Facebook Business Page Hacked or Suspended: What To Do
Facebook Business Page Hacked or Suspended: What To Do
The first sign is usually someone else. A customer messages your mobile asking why your page is posting crypto giveaways. Or a supplier mentions your Instagram has disappeared. You log in, and either the password fails or it works fine and you are simply no longer an admin of anything. Having your Facebook business page hacked on a Friday can cost two weeks of enquiries before a human at Meta looks at your appeal, and most owners spend that fortnight refreshing a support form that never changes status.
There is a better sequence. It is slower than anyone wants, but it is documented, and it ends somewhere other than a black box.
Is your Facebook business page hacked, or has Meta suspended it?
Two different things are happening and they get confused. One is a genuine compromise, which usually starts with a personal Facebook profile rather than the page itself. The other is an automated suspension, where Meta's systems flag an account and disable it with almost no explanation. The recovery paths differ, so work out which one you are dealing with first.
Compromise nearly always comes through a person. Pages do not have passwords. They have admins, and every admin is a personal profile with its own login. An attacker phishes one of those profiles, often with a message about a copyright strike or an ad account problem, adds themselves as an admin, then removes everyone else. The page was never breached in the way people imagine. A staff member clicked something at 9pm.
Suspension works differently. Automated enforcement can disable a business account over a policy trigger you may never see spelled out, sometimes tied to an ad, sometimes to a linked profile, sometimes to nothing you can identify. The appeal form is the only door, and it often returns a decision within minutes, which tells you no person read it.
What should you do in the first 24 hours?
Move in a fixed order. Secure the human accounts first, then the assets, then build a written record you can hand to someone else later. Skipping the record is the mistake that costs people weeks.
Secure every admin's personal profile. Change passwords, turn on two-factor authentication using an authenticator app rather than SMS, then check the active sessions list for logins nobody recognises. Do this for all admins, not just the one you suspect.
Report through Meta's own channels at facebook.com/hacked, and if an ad account is involved, submit the business support form as well. Lodge once and note the case number. Repeat submissions can reset your place in the queue.
Screenshot everything. The page as it looks now, the error message, the date you lost access, your ABN and business details, invoices for ad spend. Anyone escalating on your behalf will ask for exactly this.
Pull your ad account offline if you still can. Compromised pages get used to run spend against your card.
Tell customers somewhere else. A short note on your website or an email saying the page is being recovered stops people trusting whatever is posted in your name.
If money moved or identity documents were involved, get IDCARE on the phone. The IDCARE small business service is free, staffed by real case managers and built for precisely this situation, and their case reports carry weight when you escalate.
Where to escalate when Meta stops replying
The Australian Small Business and Family Enterprise Ombudsman handles disputes between small businesses and social media companies, and it has become the practical escalation point when Meta's own process stalls. You apply through asbfeo.gov.au with your case number and your evidence pack attached.
The volume is real. An ABC News report from 19 December 2025 said the Ombudsman had supported 482 small businesses that year in disputes with social media companies, with two thirds of those cases involving Meta. In the month before that report, 75 per cent of the disputes were about regaining access to an account after a hack.
Two things follow. Your situation is common enough that a formal process exists for it, and that process works far better when you arrive with documentation instead of frustration. The same holds if you are dealing with a suspended Google listing, where a calm factual submission consistently beats an angry one.
Can you prevent this happening again?
Mostly, and it takes an afternoon. The fixes are unglamorous: a proper admin structure, app-based two-factor for everyone and a recovery plan that does not depend on one person's phone being switched on.
Start by moving the page into a business portfolio in Meta Business Suite, so it is owned by the business rather than by whoever created it back in 2016. Give each staff member their own access at the lowest level that lets them do their job. Content people do not need full admin. Then remove the ex-employees and the agency you stopped working with three years ago, because they are almost certainly still in there.
Two-factor authentication should run through an app, not text messages, since SIM swapping defeats SMS. Every admin, no exceptions. Add a second full admin who is not you, ideally a partner or director, so one compromised profile can never lock out the whole company.
Keep a plain document listing your page ID, ad account ID, business portfolio ID, every admin with their access level, plus the email address attached to each. Store it somewhere that is not Facebook. When something breaks, that single page of detail is the difference between a same-week recovery and a two-month appeal. This is the housekeeping we work through with clients at Searchline before touching a campaign, because there is little sense building paid social campaigns on an asset one phishing email can take away.
Common questions
How long does Meta take to restore a hacked business page?
There is no published service standard, and outcomes range from a few days to several months. Cases with clean documentation and a verified business identity tend to move faster. If you have had no substantive response after a few weeks, that is the moment to lodge with the Ombudsman rather than keep resubmitting the same form.
Should I just start a new page instead?
Only as a last resort, and never before you have escalated. A new page loses your review history, your audience and any advertising history, and if the old page is still live under someone else's control it will keep confusing customers. Run the recovery and a temporary holding page in parallel if you need something visible this week.
Does being a verified business or an active advertiser help?
It helps you reach a human. Accounts with live spend often have chat support that unverified pages never see. It is not a guarantee, though, and plenty of long-term advertisers still get caught by automated suspensions.
Pick an afternoon this month and work through the prevention list. It is dull work, and it is considerably cheaper than the fortnight you would otherwise spend writing letters to a form.
