# Instagram Hacked and Ads Running on My Card: What to Do > Instagram hacked and boosted posts you never made are charging your card in Malaysia? Stop the ads, check Ad payments, remove the card and tell your bank. - URL: https://www.awarexone.com/research/instagram-hacked-ads-running-on-my-card - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-05 - Topics: Instagram, Account recovery, Malaysia - Related service: Instagram account recovery: https://www.awarexone.com/social-media-recovery/instagram-account-recovery ## Short answer Treat it as two problems at once. Call your card issuer to block or replace the card, then secure the account through instagram.com/hacked or the login link. End every ad you did not create, check Payment activity under Ad payments, and report the charges to Meta and your bank with evidence. Neither can promise a refund. ## Summary - Boosted posts you never created usually mean someone has access to your professional Instagram account and is spending through the card saved for ads. - Call your card issuer first to block or replace the card, then secure Instagram through instagram.com/hacked or the login link on the login screen. - Once you are back in, end every unknown ad in Ad tools and check Payment activity under Ad payments to see which boosts were charged. - Remove unknown business portfolio people and linked accounts, report the charges to Meta's payments support and lodge a written complaint with your bank. - Instagram billing messages in your DMs are a common trap, and nobody legitimate asks for your password, login codes, backup codes or the security digits on your card. - Meta decides what happens to the ad charges and your bank decides on any dispute, so keep records and do not expect a set outcome from either. Your bank sends a card alert for a Meta charge you did not make. Or a friend tells you they saw a sponsored post from your shop that you never boosted. You open Instagram and find ads running, sometimes for products that are not yours, and your card is paying for them. The short answer: treat it as two problems at once. Your card needs protecting today, and your Instagram account needs taking back from whoever is spending on it. Call the bank, secure the account, end the ads, then report the charges to Meta and your bank with evidence. This guide covers both sides in order, for professional (business or creator) Instagram accounts that boost posts from the app. If the ads ran from Facebook Ads Manager instead, our guide to [a hacked Facebook account charging your card for ads](https://www.awarexone.com/research/facebook-hacked-ads-charged-my-card) follows that route. Last checked: 5 October 2026. ## What Should You Do If a Hacker Is Running Ads on Your Card? Call your card issuer's 24-hour line and ask them to block or replace the card, because that stops new charges even if the attacker still controls Instagram. Then secure the account at [instagram.com/hacked](https://help.instagram.com/368191326593075) or with the login link from the "Forgot password?" screen. Once you are in, end every ad you did not create, check "Payment activity" under "Ad payments" to list the charges, and remove anyone you do not recognise. Report the transactions to Meta's payments support and lodge a written complaint with your bank. Meta and your bank each make their own decision; nobody can promise a refund. ## How Hacked Boosts End Up on Your Card Instagram ads are paid from an ad account linked to your professional profile. Meta's page on [how to pay for Instagram ads](https://www.facebook.com/help/instagram/559808137514535) says that a credit card, debit card or PayPal account you add in the app is added to your Instagram ad account and becomes available for ad payments. You can also pay through the ad account of a linked Facebook Page. So whoever gets into your account finds your saved card waiting. Meta's page on [boosting with a Meta ad account](https://help.instagram.com/814425323514595) shows that the daily budget and duration are chosen at the moment of boosting, with the option to confirm or change the payment details each time. Most of these takeovers start with phishing: a fake "account will be disabled" or "payment failed" message asking you to log in. Instagram's [phishing page](https://www.facebook.com/help/instagram/670309656726033/?locale=en_GB) says not to answer messages asking for your password or credit card information. ## Which Situation Are You In? Match what you see to a row below before you start. The labels quoted are the ones Meta's help pages use at the time of writing; the wording in your app can vary by version and region. *Instagram ad charge situations and the first step for each, based on Meta Help Center pages read on 5 October 2026.