That red banner turns up without warning, and so does the charge you never made. Here is exactly what to do in the first 30 minutes, and the five-minute plan you set up today.
You log into Meta Business Suite to check how your ads are running. Instead, you get a red banner. “This ad account has been disabled.” Or worse, you can't log in at all, and your bank's just texted you about a $600 charge you didn't make.
Either way, your first thought is the same: what do I do right now?
A Melbourne gym owner found out the hard way. Her hacked account was used to run a $20,000-a-day campaign on a page she had never heard of, and she was locked out for nine months. Most owners never plan for this. They should. Here is the 30-minute version, plus the five-minute version you set up today so you are never starting from zero.
Banned or hacked? They're different problems
A disabled or restricted account is Meta's own doing. It's usually triggered by a policy violation, a payment or verification issue, or being linked to another account that's already been flagged. You'll get a notification explaining why, even if the explanation is vague.
A hacked account is someone else's doing. Warning signs include a password or email you didn't change, admin roles you don't recognise, a new payment method on the account, or ad spend you never authorised. If your social posting and paid campaigns run through the same Meta assets, check both before you assume it's a billing glitch.
Knowing which one you're dealing with matters, because the fix is completely different.
If you've been hacked, here's what to do first
- →Call your bank before you do anything else. Block further Meta charges and ask for a new card. Business owners in Australia have consistently recovered unauthorised ad spend through their bank faster than through Meta itself.
- →Go to facebook.com/hacked (or instagram.com/hacked) from a device you've logged in on before. Reset your password and check “Where you're logged in” for sessions you don't recognise.
- →Remove any admin you don't recognise in Business Settings under People, and delete any automated ad rules you didn't create.
- →Turn on two-factor authentication for every admin, using an authenticator app rather than SMS. SMS codes can be intercepted through SIM-swapping.
- →Screenshot everything before you fix it, including ad spend, admin changes and login alerts. You'll want this for both Meta and your bank.
Ready to grow?
Book a free strategy session with a local specialist.
If your account's been disabled, here's what to do first
- →Read the exact wording of the notification. It tells you whether it's your ad account, your personal profile or your whole Business portfolio that's been flagged. That changes what you fix.
- →Open Account Quality through Business Support Home and check what's actually being flagged. Ignore the urge to guess.
- →Fix the real cause first. Remove the ad or asset that triggered it, or resolve whatever payment or verification issue is showing.
- →Submit one request for review. Not five. Meta treats repeated appeals as suspicious, and a professional, factual appeal reads better than a frustrated one.
- →Don't create a new account while you wait. Meta calls this circumvention, and it can get both accounts permanently banned. You've got 180 days to appeal, so there's no need to panic into a workaround.
Here is some genuinely good news buried in Meta's own numbers. In the first half of 2025, 80% of Facebook users and 85% of Instagram users who started the guided recovery process finished it and got their restrictions removed. Appeals aren't hopeless. They just need to be done properly, once, with the actual issue fixed first.
Why Australian businesses are getting hit so hard
This isn't a one-off. It's a trend, and the Ombudsman, Australia's free dispute service for small business, has watched it build. In one recent quarter, 73% of the disputes that came through its office involved Meta-owned platforms, and nearly two-thirds of those were about a hacked account. The Ombudsman called it the fastest-growing area of dispute his office handles. In 2025 alone, the office helped 482 small businesses sort out problems with their social accounts.
Part of the reason is a phishing wave that's genuinely hard to spot. In late 2025, a campaign sent roughly 40,000 phishing emails to about 5,000 businesses across the US, Europe, Canada and Australia. The trick is that the emails arrive from Meta's own facebookmail.com domain, which is genuinely used for Business Suite invites. So the usual advice, check the sender's address, doesn't save you here. If an email asks you to review a policy violation or confirm your account, go to Meta Business Suite directly instead of clicking the link.
One more thing worth saying clearly. Meta doesn't run a public phone line for customer support, full stop. If you find a phone number promising to fix your ad account, it's not Meta. It's a scam sitting on top of your panic.
Build your lockout plan before you need it
The businesses that get back up fastest are the ones who had this sorted before anything went wrong. It takes about five minutes:
- →Save your Business portfolio ID and every ad account ID somewhere off-platform, like a password manager.
- →Keep a second trusted admin on the account. Never let one personal profile be the only way in.
- →Turn on two-factor authentication for every admin now, not after something happens.
- →Keep a record of the payment method on file, so you notice fast if it changes.
- →Secure the email address tied to the account with its own strong password and 2FA.
If your admin access already went sideways once, our guide on regaining control after an ex business partner locks you out walks through the exact recovery steps. If you are rebuilding your setup from scratch, our guide to Meta Business Suite and Facebook business pages covers doing it properly. And if scam emails are the bigger worry, our guide to small business scam protection in Australia covers the email, bank and ads side of it.
What to do today
Don't wait for the red banner. Open Business Settings right now, check who has admin access, and turn on two-factor authentication if it isn't already. It takes less time than reading this post did.
Being locked out of one account is a good reminder of how much rides on your online presence altogether, not just your ads. If you'd like an outside view of what's working and what's not, we run free strategy sessions where a specialist looks at the whole picture with you. Book a strategy session to find out where the gaps are.