Your Ad Account Was Hacked. This is the “No BS” Response Plan.

Discovering your advertising account has been compromised is a heart-stopping moment. Whether it is a hacker draining your credit card or a rogue employee sabotaging campaigns, speed is your only asset. The priority is not to “fix” the ads yet—it is to Stop the Bleeding. You must sever the financial link, lock down the perimeter, and gather forensic evidence before the platforms will even consider a refund. This is a guide on how to survive the next 24 hours and protect your Business Continuity.

“I just got a notification. $5,000 was spent on my ads account.”

When I get this call, there is no time for “strategy.” We enter Crisis Management Mode. If you are reading this because you are currently compromised, stop reading the intro and follow these steps immediately.

Phase 1: The “Kill Switch” (First 60 Minutes)

If you still have access to the account, your instinct will be to delete the fake ads. Don’t. The hacker might have a script that auto-recreates them.

Step 1: Sever the Money Go to your Billing Settings and remove the credit card. If the platform (Meta/Google) won’t let you remove it because there is an “outstanding balance,” call your bank immediately and block the card. This is the only way to guarantee the bleeding stops. (I have seen hackers smart enough to add rules that turn ads back on in 24 hours—don’t waste time fighting the script, just cut the funding).

Step 2: Evict the Intruder Go to People/Users settings.

• Take a screenshot of the user list (for evidence).

• Remove any user you do not recognize.

• If you suspect a specific employee’s account was hacked, remove them temporarily.

• Force Logout: Change your own password immediately. On Meta, go to “Security and Login” and select “Log out of all other sessions.”

Phase 2: Forensics and Evidence (The “Crime Scene”)

To get a refund, you need to prove to Google or Meta that you didn’t authorize those ads.

Do not delete the unauthorized campaigns yet. Pause them, but do not delete them. Once deleted, the data (and the evidence of the “Change History”) becomes harder to access for support agents.

Gather the Evidence:

1. Screenshots of the Ads: Show that the creative has nothing to do with your business (e.g., you sell software, the ad sells crypto).

2. Screenshots of the “Change History”: This is your “Black Box” recorder. It shows who created the ads and when. (Note: IP address is often not available in the standard view, but capture whatever location data is shown).

3. Bank Statements: Highlight the unauthorized charges.

[Expert Insight: The “Rogue Admin” Trick] Scammers often deploy the “Rogue Admin” trick: they add themselves as an “Admin” and then demote you to “Analyst.” If you can still see the account but can’t change anything, do not panic. The asset is still there. You have just lost the keys. You can still recover full access (been there, done that). This requires a specific support ticket for “Admin Dispute.”

Phase 3: Comply with SOPs (The Appeal)

This is the hardest part. Platform support is slow and automated. You must follow their Standard Operating Procedures (SOPs) exactly.

How to file the claim:

• Use the specific form: Do not use the general “Help” chat unless you cannot find the form. If you use chat, ask them specifically: “Please give me the official link to report a compromised account/unauthorized transactions.”

• Be clear and specific: “My account ID [Number] was accessed by an unauthorized user on [Date]. Unauthorized ads were created. I have attached the Change History showing the user [Name] created these ads.”

• The Refund Process: Refunds are not instant. It can take 2 to 6 weeks. However, if you have the evidence from Phase 2, the success rate is high.

Phase 4: The Clean Up (Restoring Data Equity)

Once you have reclaimed control, you have a mess to clean up.

• Pixel Protection: Check if the hacker installed their pixel on your account (to steal your audience data). Remove it.

• Audience Lists: Check if they downloaded your customer lists. (You can’t undo this, but you need to know for legal/GDPR/PDPA risks).

• Device Sweep: How did they get in? It was likely malware on your computer or a team member’s computer. Run a full antivirus scan and check for suspicious browser extensions.

Mister Marketeer’s Approach: Crisis & Recovery

We offer “Sniper” services for businesses in distress. We know the navigation of the support systems better than most.

• “Please help me file the appeal.” -> We help draft the forensic report for Meta/Google.

• “Please audit the damage.” -> We review the account to ensure no “backdoors” (hidden users or API tokens) were left behind.

Conclusion: Panic is Expensive. Process is Critical.

A hacked account is a trauma, but it is rarely a death sentence for the business if you act fast. The money can usually be recovered. The Data Equity can be restored.

But you must treat this as a wake-up call. If your security was loose enough to let them in, it’s time to tighten the bolts.

🚀 Need a Crisis Manager? If you are currently locked out or dealing with a breach, we can help guide the recovery process. Contact us for emergency recovery steps.

About the Author Krishna S. is a 15-year marketing veteran who helps SMEs protect their digital assets. He specializes in crisis recovery and establishing secure marketing operations. Connect with him on LinkedIn here.