Get your Facebook Page and ad account back, then make it hard to lose again

The short answer

Facebook business Pages are almost always hacked through a person: an admin’s personal Facebook profile, the email account behind it, or a fake “Meta support” message that tricks someone into handing over a login. So recovery starts with that person. Secure the admin’s email, then recover their Facebook profile at facebook.com/hacked from a device they have used before, then remove unknown people from the Page and from your Meta business portfolio, and stop any ads you did not create.

If you have lost access to the Page entirely, Meta’s Help Center has a separate path for recovering a hacked Page you manage. Act quickly, keep records, and ignore anyone who contacts you offering to recover your Page for a fee. Below is the order to work in.

First hour: contain the damage

1. Stop the money. If ads are running that you did not create, call your bank or card issuer and freeze or replace any card attached to your Meta ad account. Ask about disputing unauthorized charges.
2. Secure email. Change the password on every email account linked to a Page admin’s Facebook profile and turn on multi-factor authentication. An attacker who controls the email can take the Facebook account again.
3. Warn your audience. If you still control another channel, such as Instagram, your website or an email list, tell customers to ignore messages or offers from the Page until further notice.
4. Start a log. Note times, what changed, screenshots of unknown admins, ads and any emails from Facebook. You will need this for Meta, your bank and possibly your insurer.
5. Check other admins. Ask every person with Page or business access to confirm they can still log in and to change their passwords.

Recover the admin’s personal profile

Pages and business portfolios are controlled through personal profiles, so recovering the person comes first. Meta’s Help Center says to go to facebook.com/hacked on a device you have used to log in before.

• If the attacker changed the email address, look for Facebook’s message to the original address. Meta says it sends a link there that can reverse the change.
• If you cannot reach the email or phone on the account, use Meta’s separate recovery option for that case, which may ask for identity verification.
• Once in, log out all unrecognized devices under “Where you’re logged in” and change the password.
• Turn on two-factor authentication. A passkey or security key is the strongest option; an authenticator app is next; text messages are the weakest.
• Check that the recovery email and phone number are yours, and remove anything the attacker added.

Before acting on an email that claims to be from Facebook, check whether it also appears in the recent security emails shown in your account settings. Fake “policy violation” and “page will be deleted” messages are a common way Pages get hacked in the first place.

Recover the Page and business portfolio

1. If you still have some access, open the Page’s access settings and your business portfolio settings and remove anyone you do not recognize. Attackers often add themselves in the business portfolio rather than on the Page itself, so check both.
2. If you have lost access, use the hacked Page recovery path in Meta’s Help Center while logged in to the profile that used to manage the Page.
3. Check partners and connected assets. Look for unknown partner businesses, new ad accounts, Instagram accounts or apps connected to your portfolio.
4. Review recent posts and messages. Delete scam posts and check whether customers were messaged with fake offers or payment requests.
5. Gather proof of ownership. Business registration, a website on your domain, invoices for ads and the Page ID help if you need to escalate through Meta Business Support.

Recover the Meta ad account

Hijacked ad accounts are often used to run scam ads on your card, and Meta may restrict the account when it detects them.

• Turn off all ads and campaigns you did not create, then remove unknown payment methods
• Review billing activity and download invoices for your bank dispute
• Remove unknown people and partners from the ad account
• If the account is restricted, use Meta Business Support from a trusted device and request a review promptly, explaining that the account was compromised
• Lower the account spending limit while you recover

Wondering where else your business is exposed? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, business continuity and more as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

Lock it down so it does not happen again

• Require two-factor authentication for everyone in your business portfolio, and use passkeys or security keys for admins where available.
• Keep admins few and named. Keep at least two trusted full-control admins so one lost login does not lock you out; everyone else gets the narrowest role that works.
• Never share one login. Agencies and staff should be added as people or partners, not given someone’s password.
• Remove access the day people leave, including former agencies and freelancers.
• Secure the email accounts behind every admin profile with multi-factor authentication.
• Set an ad spending limit and turn on billing alerts.
• Train people on fake Meta messages. Meta will not ask for your password, and real notices appear inside your account.
• Review access quarterly in the business portfolio settings.

If social media is a big part of how customers find you, our article on social media marketing for small businesses covers how to run accounts safely with an agency.

Avoid recovery scams

After a hack, businesses get comments and messages from “Meta support” or “recovery experts” promising to restore the Page for a fee. Meta controls restoration decisions, and nobody outside Meta can force a result. The FTC advises using the platform’s own recovery process. Do not pay strangers, share codes or install remote access software for them.

If your Instagram account was taken too

Attackers often take connected Instagram accounts in the same incident, since many businesses link them through the same business portfolio or use the same email.

• Use Instagram’s own hacked account recovery from the app, which may ask for a video selfie or a login link to your email or phone
• Change the password on the email linked to Instagram and turn on two-factor authentication
• Remove unknown linked accounts, devices and third-party apps in Instagram’s security settings
• Check the business portfolio to confirm the Instagram account is still connected only to your business

Recover and secure email first in every case. Every social account you own is only as safe as the inbox that can reset its password.

How JLB USA helps

Most Facebook hacks start with a weak email account or a phishing message. JLB USA’s cybersecurity services include multi-factor authentication, access reviews, same-day removal of leavers, email security and endpoint protection for businesses with roughly 25 to 100 employees, delivered through managed IT. We cannot recover a Page on Meta’s behalf, but we can help secure the accounts and devices around it.

Keep reading

• Email security for small business: the layers you need and what to buy
• Multi-factor authentication for small business: a rollout plan
• Cybersecurity for nonprofits: protect donor data on a tight budget
• Cyber insurance requirements in 2026: what insurers commonly ask for

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Managed IT services
• Social media marketing for small businesses