* | What you see | What it usually means | Who handles it | First step | | --- | --- | --- | --- | | A Meta charge on your card statement and ads you did not make in "Ad tools" | Someone used your Instagram account to boost posts with your saved card | Your bank for the card, Meta for the ad account | Call the bank, then end the ads | | You can log in, but new boosts keep appearing | The attacker still has a session, a linked account or a role in your business portfolio | You, through Instagram and Meta Business Suite | Change the password, log out other devices, remove unknown people | | You cannot log in, or the email and phone were changed | A full takeover | Instagram's hacked account process | Use instagram.com/hacked or the login link | | An Apple charge rather than a Meta one, after boosts from an iPhone | Ad funds were added through the Instagram iOS app, which Meta says is charged through the Apple App Store | Apple for that payment, plus your bank | Call the bank, then raise it with Apple through its own support | ## Step 1: Protect the Card Before Anything Else Your bank can act faster than any platform. Once the card is blocked, new boosts fail even while you are still locked out of Instagram. 1. Call the number on the back of your card or in your banking app, not a number from a message. 2. Report unauthorised Meta ad charges and ask the bank to block or replace the card. 3. Ask how to report the transactions in writing, and note the reference number. 4. Check for other cards saved to the same Meta account. Bank Negara Malaysia's page on [unauthorised use of a credit or debit card](https://www.bnm.gov.my/web/financial-fraud-alert/unauthorised-use-of-credit-or-debit-card) warns that fraudsters pose as bank staff, and says to end the call immediately if someone asks for the security digits on the back of your card. ## Step 2: Take Back the Instagram Account If you can still log in, change the password now. Instagram's page on [a hacked Instagram profile](https://help.instagram.com/149494825257596) says to change the password, turn on two-factor authentication, confirm the email and phone in settings, remove linked accounts you do not recognise in Accounts Center, and revoke suspicious third-party apps. If you cannot log in, the same page sets out the order to try: 1. Look for an email from security@mail.instagram.com saying your email was changed, and select "secure my account" in it. 2. On the login screen tap "Forgot password?", enter your username, email or phone, and request a login link. 3. If the link does not work, request a security code or support from a mobile device, and give an email address only you can access. 4. Complete the identity check Instagram asks for. For an account with photos of you, that may be a video selfie. If the attacker changed the email, phone and password together, our guide to [the first hour after an Instagram hack](https://www.awarexone.com/research/instagram-hacked-first-hour) goes through each recovery route in more detail. If the attacker also changed your username so your old handle no longer finds the profile, see our guide to [an Instagram username stolen after a hack](https://www.awarexone.com/research/instagram-username-stolen-after-hack). ## Step 3: End the Ads and Read the Payment Activity Ending the ads stops further spend from any card still attached. Meta's page on [ending or deleting an Instagram ad](https://www.facebook.com/business/help/1512900943340651) gives the steps in the app: 1. Go to your profile and tap "Professional dashboard". 2. Tap "Ad tools", find each ad you did not create below "Manage", and tap "Edit". 3. Tap "End ad", then "End" to confirm. 4. Screenshot every ad before you delete it. Meta says that once an ad is deleted, you no longer have access to its insights. Next, find out exactly what was charged. Instagram's page on [receipts for Instagram ads](https://help.instagram.com/789724481572641) says to open "Menu", choose "Business tools and controls" or "Creator tools and controls", tap "Ad payments", then "Payment methods", then the entry below "Payment activity". There you can see past bills for your Instagram ads. Save a screenshot of each one with the date and amount visible. ## Step 4: Remove Unknown Cards, People and Linked Accounts Meta's [ad payment options page](https://www.facebook.com/business/help/354027251751870) says you can add, edit or remove payment methods for Instagram ads at any time from "Menu", then "Ads payments", then "Billing & payments". Check that list for any card or PayPal account you did not add. To take your own card off, Meta's page on [removing a payment method](https://www.facebook.com/business/help/629342974487869) says there must be no outstanding balance and no ads still running. It says to pause active ads, allow up to 48 hours for delayed ad events, and clear any balance before removal. If paying a balance you dispute feels wrong, ask your bank first; a blocked or replaced card already stops new charges. Attackers often add themselves to the business side of the account so they can return later. Instagram's page for [professional accounts where a hacker is still taking actions](https://help.instagram.com/588993474002733) gives this route: 1. On a computer, go to Meta Business Suite at business.facebook.com and log in with your Instagram details. 