# TikTok Business Account Hacked? Recover Ads and Access > TikTok business account or Business Center hacked in Malaysia? Contact TikTok for Business support, stop ad charges, call your bank and avoid fake support. - URL: https://www.awarexone.com/research/tiktok-business-account-hacked - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-05 - Topics: TikTok, Account recovery, Malaysia - Related service: Business and creator recovery: https://www.awarexone.com/services/business-creator-recovery ## Short answer Call your card issuer about any ad charges you did not authorise, then contact TikTok for Business support or your account manager and say the account is compromised. TikTok says it suspends a compromised Business Center, investigates and processes reimbursements for unauthorised charges. Recover the TikTok app account separately through the app, using only official routes. ## Summary - A TikTok business can lose three things separately: the TikTok app account, the Business Center that holds members and assets, and the ad accounts that can be charged. - If ads you did not create are running, call your card issuer about the charges and contact TikTok for Business support straight away, or your account manager if you have one. - TikTok says it suspends a compromised Business Center to secure it, investigates, tells you how to regain control and processes reimbursements for unauthorised charges. - Use only TikTok's official routes: Ad Assistant when you can log in, the Feedback and Help form when you cannot, and the app's own recovery steps for the TikTok account. - Nobody genuine asks for your password, login codes or backup codes, so treat any "TikTok Business Support" message or recovery agent that does as a scam. - TikTok makes the final decision, the Business Center password reset needs the original email or phone, and some accounts are not handed back. Your card statement shows TikTok ad charges nobody on your team approved. Or you open TikTok Business Center and your login fails, a stranger is listed as an admin, or your shop's TikTok profile is posting things you never wrote. Move fast on two fronts: stop the money and tell TikTok. Call your card issuer about the charges, then contact TikTok for Business support (or your account manager) and say the account is compromised. Then work out which part of your TikTok setup was taken, because each part has its own way back. This guide is for businesses, agencies and sellers. If only a personal TikTok login was taken, our guide to a [TikTok hack where the email was changed](https://www.awarexone.com/research/tiktok-account-hacked-email-changed) fits better. Last checked: 5 October 2026. ## What Should You Do If Your TikTok Business Account Is Hacked? Contact your bank or card issuer about any ad charges you did not authorise, then report the compromise to TikTok. TikTok's [Business Center security page](https://ads.tiktok.com/help/article/best-practices-for-securing-your-business-center?lang=en) says managed clients should contact their account manager immediately and everyone else should contact customer support immediately. If you can still log in, use the Ad Assistant in Ads Manager or Business Center; if you cannot, use the Feedback and Help form. TikTok says it will suspend a compromised account to secure it, investigate, tell you how to regain control and process reimbursements for unauthorised charges. Recover the TikTok app account separately through the app. In Malaysia, call 997 if money was lost to a scam or a code was shared. ## The Three Layers a TikTok Business Can Lose Most small businesses think of "the TikTok account" as one thing. In practice there are three, and an attacker can hold one while you still hold the others. *How the parts of a TikTok business setup relate, based on TikTok's Business Help Center at the time of writing. Feature names vary by region and account type.* | Layer | What it controls | How you get back in | | --- | --- | --- | | TikTok app account (a Business Account or a Verified Business Account) | Your profile, videos, followers and messages | The TikTok app's own login and recovery steps, and TikTok user support | | TikTok Business Center | Members, partners, ad accounts, TikTok accounts assigned to it, pixels, catalogues and payment settings | Business Center password reset with the original email or phone, then TikTok for Business support | | Ads Manager ad accounts | Campaigns, budgets and the card or balance that pays for them | Business Center admin access, or TikTok for Business support if the ad account was suspended | TikTok describes Business Center as granting full control over your business on TikTok, including modifying or deleting the business and adding or removing people from the member list. Its [roles and permissions page](https://ads.tiktok.com/help/article/about-business-center-roles-and-permissions?lang=en) says Admins have full access to all system functions, while Standard members work only on the accounts and assets they are given. TikTok's 2-step verification page adds that only Admins can turn that protection on. An attacker with an Admin seat can lock out everyone else, which is why a rogue admin is the most urgent sign. ## Which Situation Are You In? *Common signs after a TikTok business takeover and where to start. Notice wording varies by app version, region and account type.