My Facebook account got hacked and is running ads I didn't create — what do I do first?

Act in this order: stop the spend (pause every unknown campaign if you still have access), remove or block the attacker's payment method, change your Facebook password (and your email password if reused), log out all unknown sessions in Security settings, and turn on two-factor authentication. If you're fully locked out, go to facebook.com/hacked and follow Meta's identity-confirmation recovery flow. Speed matters because charges are accruing in real time.

How do I lock a hacker out of my Meta ad account for good?

Changing your password isn't enough. In Business Settings, remove every user, partner, and admin you don't recognize; delete any payment method you didn't add; check whether your page or ad account was moved into a Business Manager you don't own; reset the recovery email and phone on file to your own; and revoke unfamiliar connected apps. One leftover admin can undo everything, so sweep thoroughly.

How do I report the hack and stop the fraudulent ad spend?

Report the compromise through facebook.com/hacked, Meta's official recovery path, and report the unauthorized ads and charges via Account Quality or Business Support Home, stating clearly that the account was compromised. Screenshot the rogue ads, charges, dates, and any unknown users you removed. Meta may temporarily restrict the account while it investigates, which is normal for a compromise.

Can I get a refund for ads a hacker ran on my account?

Possibly, but there is no guarantee. Report the charges as unauthorized to Meta, which may credit unauthorized spend after a case-by-case review, and separately dispute the charges as fraud with your bank or card issuer, which is often the more reliable route. File both promptly. Anyone offering to recover your hacked spend for a fee is almost always a scam.

How do I stop my Facebook ad account from getting hacked again?

Most takeovers start with a reused or weak password, a phishing message, malware that steals session cookies, or no two-factor authentication. After regaining control, turn on 2FA for every admin, audit who has access and remove stale logins and old agencies, avoid running ads off a weakly-secured personal profile, and learn to spot advertiser-targeted phishing — real Meta notices appear inside your account, not in emailed links.

Your Facebook Account Got Hacked and Is Running Ads You Didn't Create — Emergency Steps

If someone has gotten into your account and is spending your ad budget on offers that aren't yours, act now — the money is leaving in real time, so the order is stop the bleeding, lock them out, then report and dispute. Don't wait for Meta to notice; move first, and do it in this sequence. The good news: most owners can regain control, and Meta has a dedicated hacked-account recovery flow. Work top to bottom.

First 30 minutes: what do I do right now?

Speed matters more than perfection here. In roughly this order:

Pause the spend if you still have access. If you can still reach Ads Manager, pause every active campaign — especially any you don't recognize. This stops fresh charges immediately.
Remove the payment method the attacker is using, or at minimum note it so your bank can block it. Cutting off the card is the fastest way to end the bleed.
Change your Facebook password — and if you reused it anywhere (email especially), change it there too.
Check "Where you're logged in" in Security settings and log out of all unknown sessions/devices.
Turn on two-factor authentication (2FA) so a stolen password alone can't get them back in.
Check your email account. Attackers often compromise your email first so they can intercept Facebook's reset codes. Secure email before anything else if it also looks breached.

If you've been fully locked out and can't log in at all, go straight to Meta's account-recovery flow at facebook.com/hacked and follow the identity-confirmation steps.

How do I kick the hacker out for good?

Locking your password isn't enough if they left themselves a back door. Sweep for these:

Ad account access. In Business Settings, review every user, partner, and admin on the ad account and remove anyone you don't recognize or no longer trust.
Payment methods. Delete any card or payment method you didn't add.
Connected business assets. Check whether your page or ad account was moved into a Business Manager you don't own — a common takeover tactic.
Email and phone on file. Attackers swap in their own recovery email/phone so they can re-take the account later. Reset these to yours.
App passwords and connected apps. Revoke anything unfamiliar.

Do this thoroughly once, rather than a quick pass — a single leftover admin undoes everything.

How do I report this to Meta and stop the fraudulent spend?

Report the compromise through facebook.com/hacked — this is Meta's official recovery path and it flags the account for review.
Report the unauthorized ads/charges via Account Quality / Business Support Home. Explain clearly that the account was compromised and the ads are not yours.
Document everything — screenshot the rogue ads, the charges, the dates, and any unknown users you removed. You'll need this for both Meta and your bank.
Expect Meta may temporarily restrict the account while it investigates. That's normal for a compromise and is not a punishment — see (#F7) for what a restriction means and how review works.

Can I get the money back for ads I didn't authorize?

Maybe — but be realistic, and pursue both channels:

Meta: report the charges as unauthorized through the fraudulent-spend report. Meta may credit unauthorized spend after review, but there's no guarantee and no fixed timeline — it decides case by case.
Your bank or card issuer: contact them promptly to dispute the charges as fraud. This is often the more reliable route, and card networks have their own fraud protections. The sooner you file, the better your standing.

We won't promise a refund — neither Meta nor your bank guarantees one, and anyone claiming they can "recover your hacked spend for a fee" is almost always a second scam. Report honestly, document fully, and act fast; that's what gives you the best case.

How did they get in — and how do I make sure it never happens again?

Most ad-account takeovers start with one of: a reused or weak password, a phishing message ("verify your account," a fake copyright/policy warning, a bogus "Meta support" DM), malware that steals session cookies, or no 2FA on a valuable account. Once you've regained control, close the door for good:

Turn on 2FA for every admin — non-negotiable for an account that spends money.
Audit who has access and cut stale logins, ex-employees, and old agencies.
Never run ads off a personal profile with weak security; keep assets in a properly-secured Business Manager.
Learn to spot the phishing that targets advertisers — real Meta notices live inside your account, not in an emailed link.

This "harden it so it can't happen again" step is the one most owners skip after the panic passes — and it's the whole point. The full lock-down walkthrough (2FA, admin roles, the once-a-year access audit) is here: (#F10).