2. Open "Business Settings", then under "Users" click "People". 3. If there are business manager names you did not authorise, Instagram says you can remove them by switching the account back to a personal account, then switching to professional again if you need to. Know the cost before you switch. Instagram says that as a personal account you lose access to Meta Business Suite, Ads Manager and in-app insights, including ads, though insights data is kept for 90 days and returns if you switch back within that time. Take your ad screenshots before switching. ## Step 5: Report the Charges to Meta and Your Bank Run the Meta report and the bank complaint side by side. One does not replace the other, and each will want the same facts. - Meta: Meta's page on [unrecognised Meta charges](https://www.facebook.com/help/218846068134280) says charges on an ads account belong in the Meta Business Help Center, while Meta Pay purchases are reported from "Orders and payments" on Facebook. Meta's page on [unrecognised activity on your ad account](https://www.facebook.com/business/help/524424920973484) explains how to read each charge under "Payment activity" and links a contact route if you believe someone hacked your ad account. - Your bank: lodge the dispute in writing and keep the reference. BNM's [complaint page](https://www.bnm.gov.my/contact-us/lodge-complaint) says to go to your bank's Complaints Unit first, as BNM will not accept a complaint that has not been through it. If there is no response after 14 days you can refer the case to BNMLINK, and if you are dissatisfied with the bank's decision you can use the redress channels BNM lists. - Apple: if the money went in as available funds through the iPhone app, Meta's [payment page](https://www.facebook.com/help/instagram/559808137514535) says it was charged through the Apple App Store, so Apple handles that payment. Be consistent. Tell Meta and the bank the same story, with the same dates and amounts. Neither publishes a set timeline or outcome for these reviews, so do not plan around a refund arriving. ## Evidence Checklist for Meta and Your Bank - Card statement lines for each unauthorised charge, with date, amount and merchant name. - Screenshots of each entry in "Payment activity", and of each unknown ad with its dates and budget. - Screenshots of unknown payment methods, linked accounts and business portfolio people before removal. - Your Instagram username and profile link, and the email and phone that were on the account before the hack. - Instagram security emails, such as an email or password change notice, with the time received. - The phishing message or link that started it, if you have it. - The bank's reference number, the date you called, and the date the card was blocked. - A short written timeline: when you last had normal access, when you noticed the ads, and what you did after. ## Mistakes That Make This Harder - Removing ads and payment methods before taking screenshots, which leaves you with nothing to show. - Deleting the account in frustration. The charges remain, and the records go. - Forgetting a second card saved on the same Meta account. - Reporting to Meta but never to the bank, or the other way round. - Leaving an unknown person in the business portfolio, so the boosts start again. > Warning: **Fake Instagram billing and recovery offers.** Expect follow-up messages from "Meta billing", "Instagram Ads Support" or a "bank fraud unit", in English, Bahasa Malaysia or Chinese, offering to reverse the charges or restore the account. Instagram's phishing page lists the email domains Meta uses and says to report suspicious emails to phish@instagram.com. Never give anyone your password, a login code, a backup code or the security digits on your card. Anyone asking for them is not helping you, and nobody can buy a refund or a recovery for you. ## If You Gave Card Details or Paid a Scammer in Malaysia If you entered your card details on a fake page, or paid someone who promised to fix the account, the money comes first. The NSRC's [FAQ on the NFCC website](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) says to contact your bank's 24-hour hotline or the NSRC on 997 as soon as you notice an unauthorised transaction, then make a police report at the nearest station. It notes that acting quickly can reduce losses, with no guarantee of getting money back. The phishing page itself can be reported to CyberSecurity Malaysia's [Cyber999 incident response centre](https://www.cybersecurity.my/portal-main/services/cyber999-overview) by