Ad account disabled for 'unusual activity': what triggers it and how advertisers appeal

An ad account disabled for “unusual activity” is Meta saying one thing: the account behaved, for a moment, like an account that had been stolen. It is a security response, not a judgement about your ads. That distinction matters, because the appeal that works is built around proving control and explaining the behaviour, not around defending the creative.

The seven triggers behind most cases

Meta does not publish the rules, but the cases we handle cluster tightly.

1. A login from a new place. A team member on holiday, a new freelancer, a VPN switched on for the first time. The account’s location pattern breaks and the classifier reads it as a possible takeover.
2. A sudden budget jump. Going from a few hundred to several thousand a day in one step looks like an attacker maximising spend before the card is cancelled.
3. A new payment method, then immediate spend. Especially a card from a different country than the business address.
4. Several new admins or ad accounts at once. Common when an agency onboards a client quickly. To the system it resembles a compromised Business Manager being carved up.
5. Old campaigns reactivated in bulk. Dormant accounts that suddenly wake up with many campaigns are a known takeover pattern.
6. Inconsistent business details. The payment name, the verified business name and the Page name do not match each other.
7. An admin’s personal profile was actually compromised. Sometimes the flag is right. If an admin clicked a phishing link last week, the restriction may be the first sign.

Work out which one applies before you write a word of the appeal. It changes the evidence.

Step 1: check Account Quality, then check the admins

Open Account Quality from the admin profile with the highest role. Note every restricted asset and the stated reason; unusual activity on one ad account can cascade to a Business Manager. Then, before appealing, look at the admin list in Business Settings. If there is a role you do not recognise, or an admin whose profile shows recent password or email changes, treat the account as compromised and secure it first: remove the unknown role, have every admin reset credentials and enable two-factor authentication, and revoke access for any third-party tool you did not authorise.

Appealing before securing is the mistake that turns a short restriction into a long one. Reviewers check whether the activity has stopped.

Step 2: the appeal itself

Use the request-review option on the ad account in Account Quality if it is shown. If it is not, the Business Help Center’s contact options are the next official route for verified businesses and active advertisers. Either way, the submission should fit on one screen:

Ad account [id], owned by [business, verification status]. Restricted on [date] for unusual activity. The activity was [specific: a login by our new media buyer from Lisbon on [date] / a planned budget increase for a product launch on [date] / a new company card added on [date]]. Actions taken: [two-factor enforced for all admins on [date]; unknown role removed; business verification completed]. Requesting review; identity and business documents attached.

Attach what the text names: the admin’s ID if identity verification is requested, business registration, and screenshots showing the security changes with dates. Do not attach campaign performance, invoices, or a history of your spend with Meta. Reviewers are assessing control and risk, nothing else.

Step 3: wait, and do not spend around it

Automated outcomes often return within a day. If the case goes to a person, three days to two weeks is typical in our experience. During that time, do not create a new ad account, do not move the Page to another Business Manager, and do not add a fresh payment method to “test” anything. Each of these is read as circumvention, and circumvention is a policy restriction, which is a heavier case than the one you started with. Our Business Manager appeal guide covers what happens when the restriction has already cascaded.

If the flag was right

Sometimes the unusual activity was real: an admin’s profile was hijacked and someone ran ads on your card. Then the order changes. The admin recovers their personal profile first through Meta’s hacked-account flow, the business documents the takeover with dates and the security actions taken, and only then does the ad account appeal go in, referencing the recovery. Meta will not unfreeze an account whose admin it cannot confirm is back in control. Disputed charges go through the billing dispute route separately.

Preventing the next one

Most unusual activity flags are avoidable with habits that cost nothing:

• Tell the account what is coming. Raise budgets in steps over a few days rather than in one jump.
• Onboard people one at a time and give them the lowest role that does the job. Full admin is a restriction vector.
• Keep payment details, business verification and Page information consistent to the letter.
• Require two-factor authentication with an authenticator app for every admin. Meta lets you enforce this in Business Settings.
• Keep a simple change log: who logged in from where, what changed, when. When a flag hits, the log writes the appeal for you.

When to get help

A single account with an obvious trigger is usually a self-serve fix. Help is worth it when client money is frozen, when the restriction has cascaded to a Business Manager, when an admin profile was actually compromised, or when a first appeal has already come back rejected. That is the work behind our Business Manager and ad account appeals service: diagnosis, one precise appeal per asset, filed through Account Quality and the Business Help Center in the correct order, with a written record. No purchased accounts, no insider contacts, no guaranteed outcomes, and a free case review first.