My Facebook business Page has been hacked

If a business Page has been taken and there is an advertising account attached to it with a card on file, treat this as an active financial compromise and deal with it today. This is not the same as a personal account being taken. In most of these cases the attacker is not interested in your Page at all, they are interested in spending your advertising budget, and they begin within hours. The bill lands in your name.

Last checked: 15 August 2026. Every official Facebook, Instagram and Australian government link on this page was opened and confirmed working on that date. If you find one that no longer works, please tell us and we will fix it, because a dead link on a page like this is worse than no page at all.

Why this is different from a personal account

A personal account is usually stolen to message the person's friends. A business Page is stolen for the advertising account behind it, which is a working payment method that somebody else can point at their own adverts. Spending can run into thousands within a day or two, and because the account is yours, the invoices are yours.

The second difference is better news. Business accounts have a genuine support route with real people, which personal accounts do not.

Secure the personal account first

This is the step people get the wrong way round. A Page has no password of its own. It is controlled by personal Facebook profiles that hold roles on it, so if an administrator's personal account is still compromised, you can be removed from your own Page again an hour after getting it back.

Recover and secure that personal account first, using the Facebook recovery steps, and only then deal with the Page.

Check for the access that gets left behind

• People with Page access you do not recognise, in Page settings. Remove them.
• Partner businesses added to your Business Manager. This is a favourite route because it survives a password change and almost nobody looks at it.
• Additional administrators on the Business Manager itself, which is a level above the Page and is easy to forget.
• Payment methods that are not yours, sometimes added so the attacker can keep spending after you stop your own card.
• Connected apps and integrations that were granted access while they were in.

Write down what was spent

Before anything gets tidied up, screenshot the advertising charges, the dates and the amounts, and note when you first noticed. Your bank will ask, Meta will ask, and a dispute is far easier with the record captured at the time than reconstructed a fortnight later.

The people who will offer to help

Business owners are targeted hard here, because the loss is bigger and the panic is sharper. Everything below means walk away.

• Anyone offering a phone number. There is no Meta support line. A number is the clearest single sign you are being scammed.
• Paid recovery agents. Services that promise to get your account back for a fee. They have no access Meta does not give you for free, and the usual outcome is that you pay and nothing happens.
• Anyone who messages you offering to help after you post that you have been hacked, especially on Instagram. Watching for those posts is exactly how they find people.
• Anyone asking for an upfront fee, a gift card, a voucher or a cryptocurrency payment. No legitimate service is paid this way.
• Anyone asking for your password or your two factor code. No real Meta process ever asks a person for these. Sharing the code is how the second theft happens.
• Anyone asking to remote control your computer to fix it for you, unless it is somebody you already know and trust.
• A friend asking you to receive a code for them. That friend has already been taken over, and the code is for your account.

Related pages on this site

• Start at the router , if this is not quite your situation.
• There is no Meta phone number , and what the numbers really are.
• Paid recovery services , why none of them are real.
• Secure the personal account first .
• If money has gone , the order to do things in.