My Ad Account Was Hacked: How Do I Recover It Officially and Protect It Afterwards?
Treat unexpected activity as a security incident
An advertising account may be compromised if you see campaigns, ads, billing details, payment methods, or account users that you do not recognize. Other warning signs include being unable to sign in, receiving security notices about changes you did not make, or finding that your permissions have changed. A single unfamiliar item does not always prove that someone took over the account, but it is reason to investigate promptly.
Start by using a device and internet connection you trust. Avoid clicking sign-in links in unexpected emails or messages. Instead, open the advertising platform’s official website or app directly, then find its account-security, recovery, or compromised-account instructions. If you cannot sign in, use the platform’s official account-recovery route rather than a link sent by an unknown person.
Do not try to solve the problem by creating another account to continue activity, concealing who controls an account, or changing account details to avoid a review. Those actions can complicate recovery and may violate platform rules. The priority is to secure the login, report the suspected takeover through the official channel, and address any activity or policy issue the platform identifies.
Secure the email account and other sign-in routes
The email account associated with an advertising login is often central to recovery. If someone controls that inbox, they may be able to intercept security notices or reset credentials. Sign in to the email provider through its official channel, change the password to a new, unique one, and review its security settings and recent activity.
Check the email account’s recovery addresses, phone numbers, forwarding rules, filters, connected applications, and signed-in sessions. Remove anything you do not recognize, but take care not to remove a recovery method that belongs to you or your organization. If you cannot safely access the inbox, use the email provider’s official compromised-account process as well as the advertising platform’s process.
Where the advertising platform offers an additional sign-in step, enable it under the account owner’s control. Choose a method you can reliably access, and review any trusted devices or backup methods the platform lets you manage. Do not share one-time codes, recovery codes, or password-reset links with anyone who contacts you unexpectedly. A person claiming to be support should not need your password or a code that grants access.
If you use the same password elsewhere, replace it on those accounts too. Reusing credentials can allow a password exposed in one place to be tried against another. Use a password manager if that helps you create and keep distinct credentials, and make sure its own access and recovery settings are secure.
Use the platform’s official recovery route
Once the email account is secured, follow the advertising platform’s current instructions for a hacked, compromised, or inaccessible account. The exact route and wording can differ depending on whether you can still sign in, whether the login itself was changed, and whether the account belongs to an individual or an organization. Find the instructions from the platform’s own help center or account-security pages, not from search advertisements, unsolicited messages, or third-party recovery services.
If you can still sign in, secure the login and report the suspected access through the official support or compromised-account route. If you cannot sign in, use the platform’s account-recovery process. Provide accurate information and explain what you observed, when you first noticed it, what access you still have, and what steps you have already taken. Do not guess at details or submit documents that are altered, borrowed, or unrelated to the account holder.
Keep a record of the case reference or confirmation if the platform provides one, and save copies of relevant notices. Use the same official case route for follow-up where possible so the platform can review the information together. Avoid sending sensitive information through public posts or to people who claim they can accelerate a recovery. Current forms, eligibility rules, verification requirements, and support options are published in the platform’s own help and policy pages; check those pages for the current process.
Review access, roles, and connected services
When you regain access, inspect who can manage the advertising account and any associated business or organization settings. Look for people, partners, agencies, or other accounts you do not recognize. Review what each person is allowed to do, not only whether they appear on a user list. Remove unauthorized access through the platform’s normal controls, and adjust legitimate users’ permissions to match their responsibilities.
Do not remove a known colleague or service provider without checking whether they are responsible for legitimate activity. If ownership or access is unclear, document the uncertainty and ask the organization’s administrator or the platform’s official support channel before making a change that could disrupt authorized work. If the platform provides an activity or security log, review it and save relevant details.
Check connected apps, integrations, and other authorized services. Revoke access that is unfamiliar, no longer needed, or not approved by the account owner. Also review linked business assets or profiles where the platform’s settings show that they can grant access to advertising tools. A takeover may involve more than the ad account’s direct user list.
Keep the account’s genuine ownership and business information consistent. If an organization needs to change its administrator or contact details, follow the platform’s documented process and provide truthful information. Do not hide connections between accounts or use someone else’s identity to regain access.