* | What you see | What it usually means | First move | | --- | --- | --- | | Ad charges or campaigns you did not create | Someone has access to an ad account or the Business Center paying for it | Call your card issuer, then contact TikTok for Business support | | A member or partner you do not know in Business Center, and you are still an Admin | Access was granted to someone who should not have it | Remove them, change your password and turn on 2-step verification for all members | | Your Business Center password no longer works | The password was changed, possibly with your email or phone | Try Forgot password with the original email or phone, then the Feedback and Help form | | "Your account has been suspended" in Ads Manager | The ad account was suspended, possibly after the attacker's ads broke policy or to stop further misuse | Report the compromise to support and explain the ads were not yours | | The TikTok profile has a new username, posts or messages you did not write | The app account itself was taken | Follow TikTok's hacked account steps in the app | ## First Hour Runbook 1. Phone your card issuer or bank. Tell them about the TikTok ad charges you did not authorise and ask about blocking the card linked to the ad account. 2. Check your own email inbox and phone line. Whoever controls the inbox tied to Business Center can reset it again. Change that email password and sign out other sessions. 3. If you can still log in to Business Center as an Admin, remove members, partners and pending invitations you do not recognise, and pause campaigns you did not create. 4. Contact TikTok for Business support (or your account manager) and say the account is compromised. Keep the ticket reference. 5. Separately, secure or recover the TikTok app account using the steps below. 6. Write down a timeline: when you last had normal access, what changed and when the first unknown charge appeared. ## Getting Back Into the TikTok App Account The app account follows TikTok's consumer recovery steps, not the Business Help Center. TikTok's [hacked account page](https://support.tiktok.com/en/log-in-troubleshoot/log-in/my-account-has-been-hacked) lists the signs: a changed password or phone number, a changed username or nickname, videos deleted or posted without your permission, and messages you did not write. If you are still logged in, it advises three steps under Profile, the Menu button, then Settings and privacy: 1. Account, then Password: change the password. 2. Account, then Account Information, then Phone number: link your own phone number. 3. Security & permissions, then Manage devices: remove unwanted or suspicious devices. If you are logged out and the attacker changed the email or phone, work through the login screen's "Forgot password?" option and TikTok's [Report a problem form](https://www.tiktok.com/legal/report/feedback) under "Account access / security". Our [TikTok email changed guide](https://www.awarexone.com/research/tiktok-account-hacked-email-changed) walks through friend verification and the identity form in order. ## Getting Back Into TikTok Business Center TikTok's [Business Center password reset page](https://ads.tiktok.com/help/article/troubleshoot-tiktok-business-center-account-access?lang=en) sets out the steps: go to Business Center, click Log in, then Forgot password, enter the email or phone number you used to set it up, and enter the verification code it sends. A 2-step verification prompt then appears. > Note: **The original email or phone is the key.** TikTok says that if you do not have access to the email or phone number connected to your Business Center account, you will not be able to reset your password, and that this is a security measure. If the attacker changed those details, support is the remaining route. If another Admin on your team still has access, they can act straight away: remove the rogue member, check partners, and review which ad accounts and TikTok accounts are assigned to whom. This is the main reason TikTok recommends at least two Business Center Admins. ## Ads Manager: Stopping the Spend and Reporting the Charges TikTok's [guidance on securing a TikTok for Business account](https://ads.tiktok.com/help/article/protect-account-tiktok-for-business?lang=en) repeats the same promise as the Business Center page: TikTok will suspend a compromised account, notify you after its investigation about how to regain control, and process reimbursements for charges that resulted from unauthorised activity. TikTok decides what counts as unauthorised, so report it early and keep your evidence. If the ad account shows a suspension, TikTok's [page on suspended ad accounts](https://ads.tiktok.com/help/article/account-suspensions?lang=en) says all ads under it are stopped and most settings are locked, and that a temporary suspension can become permanent if the issues remain or the appeal is rejected, so do not wait. Its [troubleshooting page](https://ads.tiktok.com/help/article/how-to-troubleshoot-a-suspended-ad-account-on-tiktok?lang=en) says appeals go through Ad Assistant, under Account/Ad