Facebook or Instagram business page hacked? What to do now

Short answer: Start recovery from Meta's own pages only: facebook.com/hacked for a Facebook login, Instagram's hacked-account flow for Instagram, and Get Support in the Meta Business Help Center for the business portfolio and ad accounts. Use a device you've logged in from before, block the card on any ad account so no more spend goes through, and ask anyone who still has admin access to file a report too. Once you're back in, remove unknown admins, reset security on every linked personal account, and check billing.

Business page takeovers almost always start with one person's personal Facebook or Instagram login, phished or reused. Meta's Business Help Center says the same: compromises "typically occur when an individual account is hacked or accessed via malware or phishing scams".

The first hour

1. Don't click "Meta support" messages

Hijackers and scammers send fake "Meta Support" or "copyright violation" messages to pages they've just attacked, and to worried owners searching for help. Ignore messages, emails and comments offering recovery. Type the addresses below into your browser yourself.

2. Try to get back into the personal account

For Facebook, Meta's help center recommends going to facebook.com/hacked, ideally on a device you've used to log in before. If you're helping a colleague, they should do it on their own usual device.

For Instagram, Instagram's help center suggests, in order:

Check your email for a message from security@mail.instagram.com about a changed email address, and use secure my account in that message to undo it.
Request a login link from the login screen (Forgot password?), sent to your email or phone.
If that doesn't work, request a security code or support from Instagram on a mobile device, using an email address only you can access, then follow the identity verification steps it sends.

3. Stop the money

If the hacked account had access to an ad account:

Call your bank or card issuer and block or replace the card linked to Meta ads.
Meta's guidance is to review your personal bank or credit card transactions and report unauthorized ones to both your bank and Meta Support.

4. Get someone else with access to report it

If another admin still has access to your business portfolio, they can submit a support request on your behalf, per Meta's Business Help Center. That's often faster than waiting for your own recovery.

5. Warn your customers, briefly

Post on your website, Google Business Profile or other channels: "Our Facebook page has been compromised. Please ignore messages or offers from it until we confirm it's fixed." Keep it short and factual.

Recovery: getting the business assets back

Once at least one person can log in, Meta's Business Help Center sets out the route:

Report the incident. In the Meta Business Help Center, select Get Support (top right), or go to Business Support Home. You must be logged in with the Facebook account linked to the ad account. Meta says it can only act if it can confirm the portfolio was compromised, so describe what changed and when.
Expect temporary restrictions. While Meta investigates, it may limit spend, pause ads or lock the ad account, stop you adding users or creating ad accounts, and disable accounts involved in the suspicious activity. That's protective, not punishment.
Secure your own account. Run Security Checkup, create a passkey, remove suspicious browser extensions, and clean any infected device. A device still carrying malware can lose the account again.
Review what changed. Export the account history from People in your business portfolio settings. In Ads Manager, check the campaign history for new campaigns, changed budgets, targeting, ad copy and landing page URLs. Pause or delete campaigns you don't recognize, and reactivate only ones you do.
Check ad rules and apps. Look for automated rules you didn't create, and revoke suspicious third-party apps or API connections.
Audit people. In People settings, remove unknown users and anyone who shouldn't have access, including former staff or agencies. Meta also suggests removing people who haven't logged in during the past 90 days and reducing everyone else to the minimum permissions they need.
Check billing. In Billing Hub, review statements, remove unknown cards or bank accounts, and check the billing address and contact details.
Reconnect assets. Confirm your Page, Instagram account, pixels and other assets are still connected to your portfolio. In Business Support Home, look for anything restricted or disconnected.

If you can't restore access or still see changes you don't recognize, go back to Meta Support with the details.

What not to do

Don't pay anyone who promises guaranteed recovery.
Don't create a new page immediately and ask followers to move unless recovery has clearly failed; it splits your audience and reviews.
Don't share screenshots of recovery codes or one-time links with anyone.

Prevention: make it hard to happen again

Require 2FA in the business portfolio. Meta's help center explains that newer portfolios can require it for admins or everyone, and that Meta automatically requires it for some portfolios older than 90 days. Set it for everyone.
Use passkeys or an authenticator app on every personal account with access, not text-message codes where you can avoid them.
Two trusted admins, minimum. One locked-out person shouldn't mean a locked-out business.
Business email addresses. Meta suggests removing people whose email addresses aren't related to your business.
Close dormant ad accounts. Meta recommends closing ad accounts that haven't run ads in the last year.
Turn on security notifications and send them to an inbox someone reads.
Keep a record of your business portfolio ID, ad account IDs and who has which role, so support requests are quicker.

FAQ

Can Meta restore a page if the hacker removed every admin?

Meta's routes start from recovering a personal account that had access. That's why having more than one trusted admin, each with strong 2FA, matters so much.

Will I get refunded for ads the hacker ran?

Report unauthorized charges to Meta Support and your bank promptly. Outcomes vary case by case, so act fast and keep records of what you didn't authorize.

How long does recovery take?

It varies. Restrictions can remain while Meta investigates, so plan to tell customers through other channels in the meantime.

Should I delete the hacked account and start again?

Only as a last resort, once Meta has said it can't help. You'd lose followers, reviews and history.

If a hijacked page has shown you how much depends on one login, tell us which accounts your marketing runs through.