Pause suspicious activity and examine billing
If you find campaigns or ads that you did not create, use the platform’s normal controls to stop or pause them where you can do so safely. Do not assume that removing an ad alone resolves the incident: check for related campaigns, scheduled activity, changed settings, and unfamiliar users. Record what you found before changing it, including the names or descriptions shown in the account and any relevant notices. Avoid sharing private account details publicly.
Review billing and payment settings through the platform’s official interface. Look for payment methods, billing contacts, or account details that have changed, as well as charges you do not recognize. Record the dates and descriptions displayed, but do not publish payment information or full account identifiers. If your payment provider offers an official way to secure a card or payment account, contact it through its own verified channel. Also report the advertising activity and billing concern to the platform, which can explain its process for reviewing account charges.
A charge that looks unfamiliar may require investigation; do not assume from appearance alone that it is fraudulent or that it will be reversed. Explain the concern clearly and provide the information requested through official channels. Keep copies of relevant billing records and platform correspondence. The platform’s current billing policies and review procedures are the authority on how its charges are handled.
If the account is restricted while the incident is being investigated, follow the restriction notice and the platform’s appeal instructions. Do not try to bypass a spending limit, verification step, or account restriction by routing activity through another account. Ask support how to proceed, and address the underlying security or policy issue directly.
Explain the incident and appeal through official channels
A useful report is factual and organized. Describe the activity you did not authorize, the access or settings that appear to have changed, and the steps you took to secure the email and advertising login. Include relevant screenshots or records only through the platform’s approved submission method, and remove unrelated sensitive information where appropriate. Keep your explanation consistent across follow-ups.
If the platform has restricted the account or rejected a recovery request, use the appeal or review route stated in its notice or help center. Respond to the reason given rather than submitting repeated, unrelated requests. If the platform asks for identity or business verification, use only the account holder’s genuine information and the official submission process. Never submit false documents, use a borrowed identity, or alter records to pass a check.
Sometimes the platform may ask for more details or direct the account owner to another official process. Follow the current instructions and preserve the case history. If you believe the platform has misunderstood the incident, explain the specific point and provide relevant evidence without exaggeration. No appeal or recovery route guarantees that access will be restored; the platform reviews each case under its current rules.
Fix the cause before resuming advertising
Restoring access is only part of recovery. Identify how the takeover may have happened and reduce the chance of a repeat. Consider whether a password was reused, a device was shared or left signed in, an email account was compromised, or an unfamiliar app or person had access. These are possibilities to investigate, not conclusions to state without evidence.
Update credentials and security settings on accounts that could grant access to the advertising account. Remove unneeded sessions and integrations, and make sure account recovery methods belong to the owner or organization. If several people manage advertising, agree on a clear access process: each person should use their own authorized login, receive only the permissions they need, and report suspicious notices promptly.
Before restarting campaigns, review the account’s users, payment settings, business details, and active advertising. Confirm that any remaining work is authorized and complies with the platform’s policies. If a campaign or account issue is related to a policy violation rather than unauthorized access, correct the underlying issue and use the platform’s official review route. A security incident does not automatically remove the need to meet advertising rules.
Check the platform’s help center and policy pages for current verification requirements, account-security guidance, billing procedures, and any applicable restrictions. These details can change, and old advice may no longer match the available process.
After-recovery checklist
Use this checklist once the account is accessible and the immediate incident has been reported:
- The email account behind the login has a unique password and secure recovery settings.
- Additional sign-in verification is enabled and controlled by the legitimate owner.
- Unknown sessions, users, roles, connected apps, and integrations have been reviewed and removed where appropriate.
- Campaigns, ads, account settings, and payment details have been checked for unauthorized changes.
- Billing concerns have been recorded and raised through the platform’s official process.
- Recovery or appeal correspondence and relevant evidence are saved securely.
- The cause has been investigated, and access practices have been corrected.
- Any remaining restriction or verification request is being handled through the platform’s official route.
Keep the record factual: note what was discovered, what was changed, and what the platform advised. Share it only with people who have a legitimate role in managing the account. If another warning appears, return to the official security and support channels rather than responding to unsolicited offers of help.