Your Meta business portfolio was hacked: removing the intruder and getting control back

A hacked business portfolio usually starts with a hacked or tricked personal profile, because people reach portfolios through their Facebook profiles. Recover and secure that profile first, then, with full control, remove anyone you do not recognize under Settings, People in Meta Business Suite, check payment methods and charges, and use Meta’s Page recovery form for any Page the intruder took. If the intruder removed everyone with full control, the route back is Meta’s request for full control, filed from Business Support Home.

Speed matters here. Every hour the intruder keeps access is another hour of ads on your card, messages sent in your name, and assets moved out of reach.

The short answer

• Profile first: recover the hacked profile at facebook.com/hacked from a device you have used before, then turn on two-factor authentication.
• Find what changed: download the business history and the people list from Settings.
• Remove the intruder: Settings, People, the person’s name, Remove. You need full control.
• Lost a Page: Meta’s Page recovery form, while logged in.
• Lost full control entirely: request it from Meta through Business Support Home.
• Money: check Payment activity, then report unauthorized charges to Meta’s payment support.
• Lock it down: two people with full control, two-factor authentication for everyone, no inactive users.

How these takeovers happen

Meta’s Page recovery article describes two common patterns. In one, a hacker steals a password, logs in to a personal account, adds themselves to the Page and removes the owner. In the other, a scammer tricks the owner into handing over control, which Meta notes “might have happened in Business Manager or Meta Business Suite”. In our experience, fake policy warnings and fake partnership offers are the usual bait. Our guide to how account takeovers happen walks through the patterns in detail.

Step 1: secure the profile behind the portfolio

The portfolio cannot be safer than the profiles in it. If your own profile was taken, recover it through facebook.com/hacked, on a device you have used to log in before. Then change the password, sign out of sessions you do not recognize, and turn on two-factor authentication with an authenticator app. Meta’s business security best practices suggest saving recovery codes too, so a lost phone does not lock you out next.

If the account that was hacked belongs to another admin, they need to do the same from their own profile. Do not log in for them.

Step 2: find out what changed

Before you start deleting things, get the record. Meta’s best practices page says people with full control can download the business history, a file of important events in the portfolio, including changes to portfolio details, business assets and people. It is under the People or Business info tab in Settings. The same page explains how to export the people list, with when each person was last active and whether they have two-factor authentication on.

Keep these files. They are your evidence for every request that follows.

One caution: not every change is the intruder’s. Meta’s page on unrecognized ad account activity says Meta may itself act to protect an account by removing admins, pausing ads or changing payment methods.

Step 3: remove the intruder

Meta’s steps to remove people from a business portfolio:

1. Go to Settings in Meta Business Suite for the portfolio.
2. Click People in the left menu. If you cannot see it, you may not have full control.
3. Click the name of the person you want to remove.
4. Click Remove, then confirm.

Meta says removing a person revokes their access to the portfolio and to every business asset they could reach, such as Pages, Instagram accounts and ad accounts. If another person with full control has to approve the removal, they do it under Requests in Settings. Partners are removed separately, so check the partner list as well.

Then go through the rest of Meta’s security list: remove people who have not logged in for 90 days, people using public email addresses unrelated to your business, and people without passkeys or two-factor authentication. Review shared credit lines for activity you did not authorize.

Step 4: if the intruder removed you

A Facebook Page. Use Meta’s Page recovery form. Meta says it aims to reply within a day, although some reviews take longer, and that it can only act if it can confirm the Page was compromised. You must be logged in and have recently lost access; if the form does not let you select the Page, Meta says it does not see a recent loss of access. Meta recommends the form even if you have Meta Verified, calling it the fastest way to recover a Page.

The portfolio itself. If no one in your business has full control any more, Meta’s process is to submit a request to get full control of a business portfolio. It needs an ID, a document proving you own the business and a signed attestation letter, and it is submitted by chat from Business Support Home under the issue Business Manager admin dispute. Our guide to a disabled sole admin explains the documents line by line. Meta notes that an approved request does not remove existing people, so remove the intruder as soon as you are back in.

For suspicious activity while you still have some access, the best practices page points to Meta’s business support contact page.

Step 5: the money

In our experience, hijacked portfolios are usually used to run ads. Open Payment activity in Billing & payments, click each transaction ID you do not recognize and note the billing reason. Meta’s unrecognized activity page then links to its payment support, inside Billing & payments, to report the charges.

Expect a restriction, too. Meta’s page About advertising restrictions says it may restrict advertising when it suspects a portfolio or its assets were compromised, and that restrictions can include losing the ability to add admins or create new ad accounts. Open Business Support Home, select the restricted asset and work through What you can do, which can ask you to secure the account before you request a review. Our guide to ad accounts disabled for unusual activity covers how to write that review once the intruder is gone.

Step 6: lock it down

Meta’s best practices page is the checklist:

• Two people with full control. Meta recommends “2 active people” and also calls this second admin approval: sensitive changes then need a second person’s approval.
• Not too many. Limit full control to people who need it, ideally 10 or fewer.
• Two-factor authentication or passkeys for everyone. Remove people without them until they set them up.
• Peer approval for ads, so a second trusted person reviews ads before they publish.
• Close inactive ad accounts. Meta says bad actors target ad accounts that have not run ads in the last year.

What not to do

• Do not pay the intruder. Nothing obliges them to hand anything back, and the official routes above cost nothing.
• Do not trust emails, texts or calls about the hack. Meta’s page on Business Support Home says you can check there whether a message about your business accounts really came from Meta.
• Do not open a new portfolio to keep advertising. Meta’s Account Integrity policy covers business assets used to evade enforcement, and the original is still yours to recover.

When to get help

If you still have full control, most of this is an afternoon’s work. Help is worth it when the intruder removed everyone, when client Pages or ad accounts sit inside the portfolio, or when charges and restrictions are piling up at the same time. Our Business Manager and ad account appeals service prepares the recovery requests and reviews through Meta’s official channels, and starts with a free case review. We cannot promise Meta’s decision, and we will never ask for your password or login codes.