online form, email, phone or its app. Our guide to [fake Meta support scams in Malaysia](https://www.awarexone.com/research/fake-meta-support-scam-malaysia) shows the scripts recovery scammers use. ## When a Case Review Makes Sense If you are back in control, have ended the ads and filed both reports, you have done what an outside helper would do. A second opinion is worth it when you are still locked out, when the attacker keeps returning through the business portfolio, or when the account is how your business takes orders. SocialSafe by AwareXone, our recovery service, reviews the situation first and tells you plainly whether Instagram's official routes still look open. We work only through those routes, cannot reverse a charge or make Meta restore anything, and some accounts do not come back. You can read how we approach [Instagram account recovery](https://www.awarexone.com/social-media-recovery/instagram-account-recovery), and our [Trust Center](https://www.awarexone.com/trust) sets out what we never ask for, starting with your password, login codes and card details. ## Frequently Asked Questions ### Will Meta refund ads a hacker ran on my Instagram? Meta's Business Help Center offers a contact route if you believe someone hacked your ad account, but Meta does not publish a set outcome. Report the charges with screenshots and dates, and dispute them with your bank at the same time. ### Why are there boosted posts on my Instagram that I did not make? Usually someone has logged in to your professional account, or holds a role in the business portfolio behind it, and is boosting posts with your saved card. Change your password, log out of devices you do not own, and check the people listed in Meta Business Suite. ### Can I remove my card from Instagram ads while ads are still running? Not straight away. Meta says you need to pause active ads, allow up to 48 hours and clear any outstanding balance first. Asking your bank to block the card stops new charges in the meantime. ### How do I find out which boosts were charged to my card? Open Menu, then Business tools and controls or Creator tools and controls, then Ad payments, Payment methods and Payment activity. Each past bill for your Instagram ads is listed there. ### Is a message saying my Instagram ad payment failed real? Treat it as suspicious until you check inside the app. Open Ad payments yourself instead of following the link, and compare the sender with the Meta email domains on Instagram's phishing page. ## Official sources - [Instagram Help Center: If you think your Instagram profile has been hacked (read 5 October 2026)](https://help.instagram.com/149494825257596) - [Instagram Help Center: Hacked Instagram account (read 5 October 2026)](https://help.instagram.com/368191326593075) - [Instagram Help Center: Professional account where a hacker is still taking actions (read 5 October 2026)](https://help.instagram.com/588993474002733) - [Instagram Help Center: About receipts for Instagram ads (read 5 October 2026)](https://help.instagram.com/789724481572641) - [Instagram Help Center: How to pay for Instagram ads (read 5 October 2026)](https://www.facebook.com/help/instagram/559808137514535) - [Instagram Help Center: Boost ads on Instagram with Meta Ad Account options (read 5 October 2026)](https://help.instagram.com/814425323514595) - [Meta Business Help Center: Manage ad payment options (read 5 October 2026)](https://www.facebook.com/business/help/354027251751870) - [Meta Business Help Center: End or delete an Instagram ad (read 5 October 2026)](https://www.facebook.com/business/help/1512900943340651) - [Meta Business Help Center: Remove a payment method from your Meta ad account (read 5 October 2026)](https://www.facebook.com/business/help/629342974487869) - [Facebook Help Center: Report an unrecognized Meta charge on your bank statement (read 5 October 2026)](https://www.facebook.com/help/218846068134280) - [Meta Business Help Center: Troubleshoot unrecognized activity on your ad account (read 5 October 2026)](https://www.facebook.com/business/help/524424920973484) - [Instagram Help Centre: Protect yourself from phishing on Instagram (read 5 October 2026)](https://www.facebook.com/help/instagram/670309656726033/?locale=en_GB) - [Bank Negara Malaysia: Unauthorised use of credit or debit card (read 5 October 2026)](https://www.bnm.gov.my/web/financial-fraud-alert/unauthorised-use-of-credit-or-debit-card) - [Bank Negara Malaysia: Lodge complaint (read 5 October 2026)](https://www.bnm.gov.my/contact-us/lodge-complaint) - [NFCC: National Scam Response Centre FAQ (read 5 October 2026)](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) - [CyberSecurity Malaysia: Cyber999 Cyber Incident Response Center (read 5 October 2026)](https://www.cybersecurity.my/portal-main/services/cyber999-overview) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.