Business Manager Hacked, Ad Spend Stolen: What to Do

If a hacker takes over your Meta Business Manager (business portfolio) and runs ads on your card, do three things at once. First, stop the money by calling your card issuer to block the card and dispute the unauthorised charges. Second, recover the portfolio through Meta's hacked business portfolio recovery. Third, report it to your local fraud authority. Don't wait for Meta to refund you before contacting your bank. Bank protections, deadlines and evidence matter more for getting your money back.

#Step 1: Stop the spending (first 30 minutes)

• Call your card issuer and explain that a hacker is charging your card through your ad account without permission. Ask them to block the card and dispute the charges.
• If you can still access Ads Manager: pause or delete every campaign you didn't create, and remove unknown payment methods.
• Note the amounts and dates of every charge.

#Step 2: Recover access

1. Secure the admin's email and personal Facebook profile (facebook.com/hacked).
2. Use Meta's business portfolio recovery article: Recover a hacked or compromised business portfolio.
3. Contact Meta Business Support. Meta directs advertisers there (Meta Help Center).
4. Once you're back in: remove unknown people, partners, system users, apps and payment methods, then restore Page roles.

AwareXone's Business Manager hacked guide covers specific error messages and situations.

"After a Business Manager takeover, attackers usually add their own user, change Page roles, and start or hijack ads on saved cards. Meta's own guidance is to remove unknown people and update payment methods once you regain access. Call the card issuer as soon as unauthorised spend appears." - Md Shariar Shanaz Shuvon, Founder, AwareXone

#Step 3: Claim your money back

#Through your bank or card issuer

This is usually the most important route. Rules vary by country:

• UK: For unauthorised payments, the FCA says to tell your bank as soon as you notice, within 13 months, and that the refund should normally be in your account by the end of the next business day. Banks can refuse only in limited cases, such as if you authorised the payment, acted fraudulently, or failed to protect your card details or password in a way that allowed the payment (FCA). The underlying rules are in the Payment Services Regulations 2017 (reg. 76).
• Malaysia: For online financial fraud, call your bank's 24/7 hotline or NSRC 997 as soon as you discover it. MyGOV advises acting within 24 hours (MyGOV). Bank Negara Malaysia's policy document on unauthorised e-banking transactions (issued 28 June 2024) sets out how banks must handle these disputes (BNM).
• Australia: The ACSC says to report the transactions to your bank immediately and complete a ReportCyber report (cyber.gov.au).
• Singapore: Contact your bank. The ScamShield Helpline (1799) can direct scam victims to participating banks (ScamShield).

#Through Meta

Report the unauthorised ad activity to Meta through Business Support and keep the reference number. Meta's own refund decisions are separate from your bank's process, so don't rely on them alone.

#What evidence should I gather?

• Transaction receipts from Ads Manager billing (transaction IDs, dates, amounts)
• Campaign and ad IDs you didn't create
• Screenshots of unknown people or partners added to the portfolio
• Security emails showing email or password changes
• A timeline: when you noticed, when you called the bank, when you reported to Meta
• Your bank's dispute or reference number, plus the police or fraud report number

#Why do hackers target ad accounts?

An ad account with a payment method and good history is valuable. It can run scam or prohibited ads that a new account would struggle to get approved, at your expense. Ad accounts used this way can also be restricted afterwards. See restricted from advertising.

#How do I stop this happening again?

• Two-factor authentication for every person in the business portfolio
• At least two trusted admins, and remove unused accounts
• Spending limits on ad accounts
• A dedicated card with a low limit for ads
• Train staff to ignore fake "Meta policy violation" emails and DMs
• Review partners and agencies every quarter

See the business social account protection checklist.

#When should I get professional help?

If you can't regain the portfolio, several ad accounts are involved, or the account has been restricted after the hack. SocialSafe by AwareXone (the publisher) handles Business Manager recovery through official channels: no passwords or OTPs, no promises, cases from the quoted fee in Malaysia, and clients outside Malaysia are quoted and billed in USD, with the fee confirmed after case review. We don't recover money or unfreeze bank accounts. That's for your bank and the authorities. See how a case review works on the SocialSafe by AwareXone Business Manager recovery page, or check pricing and the Trust Center.

#What if the hacker also changed the Page name or deleted content?

Once you have admin access again, restore Page details, check posts for scam content, and review Page roles. AwareXone's Facebook Page back after a hack checklist covers this. If customers were contacted by the hacker, warn them through other channels.

#What if my ad account was restricted after the hack?

Ad accounts used for scam ads can be restricted. After you regain access and remove the attacker, request a review of the restriction through Meta's official process and explain the compromise. See ad account disabled and business portfolio restricted from advertising.

"The most useful evidence is a clear timeline: when you lost access, which security emails the platform sent, which admins or payment methods you don't recognise, and proof of who legitimately owns the business. Keep every notification email; don't delete them." - Md Shariar Shanaz Shuvon, Founder, AwareXone

#A 10-step checklist

1. Call your card issuer and block the card.
2. Pause unknown campaigns (if you still have access).
3. Secure the admin's email.
4. Recover the admin's personal profile.
5. Follow Meta's business portfolio recovery.
6. Remove unknown people, partners and system users.
7. Remove unknown payment methods.
8. Report to Meta Business Support and keep the reference.
9. Report to the police or national fraud service.
10. Turn on 2FA for everyone and set spending limits.

#Bottom line

Money first, access second, prevention third. Your bank is usually your best route to a refund. Meta's processes are your route back into the account.