Skip to main content

Under attack · TikTok ads

TikTok Ads account hacked? Start here.

Choose what was affected and follow the relevant steps to contain unauthorized spend, recover access, inspect connected assets and secure the account.

Find my recovery pathContact TikTok Business Support (opens in a new tab)

If a TikTok representative manages your account, contact them first. Ad Assistant is login-gated, but TikTok’s Business Support article also explains its current route for someone unable to log in. Use the login-troubleshooting article alongside it when registered recovery methods are unavailable.

Is unauthorized spend still active?

If you still have access, pause any suspicious campaigns and check whether other campaigns, or other advertiser accounts, are also spending. If another trusted administrator still has access, ask them to contain the activity and restrict the compromised user immediately.

If you have already lost access, do not spend time trying to force a pause. Go to the recovery path that matches your situation and ask any remaining Business Center Admin to contain the spend for you.

Before you go further

  • AdFence is an independent advertising-security platform. It is not TikTok, is not affiliated with or endorsed by TikTok, and cannot access, restore or recover your account through this guide. Account access, suspension, investigation and reimbursement decisions remain with TikTok.
  • This guide cannot promise account recovery, the identification of whoever did this, the reversal of a suspension, or the removal of any charge. It sets out the order to work in and what to record.
  • Never type a password, verification code, recovery code, payment-card number, identity document or the contents of a support case into this page or send them to AdFence. Nothing on this page asks for them, and no legitimate recovery route needs them from a third party.
  • Which TikTok support routes you are offered depends on whether you can still sign in, your role, your region, your account type, whether a TikTok representative manages your account, and your eligibility. Work through the routes below in order rather than expecting a particular chat, form or ticket to appear.
  • TikTok Shop and Seller Center are a separate system from TikTok Ads Manager, and TikTok Shop operates in some markets only. If the Shop itself was taken over, use the Shop support route on this page for it. This is an advertising guide and does not cover Shop recovery.
  • Everything on this page is readable without an account, a signup or an email address.

Last reviewed . Official TikTok destinations and menu names on this page are reviewed every quarter.

Do these first, whichever TikTok setup you use.

These four apply before the account-specific recovery paths below.

  1. 01

    Contain unauthorized spend

    Review every active campaign, ad group and ad, and pause anything you cannot verify. If the attacker is still making changes, stopping delivery comes before a perfect investigation.

    • Anything you did not create
    • An unfamiliar ad identity
    • An unexpected budget
    • An unfamiliar location
    • An unfamiliar destination
    • Activation at an unusual time
    • An unknown catalogue or product set

  2. 02

    Secure the login and the connected email

    Secure the TikTok for Business account and the email address or phone number attached to it. If the mailbox is compromised, secure it before relying on verification codes or reset messages.

    • Password
    • Registered email
    • Registered phone number
    • 2-step verification
    • Authorized devices
    • Email recovery settings
    • Email forwarding rules
    • Unknown login sessions

  3. 03

    Contact TikTok through an official route

    Do not wait until the audit is finished. Which route is open to you depends first on whether you can still sign in.

    • Managed advertiser: your assigned TikTok representative
    • Unmanaged advertiser who can sign in: TikTok Business Support
    • Locked out, or the registered email or phone is gone: the login-troubleshooting article
    • Suspended advertiser account: the notice shown inside Ads Manager

  4. 04

    Preserve the essential evidence

    Capture what you can see before removing suspicious users or changing settings, where that is practical. Do not delay urgent containment solely to collect screenshots.

    • Business Center ID
    • Advertiser account ID
    • TikTok account username and ID
    • Unknown members or partners
    • Campaign, ad-group and ad IDs
    • Budget and targeting changes
    • Destination URLs
    • Unauthorized spend and transaction IDs
    • Payment-method changes
    • Timestamps
    • Relevant emails from TikTok
    • Support case numbers

Four different TikTok accounts, and only one of them is the public profile.

Most people arrive here saying their TikTok account was hacked. Which of these four was actually reached decides the recovery route, so name it before you pick a path.

  1. TikTok account (the public profile)

    The profile used for organic content, identity and Spark Ads. It is recovered through TikTok’s consumer support, not through Ads Manager.

  2. TikTok for Business login

    The login identity used to reach TikTok Ads Manager and the other TikTok for Business tools. One login can reach several advertiser accounts and more than one Business Center.

  3. Advertiser account (TikTok Ads Manager)

    The individual account where campaigns, ad groups, ads, budgets, targeting and billing live. Its roles are currently Admin, Operator and Analyst.

  4. TikTok Business Center

    The central layer that manages members, partners, advertiser accounts, TikTok accounts, pixels, catalogues, audiences, leads, Shops and finance access. Membership and asset-level permission are two separate grants.

A compromise rarely stays inside one layer. A stolen login reaches every advertiser account and Business Center it was a member of, and a compromised profile can still be running Spark Ads from an account you have already secured.

Which part of your TikTok setup was compromised?

Select one or more. A compromised login can reach several advertiser accounts and more than one Business Center, so the paths below open in the order they should be worked through.

Select everything that happened.

No recovery paths selected yet.

