Loading page...
Hacked Facebook and Instagram advertising
Unknown Facebook or Instagram advertising is both an account-control incident and a payment incident. Pausing a campaign does not remove the person, partner, session, integration, or stolen administrator identity that created it. Replacing a card does not restore business control. Preserve evidence, stop continued access safely, and run the Meta and payment-provider responses in parallel.
Reviewed 2026-08-27 by the Hacked.com recovery team. Hacked.com is independent from Meta and never asks for passwords or authentication codes.
Official recovery tools are free
No passwords or login codes
No guarantee of Meta's decision
Start with technical recovery. If it remains unresolved, consider a formal demand and, where appropriate, small claims preparation.
Secure your recovery methods and use the platform’s recovery tools and appeals. Our experts can help.
If recovery stalls, put your facts and requested resolution in writing and give the company an opportunity to respond.
If the dispute qualifies, get help organizing evidence and preparing a self-represented case.
Hacked.com can support all three stages. The right route and included work depend on your case and chosen service. Mailing alone does not establish court eligibility or guarantee recovery.
We can help with technical recovery, demand letters and small claims preparation when appropriate. Choose where to start.
50 minutes · $249 USD · Zoom
Review your situation and agree on practical next steps with a senior security expert.
Choose a time before payment. Your booking is confirmed after payment.
Free · No payment required
Briefly explain what happened. We will discuss your situation and the services that may fit.
A callback is not a scheduled working session. No payment is required to request one.
Loading appointment times...
Contact the card issuer promptly about unauthorized charges and ask what evidence it needs before replacing or blocking the payment method.
Preserve campaign, ad, billing, administrator, partner, and activity screenshots before removing access where safe.
Secure the personal profiles, email accounts, devices, and browser extensions used by business administrators.
The visible charge is often the last step of the incident. Identify whether the attacker used a compromised administrator, an unknown business partner, a stolen session, a malicious integration, or payment information outside the ad account.
What you see
Unknown campaigns or ads appear inside Ads Manager
What it usually means
Someone with direct, partner, system-user, integration, or stolen-session access used the ad account.
Next decision
Preserve campaign IDs, creatives, destinations, timestamps, spend, and the actor history where visible before pausing delivery and removing persistence.
What you see
Unknown people or partners were added
What it usually means
The attacker may retain business-level access even after a personal password reset.
Next decision
Secure legitimate administrators and email first, record every unknown role and assigned asset, then remove unauthorized access in an order that will not lock out the business.
What you see
The bank shows Meta charges but no matching business activity is visible
What it usually means
The charge may belong to another ad account, a different Meta payment surface, a stolen card, or a statement descriptor that needs investigation.
Next decision
Compare statement date and amount with Meta billing records, ask authorized staff whether they recognize it, then use the correct Meta or card-issuer reporting path.
What you see
The attacker returns after campaigns are paused
What it usually means
A profile, email account, session, partner, system user, integration, device, or browser token remains compromised.
Next decision
Stop repeating only the campaign response and re-audit the full administrator control plane before making more ad-account changes.
What you see
Meta restricted the account after the fraudulent ads
What it usually means
The business now has two linked problems: compromise containment and an enforcement review created by attacker activity.
Next decision
Document the compromise timeline, unauthorized ads, containment completed, affected entity, and corrective actions before requesting review.
Free first-party options
Availability and labels can vary by asset, account state, device, and region. Use links from Meta-owned domains and preserve the exact message shown to the affected administrator.
Safety note: Meta does not publish one universal support phone number for every business. Treat phone numbers in ads, search results, messages, and unsolicited emails as untrusted.
Keep originals in a controlled business location and share redacted copies. Do not put complete card data, passwords, codes, or identity documents into a public form.
Financial containment and platform recovery affect each other, but neither one replaces the other. Coordinate them so evidence is preserved and access is not left open.
Trusted Endorsement
“Hacked.com gave me immediate expert assistance, spent a great deal of time pinning down the problem, and provided a high level of professionalism and service that most companies today can't even dream of. And Hacked.com did what was needed to help me to keep in touch with my 160,000+ friends on Facebook. I'm grateful, and I wish that Facebook would put Hacked.com in charge of its customer service.”
Hacked.com has recovered more than 20 million followers
Independent coverage
Coverage from trusted global publications.
Recovery-or-refund guarantee
If we cannot resolve the Meta business issue covered by your agreement, you can close the engagement and receive the amount paid minus documented professional time at $199 per hour. Read the Refund Policy
This is a service-fee refund guarantee. Meta controls restoration decisions, reversals, and response times.
Hacked.com is an independent recovery service and is not affiliated with Meta. Meta controls platform decisions and response times.
Run both responses promptly. Ask the card issuer how to contain and document unauthorized charges, while preserving Meta billing and campaign evidence and securing business access. One process does not automatically complete the other.
No. Pausing limits delivery but does not remove the access route that created the campaign. Audit people, partners, system users, integrations, sessions, email, devices, and browser extensions before considering the incident contained.
Meta controls billing investigations and refunds, and outcomes cannot be guaranteed. Preserve transaction and campaign evidence, report the correct affected account, and coordinate with the payment provider without submitting contradictory claims.
Treat containment and enforcement as linked workstreams. Secure the business, document which ads were unauthorized and when they ran, record the affected entity and restriction, and explain the corrective actions in the review path Meta provides.
Small claims support for online disputes
Hacked.com can help accepted clients organize the account history, preserve ownership and loss evidence, prepare a formal demand, and navigate California small claims escalation when appropriate.
Explore Small Claims Case PreparationHacked.com does not guarantee restoration, settlement, judgment, or payment. Legal representation and court fees are not included unless an accepted written offer expressly says otherwise.
Free qualification callback
A specialist reviews the request before calling. The form does not create a paid case.
Live Rating Feed
Public ratings loaded via Trustindex.
Choose a time before payment
Choose an available 50-minute Zoom appointment with a senior security expert, then add the affected Meta assets and incident details before secure payment.
50-minute Zoom call
$249
Credited once toward the first eligible same-case recovery service
