The moment you realize something's wrong
A hacked Facebook Business Manager doesn't announce itself. One day your campaigns are fine, the next you're locked out of your own assets while someone burns your credit line on scam ads. It's the kind of thing that can freeze your entire operation overnight.
Here's the good news: this is a solvable problem. But recovery rewards methodical action and punishes panic. This guide walks you through the exact sequence we use to get businesses back in control.
Spotting the breach before it gets expensive
Hackers work quietly. They reshape your admin structure to extract maximum value before you notice. Watch for these warning signs:
- Sudden admin removal. You get an automated email saying your permissions were changed or revoked. That's not a glitch.
- Strangers in your Users tab. Unfamiliar email addresses, often from temporary or foreign domains, suddenly have access.
- Ad spend going sideways. Existing campaigns get edited, or new high-budget campaigns appear out of nowhere, usually pushing crypto schemes or shady software downloads.
- Payment details changed. Your credit card is swapped out, or new billing profiles appear to dodge transaction limits.
One important rule: don't just delete the hacker's campaigns. Screenshot everything first, the ads, the ad account IDs, any unfamiliar tracking pixels. That evidence is what makes a refund claim work later.
Move one: lock down your personal accounts
Nearly every Business Manager hack starts with a compromised personal profile belonging to one of your admins. If you skip this step, anything you fix on the business side will be undone within hours.
Go to your personal Facebook settings, open Password and Security, and check Where You're Logged In. Force-logout every device you don't recognize. Then change your password to something genuinely unique (password managers make this easy, and no, reusing passwords across platforms is no longer forgivable).
Next, upgrade your two-factor authentication. Move off SMS and onto an authenticator app or, better, a physical security key. SMS 2FA falls to SIM-swapping attacks regularly now. Finally, run a proper malware scan on your devices. Session-cookie-stealing malware is the single biggest cause of modern account compromises, and it can reinfect you the moment you log back in.
Move two: file a formal admin dispute
Once your personal accounts are secure, you officially reclaim the business entity through a Facebook admin dispute. This is essentially a legal ownership claim, and Meta treats it seriously.
You'll need a verification package: notarized statements, business licenses, government-issued IDs. Incomplete applications get rejected fast, because Meta would rather reject a real owner than hand an account to a fraudster. Gather everything before you submit, and make sure the documents are clean, unedited scans.
Why professionals recover faster
Let's be honest about the standard route: filing through regular help channels can take 14 to 45 business days. Your tickets sit in an automated queue, generic replies close your case without fixing anything, and meanwhile your business bleeds revenue.
This is where agency escalation changes the timeline. We've worked with Meta's internal review teams on these disputes, so we know exactly what documentation passes on the first try and which channels route your case to actual humans. What takes weeks through the public queue often resolves in days through partner channels.
Beyond the recovery itself, the cleanup matters. Getting your assets back is only half the job. Setting up proper enterprise security frameworks and server-side tracking like Conversions API protects you from the next attempt, and as a bonus, it improves your ad attribution too.
Quick answers to the questions we hear most
How long does recovery take? Through standard channels, expect 14 to 45 business days. Through professional agency escalation, it's often under a week.
Will Meta refund the hacker's ad spend? Generally yes, once Meta confirms the compromise. You'll need documentation: bank statements, screenshots of the unauthorized campaigns, and the exact date the breach happened.
Can the hacker delete my Facebook Pixel permanently? Not easily. They can remove your access to it, but the underlying pixel data survives on Meta's servers if it's linked to other verified assets. Reclaiming the Business Manager restores your pixel history.
What's a notarized statement and why does Meta want one? It's a document you sign in front of a licensed notary, confirming under penalty of perjury that you're the rightful business owner. Meta uses it as fraud prevention, so impostors can't claim active business accounts.
Don't fight this alone
A hacked Business Manager is one of those problems where doing it yourself costs more than it saves, in lost ad spend, lost time, and lost sleep. Neviax's recovery team handles these disputes every week: securing your perimeter, filing the admin dispute correctly the first time, and pushing it through partner channels until your assets are back.
If your business depends on Meta ads, reach out now. The sooner we start, the less the hacker walks away with.