Your selection is saved only in this browser, on this device. It is never sent to AdFence.

Recovery paths

Open the path that matches your situation. Any path can be opened at any time, and more than one usually applies.

Not sure yet is a valid answer. Every recovery path can be opened below, and the full post-recovery audit lists what to check across the whole setup.

Go to the full post-recovery audit

Path 1

TikTok for Business login compromised

The login identity that reaches Ads Manager, your advertiser accounts and Business Center.

When this path applies

  • The password no longer works
  • The registered email or phone number changed
  • Verification codes do not arrive
  • An unfamiliar authorized device appears
  • Unexpected security notifications arrive
  • The login can no longer reach advertiser accounts or Business Centers

  1. Step 1. Contact TikTok through the route that matches your situation

    TikTok’s account-security guidance tells advertisers to report a suspected compromise immediately, and says TikTok may suspend the affected account while it investigates. Which route is open to you depends first on whether you can still sign in.

    • Managed advertiser: contact your assigned TikTok representative first
    • Unmanaged advertiser who can still sign in: follow TikTok’s current Business Support instructions, including the Ad Assistant entry inside TikTok for Business
    • Unable to sign in: start with TikTok’s login-troubleshooting article
    • Public TikTok profile taken over: that is a separate consumer support route

    Ad Assistant requires a working TikTok for Business session. TikTok’s Business Support article also describes a Feedback and Help route for someone unable to log in, while the login-troubleshooting article covers lost recovery methods. Availability varies by role, region, account type, whether a TikTok representative manages the account, and eligibility. No route is guaranteed to be available to every advertiser.

  2. Step 2. Recover the registered email address and phone number

    Confirm both are still under legitimate control. If the mailbox itself is compromised, secure it before relying on verification codes or password-reset messages.

    • Password changes
    • Unknown sessions
    • Recovery addresses
    • Recovery phone numbers
    • Deleted messages from TikTok
    • Email forwarding rules
    • Inbox filters
    • Spam, trash and archive folders

  3. Step 3. Change the TikTok for Business password

    • Unique to TikTok for Business
    • Not reused from another service
    • Not shared between team members
    • Stored in a password manager

    Do not simply add a number to the previous password.

  4. Step 4. Turn on 2-step verification

    Open TikTok for Business User Settings, select Account Security, and configure the verification methods your account offers. TikTok currently recommends 2-step verification for TikTok for Business accounts.

  5. Step 5. Review authorized devices

    Open TikTok for Business User Settings and remove any browser or device you do not recognize.

    TikTok describes authorized devices as able to skip repeated verification prompts on that device and browser. The feature is described as in testing and may not be available on your account, so treat its absence as normal rather than as evidence of tampering.

  6. Step 6. Inspect every Business Center and advertiser account the login could reach

    One login commonly reaches several advertiser accounts and more than one Business Center. Work through the Ads Manager and Business Center paths even if you have not yet seen unauthorized advertising.

My login is secure. Check my advertiser accounts next.

Path 2

TikTok Ads Manager advertiser account compromised

You can still sign in, but the advertiser account holds activity you did not create.

When this path applies

  • The login still works
  • Unfamiliar campaigns, ad groups or ads appear
  • Budgets, bids or targeting changed
  • Landing pages or tracking links changed
  • Charges you do not recognize appear

  1. Step 1. Stop suspicious delivery

    Pause anything you cannot verify. If the attacker is still making changes, containment comes before a perfect investigation.

    • Campaigns
    • Ad groups
    • Ads
    • Schedules
    • Daily and lifetime budgets
    • Bid settings
    • Optimization goals
    • Automated rules, where you use them

  2. Step 2. Inspect what changed

    • New campaigns
    • Reactivated campaigns
    • Large budget increases
    • Changed bid strategy
    • Unfamiliar objectives
    • New ad identities
    • Unfamiliar videos or creative
    • Changed landing-page URLs
    • New catalogue or product ads
    • Changed tracking links
    • Changed targeting or locations

  3. Step 3. Review who can reach the account

    If the advertiser account is managed through Business Center, the access list is in two places at once: the people assigned to the account, and the partners the Business Center shares it with.

    • Business Center members
    • Users assigned to the advertiser account
    • Partner access
    • Account Groups
    • Asset assignments
    • Ownership

    TikTok advertiser-account permissions currently include Admin, Operator and Analyst. Admins manage account settings, Operators can create and edit advertising without managing those settings, and Analysts have reporting access without campaign editing.

  4. Step 4. Confirm who owns the advertiser account

    Business Center distinguishes an advertiser account it owns from one owned by a partner, and administrators can filter the advertiser-account list by ownership and by status, including approved, suspended and disabled.

    • The owning Business Center
    • The Business Center currently managing it
    • Partner businesses with access
    • People assigned directly to the account
    • Who controls billing
    • Who raises the support case

    Ownership identifies the Business Center that owns the advertiser account. Permission changes, billing access and support actions still depend on each person’s Business Center role, advertiser-account permission, finance role, assigned assets, current access and the support workflow available. The advertiser-ownership question further down this page sets out what to check in each case.

