My Facebook page got hacked and my admin access was removed — how do I get it back?

First thing you should do is call your bank and file a chargeback for that 800 USD. Let them know the card was used on a compromised ad account without your authorization. After that immediately reset your personal profile passwords and the passwords of any linked email accounts.

The biggest mistake people make in these situations is wasting time reporting the hacker's personal profile. You need to target the ownership of the page as a corporate asset, not the attacker's account. Personal support tickets go nowhere without company documentation. Submitting an official business ownership dispute with legal documents is the only viable path.

The exact same thing happened to us last year. They ran 1,400 USD in unauthorized ads. We applied with our official business registration documents and bank statements. Exactly 11 days after submitting the file, they transferred the page to a brand-new business manager account we had created. They also refunded the stolen ad spend two weeks later.

anyone who doesnt enforce 2fa for their team ends up dealing with this sooner or later sadly... happened to us too took two weeks to get it back once we uploaded the company docs, but it was an absolute nightmare of a process. dont give up, keep replying to the emails consistently.

Was the page tied to a business manager beforehand or was it created directly under someone's personal profile? If the business manager was already verified, the process moves much faster. But if it was just set up on a personal account with delegated admin roles identity verification can take quite a bit longer.

This hit our textile company right before our peak season. The standard support form was leading nowhere. Here's how we solved it: we reached out via live chat support through another business contact who had active ad spend, and explained the compromised page situation to that agent. They escalated it to a specialized review within two days and we got the page back.

The moment you regain access, immediately take these three steps: 1) Bind the page to a fully verified business manager, and never leave just a single admin on it. 2) Require hardware security keys or authenticator-app-based 2FA for every employee with access. 3) Set strict daily spending limits on your ad accounts.

You're right. When making a decision, first look at what data you have on hand.

Start with a small trial; don't commit to everything at once.

I agree, and I'd like to emphasize that. Taking measures without an inventory leaves doors you haven't seen open.

Proven by experience.

Timely topic.

Quick summary for newcomers: Start with a small trial; don't commit to everything at once.

When we decide without measuring, we always end up in the same place. Correct me if I'm wrong.

Ill try it.

I've been dealing with this for a long time. If it's your first time, start small; scaling comes later.

Correct me if I'm wrong.

the opposite happened to me thats why Im writing. if 2FA is on a stolen password alone is useless.

if the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection. of course, it varies if your situation is different.

Exactly like that. Payment information changes are never verified through the channel they came from.

That's all, sorry if I went on too long.

Let me share what happened to me; it might be useful. If permission and scope aren't in writing, don't start that test.

Correct me if I'm wrong.

correct.

I'd say don't rush. Most incidents start with a leaked password, not a vulnerability.

Proven by experience.