Meta Business Account Takeover: How Hackers Steal Facebook and Instagram Ad Accounts

For a small business owner or freelance marketer, a Facebook or Instagram ad account isn't just a login — it's the engine behind every campaign, every audience list, and every dollar of ad spend. That's exactly why these accounts have become a favorite target for hackers. A stolen Business Manager account can be used to run thousands of dollars in fraudulent ads on someone else's payment method before the real owner even notices, and getting it back can take weeks.

These attacks have become common enough that Meta now runs dedicated recovery flows for compromised Business accounts — a sign of just how widespread the problem is. Here's how the takeovers actually happen, and the specific steps that make your ad account far harder to steal.

How Meta Business Accounts Actually Get Hijacked

• Fake "Copyright Violation" or "Page Restricted" messages. An email or Facebook notification claims your Page violated a policy and links to an "appeal" page that is really a credential-harvesting site designed to look identical to Meta's login screen.
• Malicious ad "inspiration" or "insights" tools. Fake browser extensions and desktop apps marketed to media buyers as ad research or spy tools quietly steal saved Facebook session cookies and Business Manager access tokens.
• Phishing PDFs and shared documents. A message pretending to be a brand collaboration or job offer includes a PDF or link that, once clicked, harvests your login session rather than delivering any real content.
• Weak or reused passwords. The same password used on a smaller, less secure site gets leaked in a breach, and attackers try it against Facebook Business logins in bulk.
• Being added as an unnoticed partner. Attackers sometimes gain limited access first — as a partner or an admin on a connected asset — and quietly escalate their permissions over time until they can remove the real owner.

Once inside, attackers typically add themselves as an admin, remove the legitimate owner, connect a new payment method, and launch high-spend ad campaigns — often promoting scams, counterfeit goods, or further phishing pages — all billed to whatever card or PayPal account is still attached.

Warning Signs Your Ad Account May Be Compromised

• An email from Meta about a new admin, new payment method, or new Page role you didn't set up.
• Ad campaigns appearing in Ads Manager that you didn't create, often with unfamiliar creative or a destination unrelated to your business.
• Unexpected charges on the card linked to your ad account.
• You're suddenly logged out and can't log back in, or two-factor codes stop arriving.
• Your Page's name, profile picture, or "About" section changes without your action.
• Team members report losing access to the Business Manager or ad accounts they normally use.

How to Protect Your Ad Accounts

1. Turn on two-factor authentication everywhere it applies

Enable 2FA on your personal Facebook profile, not just Business Manager, since the profile is usually the actual point of entry. Use an authenticator app rather than SMS where possible — SIM swap attacks can defeat text-message codes.

2. Never click links from "policy violation" notifications

Go directly to business.facebook.com or the Meta Business Suite app instead of clicking any link in an email or in-platform alert. Legitimate policy notices will also appear inside your account when you navigate there directly.

3. Audit admin roles and Business Manager partners monthly

Open Business Settings and review every person, partner, and connected app with access to your Pages, ad accounts, and catalogs. Remove anyone — a former employee, an old agency, a one-time freelancer — who no longer needs it.

4. Be suspicious of any tool that asks you to install an extension or desktop app to "boost" or "analyze" ads

Legitimate ad intelligence tools (spy tools, competitor research platforms) generally work through the browser without needing broad permissions to read and modify data on Facebook itself. If an extension requests access to "read and change all your data on facebook.com," that is a major red flag.

5. Use a dedicated browser profile for ad management

Keep Business Manager logins in a separate browser profile from your everyday browsing, so a malicious extension installed for another purpose has no session to steal.

6. Set spending limits and payment alerts

Set an account spending limit in Ads Manager and turn on billing notifications, so unauthorized spend triggers an immediate alert rather than being discovered days later on a statement.

7. Keep a documented recovery contact

Make sure your Business Manager has more than one trusted admin and that your recovery email and phone number are current, so you're not locked out entirely if one account is compromised.

If Your Ad Account Has Already Been Hijacked

1. Report the compromised account through Meta's official Business Help Center account recovery flow — search "Meta Business Help Center hacked account," rather than following any link sent to you.
2. Change your Facebook password immediately from a device you trust, and revoke active sessions in Settings.
3. Contact your bank or payment provider to dispute unauthorized charges and, if needed, cancel or replace the linked card.
4. Check Business Settings for new admins, partners, or payment methods as soon as you regain access, and remove anything unfamiliar.
5. Notify any team members or clients whose access may have been affected, in case the same phishing attempt was sent to them too.
6. Document everything — screenshots of the unauthorized activity, timestamps, and correspondence — in case you need it for a payment dispute or an appeal.

The Bottom Line

Ad account takeovers are painful precisely because they hit both your reputation and your wallet at once. The good news is that the vast majority of these attacks rely on the same handful of tricks — fake policy emails, malicious "helper" extensions, and weak account security — so a disciplined review of your admins, a real password manager, and two-factor authentication will stop nearly all of them before they start.