“My business’s Facebook account has been hacked, they have run ads I never created and Meta has charged several hundred euros to my card. Can I get that money back?”. You can, and the party that has to return it is your bank, because an ad you never ordered is an unauthorised payment and the payment services rules oblige the bank to refund it regardless of what Meta says. What happened to the account is, in addition, an offence of unlawful access to a computer system under article 197 bis of the Spanish Penal Code, and paying for someone else’s advertising with your card is computer fraud under article 249, so the three things to do are secure the account, block the card and report the crime, in that order and today.
My Facebook account has been hacked, what to do before calling anyone
If you can still log in, change the password from a device that is not compromised, close every open session from the security and login settings and switch on two-factor authentication. On a business account you have to go beyond the profile, because the attacker rarely stops there. Check who appears as an administrator of the page and of the Business Manager, who has access to the ad account and which payment method is stored. If there is a user you do not recognise, remove their access, pause the active campaigns and delete the card as a payment method, because as long as it stays there the ads keep being billed.
If you can no longer log in, Facebook keeps a recovery page for compromised accounts at facebook.com/hacked that works best from a browser or a phone where the account was previously open. When the attacker changes the email address or phone number, Meta sends a notice to the old address with a link to reverse the change for a short period, and that email is both the way back in and the first piece of evidence. Do not delete it and do not forward it to anyone who asks for it by message.
As for the card, call the bank, state that there are charges you did not authorise and ask for it to be blocked. Acting early matters, because Meta bills advertising in instalments as the budget is spent and every day that passes adds another charge. On the same call, ask for written confirmation of the date you notified them.
The evidence you will need later is lost within the first two days if nobody saves it. Take screenshots with a visible date of the login history, with locations and IP addresses, of the ads that were created and the ad account they were launched from, of the receipts in Meta’s billing section and of the card transactions. Keep Meta’s emails about password, email or administrator changes exactly as they arrived, without forwarding them, so that the headers are preserved. If someone writes offering to recover the account for a fee, or introduces themselves as “Meta support” by private message, do not pay and do not hand over codes, because that offer is almost always the second scam. Tell your customers through another channel, by phone, email or your website, that the page is no longer in your hands.
My Facebook and Instagram accounts were both hacked, why they fall together with the business page
Facebook and Instagram accounts are linked in the Meta Accounts Center, and the business page, the ad account and the card hang from a Business Manager that is accessed through its administrator’s personal profile. Whoever obtains that profile’s password holds, in practice, the keys to everything. That is why a hack that began with a personal email ends with cryptocurrency or fake shop ads paid with the company card and, very often, with the page renamed and posts that are no longer yours.
The way in is usually a deception rather than a security failure on Meta’s side. The most common are an email or message warning that the page infringes copyright or is about to be deactivated and leading to a form that imitates Meta’s, a direct message from a supposed support employee, a browser extension or downloaded file that steals session cookies and, in businesses with several collaborators, a password shared with an agency, a designer or an employee who no longer works with you. Identifying which door was used matters for the criminal complaint and also for the claim against the bank, because the bank will try to argue that you were the one who gave away the credentials.
The signs of an intrusion are recognisable. Emails from Meta warning of a login from a country you have not been to, an email or phone change you did not make, sessions open on devices you do not recognise, campaigns you do not remember creating, a new administrator on the page, messages sent from your account that you did not write and charges from “Facebk” or “Meta Platforms” on your statement that do not match your budget.
The ad charges on the card, what you ask Meta and what you demand from the bank
There are two separate claims and they should not be confused. Meta’s terms of service include a procedure to dispute advertising charges from within the ads manager, and it sometimes refunds the amount or credits it as ad spend, but it decides on its own criteria, is not bound by legal deadlines and frequently replies that the activity took place from a valid session of your account. That reply does not strip you of any right against the bank.
The claim with legal force is the one addressed to the bank that issued the card. A charge ordered by someone who got into your account without your consent is an unauthorised payment transaction, and the payment services rules oblige the bank to refund it without making the refund conditional on what Meta says. The card scheme, Visa or Mastercard, also has its own chargeback mechanism, a private rulebook with its own timings that the bank processes on your behalf. What usually happens is that the bank rejects the first request on the grounds that you were the one who left the card stored on the platform or failed to protect your credentials, and that is where the claim is won or lost, in how it is framed and with what documentation. That is the lawyer’s job, and at the firm we pursue these claims against banks within our bank fraud practice. I explain in another article what the bank is obliged to refund after phishing and when it is not.
