Meta Ads Account Hacked: What DTC Brands Should Do Immediately

When a Meta ads account is hacked, DTC brands need to act within hours to stop unauthorized spending, remove compromised access, secure all business assets, and begin the recovery process before the hackers can cause further damage or get the account disabled.

Last updated: February 2026

Table of Contents

Signs Your Meta Ads Account Has Been Hacked

Detecting a hack quickly minimizes damage. Watch for these warning signs:

Immediate red flags: Notification-based alerts: During business hours monitoring: Most hacks targeting high-spend DTC accounts happen during off-hours when the legitimate owner is less likely to notice. The attackers launch campaigns quickly, spend as much as possible before detection, then vanish. Setting up Meta's spending notification alerts and checking your account in the morning is a basic defensive measure.

Step 1: Pause All Campaigns Immediately

Before doing anything else, stop the bleeding.

How to pause all campaigns:
    • Open Meta Ads Manager
    • Click the checkbox at the top of your campaigns list to select all
    • Click the "Pause" button in the toolbar
    • Confirm the pause
If you can't access Ads Manager because your password has been changed, go to Step 2 first. Also: Check and remove any payment methods if possible If unauthorized charges are actively occurring, removing your payment method from the account stops further billing. You can do this in Business Settings > Billing > Payment Methods.

Step 2: Secure Your Personal Facebook Account

Meta Business Manager access is linked to personal Facebook accounts. If your personal account is compromised, your Business Manager is compromised.

Immediately:
    • Change your Facebook password to a strong, unique password you've never used elsewhere
    • Enable two-factor authentication if it's not already on (Settings & Privacy > Settings > Security and Login > Two-Factor Authentication)
    • Review and remove unknown active sessions (Settings > Security and Login > Where You're Logged In)
    • Check for unfamiliar apps with access to your Facebook account and remove them
If you can't access your Facebook account: Use Meta's account recovery flow: facebook.com/hacked or facebook.com/login/identify. Meta's account recovery process can verify your identity through document submission if your email and phone are also compromised.

Step 3: Review Business Manager Access

After securing your personal account, audit who has access to your Business Manager.

Review these access points: Remove any unfamiliar users, partners, or connected apps immediately. Note the account names and email addresses of unauthorized users; you'll need this for your Meta support report. Security note: Hackers often add their own accounts as admins before beginning unauthorized spending. Even after you remove them, check whether they made any other changes (like adding new payment methods or changing pixel configurations).

Step 4: Contact Meta Support

After securing your accounts, report the breach to Meta.

How to contact Meta support: What to include in your report: Meta's response timeline: Meta's support for hacked accounts is notoriously slow, often taking 1 to 5 business days for initial response. Do not wait for Meta support to secure your accounts and pause campaigns; do that immediately and then report.

Step 5: Dispute Unauthorized Charges

Unauthorized charges from a hacked account may be refundable through Meta and through your payment provider.

Through Meta: Submit a dispute through Business Manager > Billing > Billing History. Select the unauthorized transactions and file a dispute. Provide your hack report reference number from Meta support. Through your bank or credit card: Contact your bank or credit card issuer and report the unauthorized charges as fraud. Most financial institutions have strong consumer protection for this scenario and can initiate a chargeback within 24 to 48 hours. This is often faster and more reliable than waiting for Meta's dispute process. Important: Filing chargebacks through your bank can sometimes trigger Meta to restrict the associated payment method or account. If your Meta relationship is important to your business, consider starting with Meta's internal dispute process first, escalating to your bank if Meta doesn't resolve within 7 to 10 days.

Step 6: Assess the Damage

After securing and reporting, understand the full scope:

Financial damage: How much was spent without authorization? Which campaigns were run, to which destinations, at what spend? Account integrity damage: Did the hackers run policy-violating content (which can trigger account restrictions or disabling)? Check your Ad Account Quality score in Meta Business Manager. If unauthorized ads violated policies, you may need to appeal any resulting restrictions even though you weren't responsible. Business reputation damage: If the unauthorized ads ran with your brand's name or page association and contained misleading or inappropriate content, there may be audience trust implications. Monitor your page comments and direct messages for responses to unauthorized campaigns.

Step 7: Rebuild Security

Before resuming normal ad operations, implement these security measures:

Two-Factor Authentication (2FA): Enable 2FA on every personal account that has access to your Business Manager. Require 2FA for all employees with Business Manager access. Spending limits: Set daily and account spending limits in Meta Billing. If a hacker compromises your account again, spending limits cap the damage. Access audit cadence: Schedule a monthly review of all users with access to your Business Manager. Remove anyone who no longer needs access. Separate business and personal: If you manage personal Facebook separately from business, use a separate email address for your business Meta account. This limits the surface area of any personal account compromise affecting your business. Enable Meta's security alerts: Business Settings > Security Center has options for security notifications and two-factor authentication requirements for all business users.

How Hackers Target DTC Ad Accounts

Understanding attack vectors helps prevent recurrence:

Phishing emails: The most common attack vector. Fake emails that appear to be from Meta, warning of policy violations or account issues, directing users to a fake login page that captures credentials. Compromised employee accounts: If an employee with Business Manager access uses the same password across multiple platforms and that password is breached elsewhere, their Meta access is compromised. Malicious third-party apps: Facebook apps or browser extensions with excessive permissions can gain access to Business Manager credentials. Credential stuffing: Automated tools use previously leaked username/password combinations from other data breaches to attempt access to Meta accounts. Social engineering: Attackers posing as Meta support, agency partners, or collaborators request admin access to "fix" a fabricated problem.

Preventing Future Account Compromises

Password hygiene: Use unique, complex passwords for your Meta account. Use a password manager (1Password, Bitwarden) to generate and store these. 2FA on everything: Two-factor authentication means that even if your password is compromised, the attacker needs physical access to your phone or authenticator app to log in. Minimum necessary access: Give team members the minimum access level required for their role. Analysts don't need admin access. Restrict admin to 1 to 2 people maximum. Regular access audits: Review Business Manager users quarterly. Remove former employees immediately when they leave. Phishing awareness training: Train your team to recognize phishing emails. Meta will never ask for your password in an email. Any email directing you to log in at a non-facebook.com domain is phishing. Business Manager recovery contacts: Set up at least two admin users with different email accounts. If one account is compromised and locked, the other can recover the Business Manager.

FAQ

How quickly can hackers spend my Meta ad budget after a breach? Very quickly. Attackers targeting DTC ad accounts are typically automated or organized groups who run campaigns immediately after gaining access. DTC brands with high spending limits have lost $5,000 to $50,000+ in a single overnight attack. Speed of response is critical. Will Meta refund me for unauthorized charges? Meta's policy is to refund verified unauthorized charges. The process can take 1 to 4 weeks and requires documentation of the unauthorized activity. Your bank's chargeback process is often faster. Can unauthorized campaigns get my account permanently disabled? Yes. If hackers ran policy-violating content through your account (crypto scams, prohibited products), Meta may disable the account even though you were a victim. Appealing these restrictions requires documenting that you were hacked. This is why acting quickly matters. Should I report the hack to law enforcement? For significant financial losses (above $5,000), yes. File a report with your local police and potentially the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. This is useful for insurance claims and provides documentation if you need to escalate the dispute with Meta or your bank. How do I know if my account security has been fully restored? After completing all 7 steps: all known unauthorized users are removed, 2FA is enabled on all admin accounts, spending limits are set, all passwords have been changed, and no unauthorized campaigns remain active. Confirm with Meta support that no additional unauthorized access has been detected.