The short answer: the first five steps
- 1. Stop the costs. Pause campaigns if you still have access, and contact your bank or card issuer about unknown charges.
- 2. Secure the personal accounts. Change the passwords of your Facebook profile and your email, log out everywhere and turn on two-factor authentication.
- 3. Clean up the portfolio. Remove unknown people, partners and payment methods, and check which ad accounts and pages are still there.
- 4. Recover through Meta itself. Start at facebook.com/hacked, preferably from a device you've used for Facebook before, then go through Meta Business support.
- 5. Document everything. Portfolio ID, ad account IDs, screenshots of unknown admins and spend, invoices and a timeline. You'll need it for Meta and for your bank.
How it usually goes wrong
A business portfolio is rarely cracked "directly". The attacker almost always gets in through a person with access:
- A hijacked personal profile. An admin gives access to the whole portfolio through their own Facebook account. If that profile is taken over, so is the portfolio.
- Phishing. Fake messages from "Meta Support" about a policy violation or a blocked account, with a link to a fake login page.
- Fake ads and browser extensions. Researchers have seen campaigns posing as Meta Ads Manager that get business owners to install a malicious browser extension (TechRadar).
- Forgotten access. Former employees, freelancers or agencies who are still admins, with accounts you no longer control.
First aid, step by step
Step 1: limit the damage
If you can still get into your ad account, pause any campaigns you don't recognise and lower or stop the budget. Contact your bank or card issuer straight away about unknown charges and ask what evidence they need. Only block or replace the payment method once you know what the bank expects.
Step 2: secure who has access
Start with the personal accounts, because that's where the key is. Change the password of your email (otherwise an attacker can reset everything) and of your Facebook profile, log out on all devices, turn on two-factor authentication and remove apps or extensions you don't recognise. Ask other admins to do the same.
Step 3: clean up the portfolio
Check in your business settings who has access: people, partners, ad accounts, pages and payment methods. Remove anything you don't recognise, and note what you see before you remove it.
Step 4: recover through the official channels
Use facebook.com/hacked for a hacked profile, and Meta Business support for ad accounts and portfolios. Beware of anyone offering unsolicited help in comments or messages: so-called "recovery services" are a well-known follow-up scam.
Don't count on a quick recovery. Marketers describe that getting a hijacked business account back from Meta can take a long time, sometimes months, and that not everything always comes back (NE Times). That's why prevention is worth so much more than cure.
A typical scenario (for illustration)
A composite example, not a specific client case.
A marketing employee receives a message saying the company page will be removed over a copyright complaint, "unless you appeal within 24 hours". The link leads to a page that looks like Meta. After logging in, the attacker takes over the personal profile, adds their own admin to the portfolio and runs campaigns overnight on the linked credit card. Only the next morning does the company see the spend. Two-factor authentication with a passkey and a second, well-secured admin would almost certainly have stopped this, or contained it quickly.
How to prevent it
This is where a security perspective makes the difference. Most measures take an afternoon and prevent months of misery.
- Require two-factor authentication for everyone. Meta already requires it for business portfolios that are 90 days or older and recommends making it a requirement for everyone with access (Meta Business Help). For accounts in portfolios that advertise, Meta also asks for Advanced Protection: two-factor authentication or a passkey (Meta Help).
- Give agencies access as a partner, not as a person. Share ad accounts, pages and datasets with your agency's portfolio, and keep ownership yourself. That way nobody from outside needs to be an admin of your portfolio, and you can revoke access in one click.
- As few admins as possible, but never one. Two or three well-secured admins, everyone else with limited roles. One admin is a risk if that person drops out; ten admins is ten times the chance of a leak.
- Clean up regularly. Check who has access every quarter, use the Security Center in your business settings (Meta Business Help), and remove people as soon as they leave.
- Never log in through a link in a message. Genuine notifications from Meta also show up in Meta Business Suite itself. If you're unsure about a request from a colleague or agency, check it through another channel, like a phone call.
- Keep your browser clean. No unknown extensions, and ideally a separate browser profile for your ad accounts.
Why we pay so much attention to this
SASDAMX was founded by a cybersecurity specialist. When we work for a client, we ask for partner access, with two-factor authentication, and leave ownership of accounts and data with the client. Not because we have to, but because a hacked ad account can undo all the good creative and measurement in a single night.