Prevention Checklist

check_box_outline_blankEnable authenticator-based 2FA on every account with Business Portfolio access
check_box_outline_blankAudit Business settings People and Partners quarterly — remove anyone who no longer needs access
check_box_outline_blankGrant the least access that still lets each person do their work, per person and per asset
check_box_outline_blankNever click links in emails claiming to be from Meta's policy or billing team — go directly to facebook.com
check_box_outline_blankUse a dedicated browser profile or device for Business Portfolio access
check_box_outline_blankReview and revoke third-party app permissions in Business settings monthly
check_box_outline_blankRequire all admins to use unique, strong passwords managed in a password manager
check_box_outline_blankSet up login alerts and check Where you're logged in for unrecognized devices
check_box_outline_blankStore a recovery code for your 2FA method in a secure offline location

Expected Timeline

scheduleResolution Timeline

Meta does not publish a universal restoration schedule. Monitor the status shown in facebook.com/hacked, Business Manager Help, and any case channel, and follow the next action shown there.

Next Steps

Fixing this resolves the immediate problem. It does not change the setup that produced it. These cover the Meta account structure, permissions, and review exposure underneath.

How to Secure Ad Account Access: Admin Roles, Partner Access, 2FA, and Offboarding Across Meta, Google, and TikTokarrow_forward Who Owns the Meta Pixel, Catalog, and Custom Audiences When an Agency Runs Your Ad Accountarrow_forward How to Transfer Meta Ad Account Ownership Between Business Portfoliosarrow_forward Buy Facebook Ads Account: What You're Actually Buying, Why Purchased Accounts Get Restricted, and the Compliant Alternativearrow_forward What AdsInfra charges to run this as managed infrastructurearrow_forward

shield_with_heartAdsInfra

Scaling past $100K a month?

AdsInfra coordinates agency ad-account access, billing, permissions, and restriction-response workflows for high-spend teams across Meta, TikTok, and Google.

check_circleCoordinated account access and billing workflows
check_circleHuman-led restriction review and escalation
check_circlePlatform-specific onboarding and compliance checks

Message us on WhatsApp Talk to a Specialist

Frequently Asked Questions

How do I remove an unauthorized admin from my Business Portfolio?expand_more

In Business settings, open People, find the account you do not recognize, and remove it; Meta documents removing people from a business portfolio as an Admin action. Then open Partners and remove unrecognized partner connections, because a partner is a separate object and removing a person does not remove a partner. Meta also documents changing a person's permissions for a portfolio or an individual asset, which is what you use to demote an account you need to keep but do not want holding Admin. Two practical points: re-check People after your first pass, since an attacker with Admin can add a backup account, and if you are locked out of the profile entirely, none of this is reachable until you recover the profile at facebook.com/hacked first.

Will Meta refund the ad spend an attacker ran on my account?expand_more

Meta does not document a refund entitlement for unauthorized ad spend, and no honest answer promises one. What it does document is an investigation path: for unrecognized activity on an ad account it directs you to open the Transaction ID for each charge to reach the receipt, check whether a payment threshold or bill date explains it, check whether someone sharing your payment method or ad account ran the ads, and review who holds access in Ad account roles, and then to report it if you still believe the account was hacked. There is a separate flow for reporting an unrecognized Meta charge on a bank statement. Meta publishes no rate, timeline, or outcome for those reviews. Treat a chargeback as a last resort rather than a first move, and check Meta's own path before going to your bank, because a chargeback can affect account standing.

What happens if my compromise report is rejected or nothing comes back?expand_more

Meta does not document what follows a rejected compromise report, and it publishes no appeal ladder, restoration schedule, or success rate for these cases. That gap is the honest answer rather than a sign you have missed a queue. Do the things that are within your control: keep the case reference, follow whichever next action the flow displays, make sure you filed in the flow that matches the object taken, and make sure containment is genuinely complete so a second report is not filed against a portfolio the attacker still holds. What you should not do is create a replacement portfolio or profile to route around the decision, which Meta's Account Integrity policy addresses as accounts used to evade its enforcement actions or review processes.

Can I file a second compromise report if the first one goes nowhere?expand_more

Nothing stops you from filing again, but Meta does not document a second-attempt process, an appeal ladder, or an escalation path for compromise cases, so a duplicate report is not an escalation and should not be treated as one. Make the second filing worth reading rather than louder: confirm you used the flow that matches the object taken, since a portfolio report and a profile recovery are separate queues, and confirm containment is actually complete, because a report filed against a portfolio the attacker still holds describes a moving target. Add what the first report lacked, such as Billing receipts by Transaction ID, dated screenshots of each unauthorized change, or evidence of an asset moved out of your portfolio. Keep the original case reference and follow whichever next action the flow displays.

My profile was hacked and my Business Portfolio with it — which do I recover first?expand_more

The profile, because portfolio access hangs off it. Meta recommends starting at facebook.com/hacked and, if you can, using a device you have logged into Facebook from before. If the attacker changed the account email, Meta documents that a message with a link goes to the previous email address and that the link reverses the email change, so check that inbox including spam before assuming the address is gone. Once you are back in, work Business settings immediately: remove unrecognized people, remove unrecognized partners, then report the portfolio compromise through Meta's business portfolio recovery flow with a dated log of what changed while you were locked out.

How do attackers get past two-factor authentication?expand_more

Usually by not logging in at all. Session hijacking takes an already-authenticated browser session rather than credentials, through malware that extracts session cookies, a malicious browser extension, or real-time phishing that relays both the password and the code as you type them. The other route skips your account entirely: a connected third-party app acts with the permissions it was granted, and any Admin on the portfolio can do what an Admin can do, so a phished contractor is a full compromise. Review Where you're logged in, audit connected apps, keep roles at the least access each person needs, and consider hardware security keys for accounts that hold Admin.

Do I need to rebuild my pixel and audiences after a hack?expand_more

Check before you rebuild. In Events Manager, confirm which pixels and custom audiences are still listed and whether events are still arriving. If a pixel shows no recent events, find out whether it was deleted, disconnected, or shared to another business rather than assuming data loss, and check Business settings for ownership and sharing changes on each asset. Meta documents permissions as assignable per asset, so a pixel can be exposed to an unfamiliar business while your people list looks correct.

Would an agency ad account have protected me?expand_more

No, and treating it as protection is the mistake worth naming. An agency arrangement is a provider relationship, not a recovery mechanism, and no provider can guarantee restoration of a compromised asset. Before relying on one, get ownership, admin access, billing responsibility, support channels, incident handling, and offboarding terms in writing. Keep your own records of asset ownership regardless, and follow Meta's official recovery flow for whichever object was actually compromised.