Review, then Account Review, then Account Suspension Appeal, that you should file one appeal per incident and that you should avoid creating new ad accounts while the appeal is reviewed. Say clearly that the account was compromised and the ads were not yours. ## How to Contact TikTok for Business Support TikTok's [contact page](https://ads.tiktok.com/help/article/contact-tiktok-business-support?lang=en) gives two routes, depending on whether you can log in: - Logged in: open TikTok Ads Manager, Business Center or the Business Help Center, click the blue circular Ad Assistant icon at the lower right, then Get support. Pick a topic, describe the issue and submit. Manage Tickets shows the status of existing requests. - Locked out: TikTok says you must be logged in to reach Ad Assistant, so it points people with a login issue to the Feedback and Help contact form. - Managed clients: contact your TikTok account manager as well. - App account problems: TikTok's contact page sends user login and app issues to TikTok user support rather than Business support. The same page says that in certain cases you may receive support and onboarding messages from TikTok representatives and partners under these domains: @bytedance.com, @advertiser.tiktok.com, no-reply@business-support.tiktok.com and @c.tiktok.com. A message from a lookalike domain, a Gmail address or a social media DM is a red flag. Even a real-looking sender is no reason to hand over a code. For a wider look at real contact routes, see our guide to [how to reach TikTok support from Malaysia](https://www.awarexone.com/research/tiktok-support-contact-malaysia). ## Fake "TikTok Business Support" Messages and Recovery Scams Many business takeovers start with a message dressed up as TikTok: an urgent "ad account suspended" warning, a fake policy violation, or a partnership offer with a login link. After a hack, a second wave arrives: comments and DMs from "recovery agents" who say they can get the Business Center back. Watch for these signs: - They ask for your password, a login or verification code, or backup codes. - They want you to log in through a link they send rather than going to ads.tiktok.com yourself. - They ask to be added as a Business Center member or partner "to fix it". - They promise a result, a deadline, or "inside contacts" at TikTok. - They want payment by crypto, gift card or transfer to a personal account. > Warning: **What not to do.** Do not share passwords or codes with anyone, including people who claim to be TikTok. Do not buy aged ad accounts or set up a new Business Center to get around a suspension. Do not pay anyone offering to hack the account back. Legitimate help works only through TikTok's own forms and support, never asks for login details, and cannot force TikTok's decision. ## If Money Was Lost in Malaysia Unknown ad charges are first a matter for your bank and TikTok. If money was also lost to a scam (for example, you paid a fake support agent or a code was shared and funds moved), the government's [NSRC 997 hotline page](https://www.malaysia.gov.my/en/categories/safety-and-community/cybersecurity/nsrc-997-hotline) says to call 997 within 24 hours of discovering the scam so authorities can try to block the money, contact the relevant bank and lodge a police report at the nearest police station. To report the intrusion as a computer security incident, CyberSecurity Malaysia's [Cyber999 centre](https://www.cybersecurity.my/portal-main/services/cyber999-overview) acts as the national point of contact for reporting such incidents. A police report also helps if your bank or insurer asks for one. ## Evidence to Collect for TikTok Support A clear, consistent report is easier for TikTok to check. Gather these before you write: - Your Business Center ID, ad account IDs and TikTok username. - The email and phone number originally used to set up Business Center. - Screenshots of the member list, partners and invitations, showing any unknown entries. - Screenshots of campaigns, ads and charges you did not create, with dates and amounts visible. - Bank or card statements showing the unauthorised charges, and your bank's case reference. - Security emails you received (password changed, new member added), with dates and times. - Your timeline, the support ticket references and any police or Cyber999 report numbers. ## Lock Down Business Center Once You Are Back TikTok's Business Center security page lists the controls that would have made the takeover harder. Set them up the same day: - Keep at least two Business Center Admins, both people inside your company, so one lost login does not lock out the business. - Turn on 2-step verification for all members, not only admins. TikTok's [2-step verification page](https://ads.tiktok.com/help/article/2-step-verification-business-center?lang=en) puts it under Business Settings, then Settings, then the Security section. - Add an email domain allowlist so only addresses on your company domain can be added. TikTok's [allowlist guide](https://ads.tiktok.com/help/article/how-to-create-an-email-allowlist?lang=en) uses the same Security section. - Give each person the minimum role they need, and remove inactive users. - Review members, partners and invitations regularly, and remove anything you cannot account for. - Use a unique password for every admin, never shared between coworkers. For a routine that covers TikTok alongside Meta and other platforms, use our [business social account protection checklist](https://www.awarexone.com/research/protect-business-social-accounts-checklist). > Note: **TikTok makes the final decision.