How We Recovered a Hacked Meta Business Account for a Local Business — Dermaluxe Beauty

The Problem: A Hacked Meta Business Account Bringing Ads to a Halt

Dermaluxe Beauty, an Australian beauty and aesthetics business, woke up one day to find their Facebook Business Manager account had been compromised. Within hours, they had lost admin access to their Facebook Page, their ad accounts were frozen, and their Instagram integration had broken — taking their entire paid advertising operation offline.

Despite spending numerous hours attempting to resolve the issue, and engaging their own marketing team, Meta’s standard support channels provided no resolution. Every day without ads meant lost revenue and lost customers.

They needed a specialist to navigate Meta’s complex account recovery process — fast.

The Challenge: More Than Just a Hacked Account

What appeared to be a straightforward account hack quickly revealed several layers of complexity:

• The hacked Business Manager  still held the Facebook Page and Instagram assets
• A connected commerce account was blocking Instagram from being linked to the new Business Manager
• A Meta platform-level backend bug was silently failing to save page permission assignments
• The Instagram account had become trapped inside a separate, legacy Business Manager under a different email address
• Meta’s mandatory waiting periods (7–10 days for new admins) added unavoidable delays to the recovery timeline.

Our Process: Step-by-Step Meta Account Recovery

Step 1: Initial Audit and Asset Mapping

We started with a full diagnostic call and screen-share session with the client to map every broken asset and connection. This revealed that Instagram was still attached to the compromised Business Manager via a commerce account — which was why all reconnection attempts on the new page were failing.

Step 2: Opening a Formal Meta Support Case

We engaged Meta support directly, working with an agent via screen-share to confirm the nature of the issue. The diagnosis was clear: this required a formal Business Manager Admin Dispute submission.

We prepared a dispute package in line with Meta’s official guidelines, including:

• A formal dispute letter requesting restoration of admin access
• ASIC company registration documents
• Bank statements matching the registered business details
• Supporting identification documents

All documents were compiled into a single PDF, signed, and submitted to Meta’s Admin Dispute team.

Step 3: Navigating Meta’s Document Requirements

Meta’s document submission process required several rounds of resubmission.  

Persistence and attention to detail here were critical — minor inconsistencies between documents are a common reason Meta rejects dispute submissions.

Step 4: Escalating a Backend Platform Bug

Even after partial access was restored to the Business Manager, a new problem emerged: the “Assign People” function for Facebook Page assets was failing silently. The UI appeared to save changes, but nothing was being committed on Meta’s backend.

We filed a formal technical escalation request documenting the issue as a backend API synchronisation error — confirmed to be platform-side, not a browser or local configuration issue. We requested a manual override from Meta’s technical team and provided a full written summary of findings to support the case.

Step 5: Locating and Releasing the Locked Instagram Account

Investigation revealed the Instagram account was sitting inside a separate legacy Business Manager, tied to a different email address entirely. This explained why all standard reconnection attempts had failed.

Working directly with a Meta specialist, and coordinating with the relevant account holder to obtain verification codes, we successfully:

• Located the Instagram account within the legacy Business Manager
• Released it from that account
• Re-added it to the correct, new Business Manager
• Assigned the correct users to all assets

Step 6: Migrating the Facebook Page and Cleaning Up Assets

With Instagram resolved, we turned to the Facebook Page. We:

• Unlinked the Page from the hacked Business Manager’s dataset
• Removed the Page from the compromised account
• Waited out the mandatory one-week new-admin period required by Meta
• Added the Page to the new Business Manager
• Deactivated the conflicting commerce account to clear the final Instagram connection error

The Results: Full Access Restored, Ads Back Online

After a structured, methodical recovery process, Dermaluxe Beauty had their full Meta capability restored and most importantly recovered their old page.

• Business Manager access reinstated — admin dispute resolved, ownership formally documented with Meta
• Instagram reconnected — account located, released, and correctly linked to the new Business Manager
• Ads back online — all ad accounts and original Page assets correctly assigned with no remaining blockers
• Asset structure cleaned up — commerce account deactivated, broken links resolved, all users assigned to the correct roles.

Time taken to finalise: 14 April to 4 June – 14hrs

Frequently Asked Questions About Meta Business Manager Recovery

How long does a Meta Business Manager admin dispute take? The timeline varies, but most disputes take between two and six weeks when documents are submitted correctly. Meta also imposes mandatory waiting periods — for example, new page admins must wait seven days before certain actions can be taken.

Can Meta recover a hacked Business Manager? Yes, but only through a formal admin dispute process. This requires submitting identity and business verification documents through Meta’s specialised support channel — not standard Help Centre support.

What documents does Meta require for an admin dispute? Typically Meta requires proof of business registration (such as an ASIC certificate in Australia), a signed letter requesting admin access restoration, and supporting financial documents such as a bank statement. All details must match exactly across documents.

What if Instagram won’t connect to a new Business Manager? This is usually caused by the Instagram account still being attached to the old or compromised Business Manager, or a connected commerce account blocking the link. Resolving it requires tracing where the Instagram account is currently sitting and formally releasing it.