Someone Hacked Your Facebook Account and Is Running Ads You Didn't Create — What to Do, in Order

First, breathe — this is recoverable, and you are not the first owner it has happened to. But move now, because while you read this the charges are still adding up. There is a right order, and following it beats scrambling: stop the spend, lock them out, then report and dispute. Don't wait for Meta to notice on its own, and don't hand your account to a stranger who suddenly appears offering to "fix" it. Work top to bottom.

One note before the steps: Meta renames and reshuffles these settings often, so a menu may sit somewhere slightly different from what's written here. The path is stable even when the label moves — when in doubt, start at facebook.com/hacked and Meta's Help Centre and follow the flow from there.

What do I do in the first 30 minutes?

Speed matters more than doing it perfectly. Roughly this order:

1. Pause the spend, if you can still get in. Open Ads Manager and pause every active campaign, especially anything you don't recognise. This stops fresh charges straight away.
2. Cut off the payment method. Remove the card or UPI method being charged, or at least note it down so your bank can block it. Killing the money source is the fastest way to end the bleed.
3. Change your Facebook password — and if you reused that password anywhere else (your email above all), change it there too.
4. Log out every unknown session. In Security settings, open "Where you're logged in" and sign out of any device or location you don't recognise.
5. Turn on two-factor authentication (2FA) so a stolen password on its own can't let them back in.
6. Secure your email account. Attackers often break into your email first, so they can intercept password-reset codes. If your inbox also looks tampered with, lock it down before anything else.

One hard rule runs through all of this: never read out or forward a one-time password (OTP), and never share your password — to anyone, for any reason. Meta will not phone you, WhatsApp you, or DM you asking for a code. A message asking for your OTP is the attack.

What if I'm completely locked out?

If you can't log in at all — password changed, phone number swapped — don't panic and don't go looking for a shortcut. Go straight to Meta's official recovery flow at facebook.com/hacked and complete the identity-confirmation steps. It may ask you to upload an ID or confirm details only you would know. It can feel slow, but it is the one path that actually returns the account to you.

This is exactly the moment the second scam arrives. Someone will DM or comment offering to "recover your hacked account fast" — sometimes posing as Meta support, sometimes as a helpful stranger. They cannot do anything you can't do yourself through facebook.com/hacked, and handing them access or an OTP just hands your account to a fresh attacker. Recover only through Meta's own channels. Never through anyone who reaches out to you.

How do I lock the hacker out for good?

Changing your password does nothing if they left themselves a back door. Once you're back in, sweep for every one of these:

• Ad account access. In your business settings, review every user, partner, and admin on the account and remove anyone you don't recognise or no longer trust.
• Payment methods. Delete any card or UPI method you didn't add yourself.
• Business portfolio moves. Check whether your Page or ad account was quietly shifted into a business portfolio you don't own — a common way attackers keep a grip after you've reset the password.
• Recovery email and phone. They often swap in their own email or number so they can re-take the account later. Reset both back to yours.
• Connected apps. Revoke anything unfamiliar with access to the account.

Do this slowly and completely, once — not a quick glance. A single leftover admin can undo the entire clean-up the moment your back is turned.

How do I report the fraud and stop the unknown spend?

Two reports, both worth filing:

• Report the compromise at facebook.com/hacked. This is Meta's official recovery path and it flags the account for review.
• Report the unknown ads and charges through Account Quality or Business Support Home. State clearly that the account was compromised and the ads are not yours.
• Document everything. Screenshot the rogue ads, the ₹ charges, the dates, and any unknown users you removed. You'll need the same evidence for both Meta and your bank.

Expect that Meta may temporarily restrict the account while it investigates. For a compromise that's routine — it's protecting you, not penalising you — so don't read a restriction as a second disaster.

Can I get the ₹ back for ads I didn't run?

Maybe — and it's worth chasing both routes at once, but go in clear-eyed: no one can promise a refund.

• Meta: report the charges as unauthorised through the fraudulent-spend report. Meta may credit the spend after review, but there's no guarantee and no fixed timeline — it's decided case by case.
• Your bank or card issuer: contact them promptly and dispute the charges as fraud. This is often the more reliable route, and card networks carry their own fraud protections. If the attacker set up a UPI autopay mandate, cancel it in your UPI app or through your bank so it can't charge again.

A jewellery-shop owner once woke to ₹38,000 gone overnight on ads for a product he'd never sold. He got part of it back — but only because he'd screenshotted everything and filed with both Meta and his bank the same morning. The sooner you file, the stronger your case.

And to be plain about it: we won't promise you a refund, because neither Meta nor your bank guarantees one — and anyone claiming they can "recover your hacked spend for a fee" is almost always the next scam. Report honestly, document fully, move fast. That's what gives you the best shot.

How did they get in — and how do I keep them out?

Most takeovers start with one of a short list: a reused or weak password, a phishing message (a fake policy or copyright warning, a bogus "your account will be disabled" alert, a fake "Meta support" handle), an OTP handed over to someone pretending to help, malware that steals your logged-in session, or simply no 2FA on an account that spends real money. Once you're back in control, shut the door properly:

• Turn on 2FA for every admin. Non-negotiable on an account that touches money.
• Audit who has access and cut stale logins, ex-staff, and old agencies you stopped working with.
• Stop running ads off a personal profile with weak security — keep your assets inside a properly secured business portfolio.
• Learn to spot advertiser phishing. Real Meta notices live inside your account, not in a link or an OTP request sent to your phone.

This "harden it so it can't happen twice" step is the one most owners skip once the panic fades — and it's the whole point. The full lock-down walkthrough — 2FA, admin roles, and the once-a-year access audit — is worth doing while it's still fresh in your mind.