** Only TikTok can restore access to a Business Center, an ad account or a TikTok account, and only TikTok decides which charges it reimburses. Some accounts are restored, some take a long time, and some are not handed back. Nobody outside TikTok can promise otherwise. ## When a Case Review Makes Sense The steps above are often enough to act alone. A second look helps when the attacker holds the original email or phone, when the app account and Business Center were both taken, when an ad account suspension followed the hack, or when tickets have gone round in circles. SocialSafe by AwareXone, our recovery service, reviews the case first and tells you honestly which official route is still open, if any. We work only through TikTok's own forms and support, and we never ask for passwords, login codes or backup codes. See how [business and creator recovery](https://www.awarexone.com/services/business-creator-recovery) works, and read our [Trust Center](https://www.awarexone.com/trust) for what we will not do. ## Frequently Asked Questions ### Will TikTok refund ad charges made by a hacker? TikTok says that after investigating a compromised account it processes reimbursements for charges that resulted from unauthorised activity. TikTok decides what qualifies, so report it quickly and contact your card issuer as well. ### Can I reset my TikTok Business Center password without the original email? Not through the reset page. TikTok says you cannot reset the password without access to the email or phone number connected to the account, so contact TikTok for Business support through the Feedback and Help form instead. ### Is an email from TikTok Business Support real? TikTok lists @bytedance.com, @advertiser.tiktok.com, no-reply@business-support.tiktok.com and @c.tiktok.com as domains its representatives may use. Even then, never share a password or code, and log in by typing ads.tiktok.com yourself. ### Should I open a new Business Center if mine was suspended after a hack? No. TikTok advises against creating new ad accounts while a suspension appeal is reviewed. Report the compromise and appeal through support instead. ### Akaun TikTok bisnes atau Business Center kena hack, apa perlu buat? Hubungi bank anda tentang caj iklan yang tidak dibenarkan, kemudian laporkan kepada sokongan TikTok for Business melalui Ad Assistant atau borang Feedback and Help. Jangan berikan kata laluan atau kod kepada sesiapa. ### TikTok 企业号被盗，广告被乱投怎么办？ 先联系发卡银行处理未经授权的扣款，再通过 Ad Assistant 或 Feedback and Help 表单联系 TikTok for Business 客服说明账号被盗。不要把密码或验证码交给任何人。 ## Official sources - [TikTok Business Help Center: Best practices for securing your Business Center (read 5 October 2026)](https://ads.tiktok.com/help/article/best-practices-for-securing-your-business-center?lang=en) - [TikTok Business Help Center: Best practices for securing your TikTok for Business account (read 5 October 2026)](https://ads.tiktok.com/help/article/protect-account-tiktok-for-business?lang=en) - [TikTok Business Help Center: How to contact TikTok for Business customer support (read 5 October 2026)](https://ads.tiktok.com/help/article/contact-tiktok-business-support?lang=en) - [TikTok Business Help Center: How to reset Business Center password (read 5 October 2026)](https://ads.tiktok.com/help/article/troubleshoot-tiktok-business-center-account-access?lang=en) - [TikTok Business Help Center: About Business Center roles and permissions (read 5 October 2026)](https://ads.tiktok.com/help/article/about-business-center-roles-and-permissions?lang=en) - [TikTok Business Help Center: How to turn on 2-Step Verification for Business Center (read 5 October 2026)](https://ads.tiktok.com/help/article/2-step-verification-business-center?lang=en) - [TikTok Business Help Center: How to create an email domain allowlist (read 5 October 2026)](https://ads.tiktok.com/help/article/how-to-create-an-email-allowlist?lang=en) - [TikTok Business Help Center: About suspended ad accounts on TikTok (read 5 October 2026)](https://ads.tiktok.com/help/article/account-suspensions?lang=en) - [TikTok Business Help Center: How to troubleshoot a suspended ad account (read 5 October 2026)](https://ads.tiktok.com/help/article/how-to-troubleshoot-a-suspended-ad-account-on-tiktok?lang=en) - [TikTok Help Center: My account has been hacked (read 5 October 2026)](https://support.tiktok.com/en/log-in-troubleshoot/log-in/my-account-has-been-hacked) - [TikTok: Report a problem online form (read 5 October 2026)](https://www.tiktok.com/legal/report/feedback) - [MyGOV Malaysia: NSRC 997 Hotline (read 5 October 2026)](https://www.malaysia.gov.my/en/categories/safety-and-community/cybersecurity/nsrc-997-hotline) - [CyberSecurity Malaysia: Cyber999 Cyber Incident Response Center (read 5 October 2026)](https://www.cybersecurity.my/portal-main/services/cyber999-overview) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.