An unlocked combination padlock standing on a computer keyboard in blue light.

Account access

Our Meta business portfolio was hacked and someone ran ads on our card. How do we get it back and get refunded?

By The Tofu team ·

Report each charge to Meta's payment support, in Billing & payments, within 30 days: its payments terms say you waive claims over an unauthorized charge after that, as far as the law allows. First secure each admin's Facebook profile at facebook.com/hacked, then remove people and partners you don't know and turn off the intruder's ads. If no one at your company still has full control, ask Meta for it in Business Support Home's "Business Manager admin dispute" chat. Meta doesn't publish how it decides refunds for hacked ad spend.

Ask Tofu next

Pick a question and Tofu Ads Agent answers it in chat.

As of October 2026.

Restricted rather than hacked? See why Meta restricts an ad account after you verify it. Google Ads hacked too? See how to recover a hacked Google Ads account.

How do I stop the spending right now?

Turn off every campaign you didn't create in Ads Manager, then cap the account. An ad account spending limit is a lifetime cap you set in Payment settings (not on prepaid accounts that use available funds), and Meta says your ads pause when spending reaches it. If you still have full control:

  • Remove unknown people: Settings in Meta Business Suite > People > click the name > Remove.
  • Remove unknown partners: Settings > Partners > Options > Remove from business portfolio.
  • Remove unknown users from an ad account: Ad account settings in Ads Manager > Ad account roles > Remove user.

Blocking the card with your bank also stops spend, but Meta says a failed payment pauses your ads and disables the ad account until you pay the amount due.

How do we get the business portfolio back if the hacker removed us?

If a colleague still has full control, they can remove the intruder. If no one does, ask Meta for full control. Its list of eligible cases doesn't name a hack, but it includes "No one has full control of the business portfolio" and a court order showing you own the business.

You need three documents, in PDF, JPEG or PNG:

  1. A passport, government ID or driver's license for the person asking.
  2. Proof you own the business, such as articles of incorporation, a business license, a tax certificate or a bank statement. Meta also accepts the amounts from 3 past invoices of an ad account in the portfolio plus the last 4 digits and expiry date of the linked card.
  3. A signed attestation letter on your letterhead. Meta lists what it must include, such as the business portfolio ID, your Facebook profile URL, user ID and email, and why you need full control.

Then go to Business Support Home, contact support, start a chat and choose Business Manager admin dispute. If Meta approves, you get full control, but it says "existing people will not be removed," so remove the intruder yourself.

How do we see exactly what the hacker did?

Download your business history: Settings > People > Export > Business history, pick dates, then Create export file. It logs actions such as people added, roles changed and partners given access to assets, with the user behind each one. You need full control to export it.

For the money, open Payment activity in Billing & payments and click each Transaction ID; the receipt shows the amount, date, payment method and which ads it paid for.

Not every change is the hacker's: Meta says that to recover an account showing suspicious activity, it may remove admins, pause ads or change payment methods.

How do we report the charges and ask for a refund?

Use payment support: if you believe someone hacked your ad account, Meta's unrecognized-activity page says "please let us know," linking to payment support in Billing & payments. For suspicious activity in the portfolio, Meta's security page links to Business Support Home.

Don't wait. Meta's Community Payments Terms (updated July 30, 2026) say to notify Meta immediately and that, unless you submit the claim within 30 days after the charge, you waive your claims "to the fullest extent permitted by law." The terms leave that 30-day line out for consumers and small businesses in Australia. Send transaction IDs, the campaigns you didn't create and your business history file.

Will Meta refund the money?

It may, but Meta publishes no rules or timeline for refunding ad charges from a hacked account. Its payments terms say a refund Meta owes may go back to the card you paid with, and that Meta can decline refund requests or give ad credit instead. Don't rely on the Payment Protection Policy you may find in searches: it gives 120 calendar days to file a claim, but covers only Onsite Checkout (US and UK), WhatsApp Payments to Merchants (Brazil) and Instagram Payments to Merchants (US), not ads.

Should we dispute the charges with our bank instead?

Report to Meta first. Meta's payments terms make you responsible for chargebacks and their fees, and Meta lists high rates of "disputed payments" among reasons it may restrict advertising. If your bank's deadline is close, decide with your finance team; Meta doesn't say how it treats a dispute over hacked spend.

Our ad account was restricted after the hack. What now?

Meta says it may restrict advertising when it suspects a portfolio or its assets were hacked. While it investigates unusual activity, it may limit spending and payment features and block adding admins, partners or users or creating ad accounts. Go to Business Support Home and follow the actions it lists for the restricted account.

We can't reach anyone at Meta. What else can we try?

Meta Verified for businesses, a paid subscription, adds chat and email support on every plan and phone call requests from support agents on higher plans. It requires Advanced Protection on the business portfolio.

Ignore anyone who offers to recover the account for you. Meta says its staff never ask for your password or payment details, and its emails come only from its own domains, such as facebookmail.com and meta.com. Report phishing to [email protected].

How do we stop it happening again?

ControlWhat it doesWhere
Two-factor authenticationRequired in portfolios 90 days or older; Meta recommends requiring it for everyone and removing people with neither it nor a passkeySettings > Security Center
Two people with full controlA second approval for sensitive actions, such as changing someone's full controlSettings > Security Center
Peer approvalA trusted person must approve ads, such as any ad over a budget you set. Ads published by people with full control skip itSecurity Center > Peer approval
CleanupRemove people inactive for 90 days or on public email domains; keep full control to 10 people or fewer; close ad accounts with no ads in the last yearSecurity Center recommendations

Give an agency its own partner access instead of a shared login; see how to give an agency access to your Meta ad account.

Sources

Related answers

More on

Let an agent build your next campaign.

Tofu Ads Agent reads your CRM, plans the funnel, builds the audience and creative, and stages full campaigns across LinkedIn, Google and Meta for your approval.

Try it free Get a demo