Breaking into the account, running ads and charging them to your card, the offences under articles 197 bis, 249 and 401
What has happened to you has a name in the Spanish Penal Code, and the classification matters because it fixes the sentence, the limitation period and what can be claimed as civil liability from whoever is convicted.
Accessing your account without authorisation, by bypassing the password or using a stolen session, is the offence of unlawful access to an information system under article 197 bis.1, punishable by six months to two years in prison. It is committed even if the intruder does nothing further, and it is also committed by whoever stays inside against your will, the case of the former collaborator who kept the credentials. I cover a related situation in the article on a hacked business Instagram account with a ransom demand.
Using that account to run ads paid with your card is computer fraud under article 249.1 as amended by Organic Law 14/2022, which punishes both obtaining a non-consented transfer of assets through computer manipulation and carrying out transactions with the data of someone else’s card to the detriment of its holder. The sentence is that of fraud, six months to three years in prison, and if the amount defrauded does not exceed 400 euros it becomes a fine of one to three months as a minor offence. When the loss exceeds 50,000 euros or a large number of people have been defrauded, article 250 raises the sentence to one to six years in prison and a fine of six to twelve months.
If the attacker impersonates you to your customers, using your name and details to contract or collect payment in your place, the offence of usurpation of civil status under article 401 may be added, with six months to three years in prison. And if they write demanding money to return the account or to refrain from posting something from it, that is extortion under article 243, punishable by one to five years in prison. Paying guarantees nothing, except that they will ask again.
| Conduct | Article of the Penal Code | Sentence |
|---|---|---|
| Entering your account or remaining in it without permission | 197 bis.1 | Six months to two years in prison |
| Ads charged to your card or non-consented transfers | 249.1 (computer fraud) | Six months to three years in prison; fine of one to three months if under 400 euros |
| Fraud exceeding 50,000 euros or affecting many people | 250 | One to six years in prison and a fine of six to twelve months |
| Impersonating you to customers or third parties | 401 | Six months to three years in prison |
| Demanding money to return the account or not to post | 243 | One to five years in prison |
None of this troubles the intruder sitting on another continent, but it does matter in court, because the classification determines whether the case is investigated as an offence of some weight, whether connection data is requested from Meta and whether, if there is an intermediary in Spain, the money can be demanded from them.
Money has been requested from your customers through your page, who is liable
The account holder bears no criminal liability for what the intruder does from it. The offence is committed by whoever deceives, and you are another victim, not an accomplice. What does matter to you is that the date you lost control is recorded as early as possible, in the criminal complaint and in the notice to your customers, because the complaints filed by deceived customers will end up pointing at your page and that date is what separates you from the facts.
On the civil side, a customer who paid for an order into an account that was not yours may consider claiming against you. That claim would only succeed if negligence on your part with a direct link to the deception could be proven, which is not presumed from the mere fact of having been hacked, and having warned people quickly is what weakens it most. A customer who paid by bank transfer or Bizum also has their own claim against their bank and their own criminal complaint.
There is one front businesses tend to forget. If the page’s inbox or contact forms held customer data that the intruder accessed, your company is the controller of that data and the General Data Protection Regulation obliges you to assess whether the breach must be notified to the Spanish Data Protection Agency within seventy-two hours and, where applicable, to the affected individuals themselves. Failing to notify when it was due is what turns someone else’s incident into a fine of your own.
My Facebook account has been hacked, how and where to report it even if the perpetrator is abroad
The complaint is filed with the National Police or the Guardia Civil, at a police station or barracks, or directly with the duty court. The National Police accepts online reports for some offences, but they must later be ratified in person, and in a matter involving charges and a hijacked business page it pays to arrive fully prepared from the start. What you bring is the timeline of events, the screenshots of the login history with the IP addresses, Meta’s emails about the changes to the account, the advertising billing receipts, the statement showing the charges and the notice given to the bank with its date. A complaint that only says “my Facebook was hacked” is shelved within weeks because there is nowhere to start investigating. One that identifies the IP addresses, the ad account used and the time window allows the court to send Meta a request for connection data, which is the only serious route to putting a name on the perpetrator.
