Short answer
Secure your own Facebook profile first, because hackers usually get into a Business Manager through a person's account. Then remove anyone you don't know, pause ads you didn't create, call your bank about the charges, and report the hack to Meta through the Meta Business Help Center.
Meta now calls a Business Manager a “business portfolio”. Most people still say Business Manager, so we do too. This guide is for business owners, advertisers and agencies who just found strangers in their business or ads they didn't create.
Signs your Business Manager was hacked
You may see one or more of these:
- People or partners you don't know in your business settings.
- Ads you didn't create, often with a big daily budget or a new payment method.
- Emails from Meta about a new admin, a changed email address or a new login.
- You were removed as an admin, or you can't open the business at all.
- Charges from Meta on your card that you don't recognize.
How hackers usually get in
Most Business Manager hacks start with one person's Facebook account, not the business itself. Hackers send fake files or links, often dressed up as an ad brief, a job offer or a message from Meta. When someone opens them, malware can steal the login saved in their browser.
In 2022, security researchers at WithSecure described one campaign like this, called DUCKTAIL. It went after people who manage Facebook business and ad accounts, stole their browser session cookies, and added the attacker's email address to the business. A stolen session cookie can let a hacker in without your password, so a strong password alone isn't enough. That's why the steps below include logging out everywhere and checking your computer.
What to do, step by step
Secure your personal Facebook account
A Business Manager is run through people's personal profiles, so start there. Change your password. In Accounts Center, open Password and security, then “Where you're logged in”, and log out of anything you don't recognize. Turn on two-factor login with an authenticator app. If you can't log in at all, go to facebook.com/hacked.
Secure the email account behind your Facebook login too. If a hacker controls that email, they can take your account back.
Ask another admin to help
If someone else still has full control of the business, they can remove the hacker and give your access back. This is often the fastest way out, so call them before anything else.
Remove people and partners you don't know
Open your business settings in Meta Business Suite and look at People and Partners. Remove anyone you don't recognize. Then check who has access to each ad account, Facebook Page and Instagram account in the business.
Stop the ad spending
Open Ads Manager and look for campaigns you didn't create. Take screenshots that show the dates and amounts, then turn those ads off. Check the payment methods on each ad account and remove any you don't recognize.
Call your bank or card company
Tell them about any charges you didn't make, and ask how long you have to dispute them. If the hacker might still be able to use the card, ask the bank to block it and send a new one.
Report it to Meta
Go to the Meta Business Help Center and choose the options for a hacked or compromised account. Meta's help pages say charges on an ad account that you don't recognize are handled there too. If you advertise, you may also be able to reach Meta's business support team from the same place.
Check your computer for malware
If the hacker used a stolen browser session, a new password won't stop them on its own. Run a trusted antivirus scan on every computer that logs in to the business, then log out of all sessions again. WithSecure's advice after DUCKTAIL was the same: end all browser sessions, reset logins and remove unknown users.
Keep a record
Save screenshots of unknown people, ads and charges, and keep every email from Meta. Write down the dates. This helps with appeals, refunds and your bank.
Lock it down for next time
In your business settings, open Security Center and require two-factor login for everyone. Keep at least two trusted people with full control, so if one of you is locked out, the other can still act. Be careful with files from strangers, even when they look like an ad brief or a job offer.
Watch out for “recovery experts” in your DMs
After a hack, strangers often message you offering a quick fix. Real Meta staff won't DM you offering help. Never share your password or login codes in a DM or with anyone who contacted you first, and never pay in crypto or gift cards. We never ask for logins by DM or email.
Once you're back in
Hackers often change small things so they can come back later. Before you relax, check these:
- The business email and contact details in your business info. Change them back if they were edited.
- The payment methods on every ad account. Setting an account spending limit in Ads Manager caps the damage if it ever happens again.
- Partners and apps that have access to the business. Remove anything you don't use or don't recognize.
- Each Facebook Page and Instagram account in the business. Make sure they're still connected and still yours.
- Your team. Tell everyone what happened, and ask anyone who opened a strange file to scan their computer.
Where to get help, and what it costs
| Route | Cost | Best for |
|---|---|---|
| Another admin in your business | Free | The fastest fix, when someone still has full control |
| facebook.com/hacked | Free | Getting back into your personal Facebook account |
| Meta Business Help Center | Free | Reporting the hacked business and ad charges you don't recognize |
| Your bank or card company | Free | Disputing charges you didn't make and blocking the card |
| Paid help, like Lockout Desk | $4,000–6,000 total for Business Manager cases. Half is paid only after you're back in. | Big or complicated cases, or when the free routes have stalled |
Questions people ask
How did they get in if my password was strong?
Often through a fake file or link that stole a logged-in browser session, not through the password itself. That's why you should log out everywhere, scan for malware and turn on two-factor login.
Can I get back money the hacker spent on ads?
Sometimes. Report the charges to Meta through the Business Help Center and to your bank as soon as you can, with screenshots of the ads, the amounts and the dates. Neither one can promise a refund.
The hacker removed me as an admin. Is it too late?
Not necessarily. Secure your personal account first. Then ask any other admin to restore you, or report it through the Meta Business Help Center. Meta may ask for documents that prove the business is yours, like a utility bill, a tax filing or a business license. It doesn't accept domain records or website screenshots as proof.
Should I just make a new Business Manager?
Not yet. A new one starts empty, without your Pages, ad accounts or history. Try to get the original back first.
Meta restricted my Business Manager after the hack. What now?
Strange activity, like ads the hacker ran, can lead Meta to restrict a business. Check the reason in Business Support Home at facebook.com/accountquality and ask for a review once, with the facts of what happened.
Will Meta call me to help?
Don't wait for a call. Start from Meta's own help pages. Anyone who messages you first offering to fix it is almost certainly a scammer.
Stuck on a step?
Send us a free case check. Within 24 hours, we'll tell you honestly if we can help and what it would cost. If we take your case, you pay half only after you're back in. We never ask for logins by DM or email.
Sources: Meta Business Help Center (facebook.com/business/help); Meta Accounts Center help pages; Meta Help Center: Report an unauthorized Meta Pay charge (meta.com/help/meta-pay/455686176601449), which sends ad account charges to the Business Help Center; WithSecure Labs: DUCKTAIL, an infostealer malware targeting Facebook Business accounts (2022, labs.withsecure.com/publications/ducktail); Meta Help Center: What type of business documents does Facebook accept to prove that I'm the owner? (facebook.com/help/287728524907292).
This guide is general information. Meta changes its menus often, so the names in your app may be slightly different.
Feeling hopeless? You're not alone. In the US, call or text 988. In the UK, call Samaritans on 116 123. Both are free, any time.