Searching “hacker ran ads on my Facebook account” usually means someone is spending on ads in your name and billing your card. Stop the spend first: turn off the campaigns, cut off the card, remove the intruder and lock your login. Then report the charges to Meta and dispute them with your card issuer.
The First 15 Minutes: Stop the Spend
- Turn off every campaign. In Meta Ads Manager, open the Campaigns tab and click each toggle until it turns gray; Meta says delivery can take a few minutes to stop. Check every ad account you can see.
- Cut off the card. Meta lets you remove a card in Billing & payments > Payment settings (or Payment methods) > Options > Remove, but only once ads are paused and no balance is outstanding. Otherwise, call your card issuer and ask to block or replace the card.
- Screenshot, then remove strangers. Capture the Ad account roles list and Activity history first, because Meta says changes by someone who was later removed can show as made by “Meta.” Then use Ad account settings > Ad account roles > Remove user. In a Business Portfolio, use Settings > People and Settings > Partners (full control required).
- Secure your login. In Accounts Center > Password and security, use Change password, turn on Two-factor authentication and log out unknown devices under Where you’re logged in. Locked out? Start at facebook.com/hacked.
Find Every Charge and Save the Evidence
- Receipts: in Billing & payments > Payment activity, click a Transaction ID to see the amount, date, payment method and ads it paid for, or use the Download menu for a PDF or CSV report.
- Statement matches: Meta ad charges start with FACEBK* or FACEBOOK INC. plus a 10-character reference number; match each one with the Reference number search in Payment activity.
- Who did what: Activity history in Ads Manager shows who created or changed each campaign. With full control, Business history (Settings > People > Export) shows when people and partners were added.
Meta bills as ads deliver, so charges can follow after you stop the ads. Meta also says one card can typically be added to up to 10 ad accounts, so a reference number you can’t find may belong to an account you can’t see.
Recovering the Charges: Meta and Your Card Issuer
Do both at once so you don’t miss your card’s dispute deadline.
Report the unauthorized charges to Meta
- Go to Billing & payments and select the hacked ad account.
- Open Payment settings and click Get help at the bottom of the page, or use Meta’s Ads payment support form.
- Say the account was compromised, and list each Transaction ID with its date, amount and the campaigns you didn’t create.
Meta says ad refunds are decided case by case at its sole discretion, usually take at least a month, and go to the original payment method or come as ad credits. Its Self-Serve Ad Terms also make advertisers responsible for their ad account’s security. The Meta Pay charge-report flow is not for ad charges.
Dispute the charges with your card issuer
Call the issuer right away, then follow up in writing. For credit cards, the FTC says your letter should reach the billing-inquiries address within 60 days after the first bill showing the charge was sent. The issuer must acknowledge it within 30 days and resolve it within 90, and you can hold back the disputed amount meanwhile. Federal law caps your liability for unauthorized credit card charges at $50, though the issuer decides what counts as unauthorized.
For debit cards, the CFPB says to report no later than 60 days after the statement showing the charge was sent. These are consumer rules, so for a business card, ask your issuer what applies. Meta says a failed payment pauses ads and disables the ad account until the amount due is paid, so tell Meta about the hack while you dispute.
If You Lost Admin Access or the Ad Account Was Disabled
Your card issuer needs no Meta access, so call first. Then:
- Profile locked: start at facebook.com/hacked, then follow our steps to recover a hacked Facebook account.
- Removed from your Page: Meta’s Page recovery form only works while you’re logged in and recently lost access. See recovering admin access to a hacked Facebook Page.
- Business Portfolio taken over or restricted: check its status in Business Support Home, then read what to do when a Meta Business Portfolio is restricted.
- Ad account disabled afterward: in Business Support Home (facebook.com/accountquality), click the account and follow What you can do; only an admin can request a review. See our guide to recovering a disabled Facebook ads account.
Meta may also have already removed admins, paused ads or changed payment methods after spotting suspicious activity.
What You See, What to Do, Where
| What you see | What to do | Where |
|---|---|---|
| Ads you didn’t create | Turn off every campaign | Ads Manager, Campaigns tab |
| FACEBK* charge you don’t recognize | Match the reference number, save the receipt | Billing & payments > Payment activity |
| You want a refund from Meta | Report the hack with transaction IDs | Payment settings > Get help |
| Charge on your card statement | Call, then dispute in writing within 60 days | Issuer’s billing-inquiries address |
| Ad account disabled | Follow What you can do | Business Support Home |
Lock It Down and Avoid Common Mistakes
To lock it down, Meta recommends:
- Peer approval in Settings > Security Center. Custom protection requires a trusted user’s approval for ads above a budget you set.
- Two trusted people with full control, and removing inactive users and anyone without two-factor authentication.
Common mistakes:
- Removing the attacker before screenshotting roles and Activity history.
- Letting the 60-day dispute window run out while waiting on Meta.
- Re-adding your card before every admin has two-factor authentication.
- Trusting “Meta support” calls or paying a “recovery hacker.” Meta says you can verify such contact in Business Support Home. Learn how to spot fake account recovery services.
When to Get Professional Help
If you’re still locked out, a structured case can help. The AccRevert team reviews the case, organizes your ownership evidence and prepares a documented request or appeal submitted through Meta’s official channels. Only Meta decides the outcome, so no result is promised, and we never ask for your password or login codes.
Card disputes stay between you and your issuer. Pricing: a flat $299 case-preparation fee opens a case; a success fee of $599 for personal accounts, $999 for business accounts or $1,199 for Business Manager and ad accounts applies only if access is restored. Payment is by PayPal only. See our Business Manager Appeal service.
Frequently Asked Questions
Will Meta refund ads a hacker ran on my card?
Maybe. Meta says ad refunds are decided case by case at its sole discretion and usually take at least a month. Report the charges from Payment settings with every transaction ID, and dispute them with your card issuer as well, in case Meta declines.
Why am I still being charged after turning the ads off?
Meta bills as ads deliver, when spend reaches your payment threshold or on your monthly bill date, so earlier delivery can be charged later. Compare each transaction date with when you stopped the campaigns. If new edits appear in Activity history, someone still has access.
Can I remove my card if the hacker controls the ad account?
Only an ad account admin, or someone with full control of the ad account in a Business Portfolio, can remove a payment method, and Meta requires paused ads and no outstanding balance first. If you can’t do that, ask your card issuer to block or replace the card.
Will disputing the charges get my ad account disabled?
The Meta billing pages we checked don’t say what a card dispute does to an ad account. They do say a failed payment pauses ads and disables the account until the amount due is paid. So report the hack to Meta through payment support at the same time.
Final Checklist
- Every campaign off, in every ad account.
- Card removed, or blocked by your issuer.
- Strangers screenshotted, then removed.
- New password, two-factor authentication on.
- Receipts and Activity history saved.
- Charges reported to Meta and disputed with your issuer within 60 days.
Still locked out of your ad account or Business Portfolio? Open your recovery case with AccRevert: a flat $299 case-preparation fee starts the work, and the success fee ($599 personal, $999 business, $1,199 Business Manager or ad account) applies only if access is restored.
Related Articles
Stop guessing and document the case properly.
Our team can review the account history, available ownership evidence and the recovery steps already attempted.
Facebook Decision Is Final? What You Can Still Do
Facebook Disabled After Being Hacked? How to Get Your Account Back
