A hacker removed you as admin, Meta suspended the business portfolio, and the appeal was rejected in minutes. Here is the timeline and what to do next.
When a hacker removes you as admin and the business portfolio is then suspended, an appeal sent from the wrong account or without admin access is likely to fail. First regain admin access through Meta's hacked portfolio and Page recovery routes, secure every admin, then request review from Meta Business Support Home as an admin.
SummaryIt happened fast. You got an email that you were removed from your business portfolio. Then the Page, the Instagram account and the ad account went quiet. A suspension notice arrived, you appealed, and the rejection landed minutes later. In October 2026, the Ottawa Citizen reported an Ottawa gym that lost access to its social media accounts in minutes after a hack.
This guide is about that specific chain: removed as admin, then suspended, then rejected. For first response steps after a business hack, read our core guide on a hacked Meta Business Manager. Here we map the timeline, explain why the appeal failed, and show the order that gives a review its best chance, using Meta's hacked business portfolio page and its disabled account troubleshooting page. One wrong step can cost you the account, so know what you are doing before you start.
Last checked: 3 November 2026.
When a hacker removes you as admin and the business portfolio is then suspended, an appeal sent from the wrong account or without admin access is likely to fail. First regain admin access through Meta's hacked portfolio and Page recovery routes, secure every admin, then request review from Meta Business Support Home as an admin.
Every takeover is different, but the notices tend to arrive in this order. This table is our summary, built from Meta's descriptions of how compromises happen and what they look like.
| Stage | What you may receive | What it means | What to do |
|---|---|---|---|
| 1. Login | A new login or security alert | Someone signed in to an admin's personal account | Secure that personal account at once |
| 2. Access change | An email that a person was added or that you were removed | The intruder gave themselves full access and removed yours | Start recovery, do not appeal yet |
| 3. Misuse | Ad spend you did not approve, or strange posts | The intruder is using the assets | Record everything, alert your bank if cards are charged |
| 4. Enforcement | A notice that the portfolio, Page or ad account is restricted | Meta acted on the activity it saw | Note which asset and which notice |
| 5. Rejection | A review rejected minutes after you sent it | The review did not succeed from where you stand | Regain admin access before any new request |
Meta's hacked portfolio page says compromises typically occur when an individual account is hacked or accessed through malware or phishing, which results in unauthorised changes. It lists signs such as new users or admins added without approval, ad accounts or campaigns you did not create, unexplained increases in spend, and posts that are not typical of your business.
Meta's troubleshooting page is clear on one point that matters here:
To request a review, you must be an admin on the account.
If the intruder removed you, you may not be an admin any more, or you may be requesting review from an account with the wrong role. A review sent by the intruder, or one that only restates that the account was hacked without the recovery done first, may also fail. A decision within minutes suggests an automated check, but Meta does not say how each decision is made, so treat this as our reading, not Meta's explanation.
Meta's account suspension page covers personal profiles and says that if an appeal is not successful, the account is permanently disabled and you cannot request another review. That page is about personal accounts, not business portfolios, but it shows why you should not spend a review before you are ready.
Meta's troubleshooting page says the What you can do section may ask you to confirm your identity, complete verification, secure your account, or request a review. Do those steps in the order shown. If ad spend was charged, see our guide on ad spend after a Business Manager hack.
Meta's permissions page says people with full access can manage everything in the business portfolio, including settings, people, tools and assets, and can claim or remove assets or people. That is why an intruder with full access can remove you. It also means that after recovery, the number of people with full access is worth cutting back to the people who truly need it.
If an ad account stays disabled after the portfolio is back, our disabled ad account and Business Manager guide covers that route.
Malaysian small businesses run Page sales, Instagram orders and ads from one business portfolio, so one takeover can stop the whole shop at once. If a card was charged, tell your bank quickly. If money was taken by fraud, you can also make a police report. Keep a dated folder of every Meta email, screenshot and invoice, because you will need it for the review and for the bank.
Meta decides whether a portfolio, Page or ad account is reinstated, and it may ask for verification first. A careful request, sent in the right order and as the right admin, gives the reviewer what they need. It cannot force the outcome, and some businesses do not get every asset back.
Getting help is safer when you are no longer an admin, when several assets are restricted at once, when a review has already been rejected, or when the business depends on the ads and Page to trade. Each extra rejected request makes the record harder to read, and fake helpers target business owners in this position.
If you are unsure about any step, or the portfolio matters to your income, having an experienced team handle the recovery order is the safer choice. AwareXone does this work. See our Business Manager recovery page.
A case review helps when you need a clear plan for which asset to recover first, or a second look at your review wording. We are a Malaysia-based team, independent of Meta, and we use only the official routes. We do not ask for your password or codes. Reply within 60 seconds, 24 hours a day, every day. We cannot promise a result. See our trust page.
More free guides on the same kind of problem.
