Hacked on Facebook

Your Facebook was taken. Here's the next hour.

A Facebook takeover usually means a Business Manager and an ad account are about to be drained.

Does this look familiar

  • Locked out, or logged in but your Pages and ad accounts are gone
  • Ads running in languages or for products you don't sell
  • A new admin on your Page or Business Manager you didn't add
  • Email from Facebook about a new login or a changed email
  • Friends messaged about a "video of you" link

Do these, in order

  1. Email and carrier first

    Before touching Facebook: from a clean device, change your email password, enable app-based two-factor, sign out of all sessions, and check recovery options. Call your carrier for an account PIN and port-freeze. Full first hour.

  2. Go to facebook.com/hacked from a clean device and follow the flow. If Facebook emailed about the change, that email has a revert link; confirm it came from a facebookmail.com address before clicking.

  3. Once in: Accounts Center → Password and security. Change the password, review "Where you're logged in" and log out everywhere, enable two-factor with an app, and remove unknown emails and phones.

  4. Business Manager → Settings → People and Partners. Remove anyone you don't recognize, then check Ad accounts, Pages and Payment methods for additions. Pause any campaign you didn't create.

  5. Settings → Apps and websites, and Business integrations. Remove everything unused.

  6. If an ad account was used fraudulently, dispute the charges with Meta Business Support and your card issuer the same day, with screenshots.

Avoid

  • Clicking "Is this you in this video?" links from friends. That's how the next account falls.
  • Any "Meta Support" Page or DM asking you to verify. Meta doesn't do that.
  • Adding a new admin to "help" recover. That's the attacker.

After you're back in

Make sure it can't happen the same way twice.

  • Figure out how they got in. The fix depends on the door they used, and there's usually more than one.
  • Close that door specifically, then the ones next to it.
  • Assume the same people will try again. They usually do.
  • Check your passwords and email against known breaches with a free account, and run the exposure scorecard. Or let us do the whole thing.