The hacker being in another country does not prevent you from reporting here. The Spanish Supreme Court applies the ubiquity doctrine to offences committed remotely, and the courts of A Coruña have jurisdiction because this is where you suffered the loss and where the payments were charged. That same complaint serves the claim against the bank and the dispute with Meta, and you want the criminal classification it contains to be the right one.
The time limit for reporting is set by article 131 of the Penal Code. Unlawful access, basic computer fraud and usurpation of civil status become time-barred after five years, aggravated fraud under article 250 after ten and fraud under 400 euros, as a minor offence, after one year. There is no legal rush to report, but there is a real one, because Meta keeps connection logs for a limited time and what is not requested early cannot be recovered.
When the perpetrator is not identified, the court orders a provisional stay. That closes nothing that depends on you. The claim against the bank runs its course independently of the criminal case, the dispute with Meta does too, and the case is reopened if the perpetrator or an intermediary in Spain later surfaces, which happens more often than it seems when the same network has attacked dozens of pages and another complaint traces the account where the money ended up.
My Facebook account has been hacked, how to recover it when Meta does not reply
Meta Platforms Ireland is the company you have a contract with in Europe, and its duty to deal with you arises from its own terms of service and from Regulation (EU) 2022/2065, the Digital Services Act, which requires large platforms to provide notification channels for illegal content, an internal complaint system against their decisions and a duty to give reasons. A page that impersonates your business or publishes fraudulent ads in your name is illegal content for the purposes of that regulation, and a formal notice through that channel carries more weight than the generic help form. The regulation sets no deadline for returning an account and does not guarantee that it will be returned, and I will not promise what the law does not say.
When the platform does not reply, or replies with an automatic refusal, the route is a formal claim to Meta, with the criminal complaint filed and the documentation proving that you are the legitimate holder, and afterwards, if the lockout drags on and the business has lost sales, a civil claim for damages. That second route requires proving the loss and the platform’s breach, and it is not worthwhile in every case. On data protection, if the intrusion was due to a security failure on the platform’s own side you may complain to the Spanish Data Protection Agency and seek compensation for the harm, but when the door was a phishing email that liability does not exist, and it is better to know that before spending time on it. At the firm we pursue these claims within our cybercrime practice, with the criminal complaint and the request to Meta drafted together so that each supports the other.
Frequently asked questions
My Facebook account has been hacked and I cannot log in, what do I do?
Go to facebook.com/hacked from a device where the account was previously open and follow the recovery process. Look in your email for Meta’s notice about the password or address change, because it includes a link to reverse it for a short period. In the meantime, block the card linked to the ad account and take screenshots of everything you see.
My Facebook account has been hacked and I cannot recover it, what are my options?
Report the crime and claim against Meta with the complaint in hand, through a formal notice rather than the help form. If Meta keeps the lockout, a civil claim for damages to the business is possible, but it requires proof of lost sales and only pays off when the page supported a real share of turnover. For a personal profile with no charges, the sensible course is to keep pressing for recovery and to report.
How do I report that my Facebook account has been hacked?
To the National Police, the Guardia Civil or the duty court, with the timeline of events, screenshots of the login history with IP addresses, Meta’s emails about the changes, the ad receipts and the card statement. The facts amount to unlawful access under article 197 bis and, if there were charges, computer fraud under article 249 of the Spanish Penal Code.
How do I know if my Facebook account has been hacked?
It is given away by Meta’s emails about logins from unknown places or password, email or phone changes you did not make, sessions open on devices you do not recognise, new ads or administrators on the page, messages sent in your name and Meta charges on your card that do not match your budget.
Do I have to report to the police if my Facebook was hacked, and what happens if I do not?
It is not compulsory, but without a complaint nobody will investigate, the bank will have one more argument to refuse refunding the charges and, if your customers were defrauded from your account, there will be no official record of the date you lost control. The offence becomes time-barred after five years, but the connection logs that allow the perpetrator to be identified are kept for far less time.
The step to take now is to file the criminal complaint with the evidence you have saved and, with that complaint, raise the claim for the charges against the bank before it closes your file with its first refusal. Both documents are drafted by the lawyer, because the criminal classification and the way the claim is framed are what decide whether the money comes back. At Perseus & RC Abogados we act for those who have suffered a hack with charges to their card, in court and against the bank. You can call +34 677 841 007 or write through the contact page, and we reply as soon as possible.