  5. Step 5. Review billing and transactions

    • Payment methods
    • Account balance
    • Billing option
    • Transaction history
    • Billing threshold
    • Billing date
    • Credit-line allocation
    • Invoices
    • Unrecognized charges
    • Recent payment failures

    Business Center separates finance access into Finance Analyst and Finance Manager roles, and transaction, balance, billing and invoice access follows those permissions rather than Business Center membership.

  6. Step 6. Inspect the connected assets

    • TikTok accounts
    • Pixels
    • Catalogues
    • Audiences
    • Leads
    • Shops
    • Account Groups
    • Shared assets
    • Partner-owned assets

    If a TikTok Shop or Seller Center account was taken over, that is a separate system with its own support route, and TikTok Shop operates in some markets only. Use the Shop route for the Shop, and keep using this page for the advertising side.

  7. Step 7. Report it to TikTok with the facts attached

    • TikTok for Business login email
    • Business Center ID
    • Advertiser account ID
    • Suspicious campaign IDs
    • The unauthorized amount and the currency
    • The date and time you discovered it
    • Screenshots
    • Unknown members or partners
    • Actions you have already taken
    • Whether suspicious delivery is still running
    • TikTok for Business: contact Business Support (opens in a new tab)

      TikTok’s current instructions for reaching Business Support. Ad Assistant requires a working TikTok for Business session, while the article also describes a Feedback and Help route for someone unable to log in. The exact routes offered vary by role, region, account type and eligibility. If a TikTok representative manages your account, contact them first.

Delivery is contained. Check the Business Center next.

Path 3

TikTok Business Center compromised

The central layer for members, partners, advertiser accounts, assets and finance access.

When this path applies

  • Unknown members appear
  • A member was promoted
  • An unfamiliar partner is connected
  • Advertiser accounts or assets were added
  • Permissions changed
  • Finance access changed
  • A new advertiser account appeared
  • The legitimate administrator lost access

  1. Step 1. Identify the remaining trusted administrator

    A Business Center Admin can add or remove members and partners, create or request advertiser accounts, assign assets, control security settings and manage business verification. Confirm which legitimate Admins still have access, and do not remove the last one.

  2. Step 2. Review every member

    • Email address
    • Business Center role
    • Assigned accounts
    • Assigned assets
    • Date added, where it is shown
    • Finance permissions
    • Whether the person still works with the business
    • Whether that person’s own identity may be compromised

    Business Center uses Admin and Standard member roles. Standard members reach only what is assigned to them. Record identifying details before removing anyone, where that is practical.

  3. Step 3. Review the finance roles separately

    Finance permissions are separate advanced roles, so a Business Center Admin does not automatically hold every financial access.

    • Finance Analyst
    • Finance Manager
    • Recent transactions
    • Billing changes
    • Invoice access

  4. Step 4. Review the connected partners

    An unfamiliar member and an unfamiliar partner are two different access paths. Removing one does not remove the other.

    • Partner name
    • Partner Business Center ID
    • Assets shared to the partner
    • Advertiser-account access
    • TikTok-account access
    • Pixel access
    • Catalogue access
    • Audience access
    • Finance or media-agency relationships
    • Whether the partnership is still legitimate

  5. Step 5. Review account and asset permissions

    TikTok supports account-level and asset-level permissions, so a membership list alone does not show the full access a person or a partner holds.

    • Advertiser accounts
    • TikTok accounts
    • Shops
    • Pixels
    • Catalogues
    • Audiences
    • Leads
    • Account Groups

  6. Step 6. Review every advertiser account, not only the noisy one

    • Newly created advertiser accounts
    • Partner-owned accounts
    • Accounts transferred into the Business Center
    • Suspended accounts
    • Disabled accounts
    • Accounts with activity nobody recognizes
    • Accounts the legitimate team does not use

  7. Step 7. Review the Business Center security settings

    • The 2-step verification requirement
    • Email domain allowlist
    • Approved email domains
    • Business verification
    • Administrative users
    • Account-recovery contacts

    Business Center supports 2-step verification controls and an email domain allowlist that restricts invitations to approved domains.

  8. Step 8. Review the Enterprise structure, where one exists

    An Enterprise Business Center can hold several tiers and centralize user, security, reporting and finance controls across Standard Business Centers, so access can be granted a level above the one you are looking at.

    • Parent Enterprise Business Center
    • Child Business Centers
    • Standard Business Centers
    • Cross-region access
    • Finance hierarchy
    • Central security settings
    • Claimed Business Centers

The Business Center is under control. Check the connected TikTok profile.

Path 4

Connected TikTok profile taken over

The public TikTok account used for organic content, identity and Spark Ads.

When this path applies

  • The password or phone number changed
  • The username or nickname changed
  • Videos were deleted
  • Videos were posted without permission
  • Messages were sent without permission
  • The bio or website link changed
  • Unknown devices appear
  • The Spark Ads or advertising identity changed

  1. Step 1. Reset the TikTok account password

    In the TikTok app: open Profile, then Menu, then Settings and privacy, then Account, then Password.

    TikTok names changed passwords, changed account information, unauthorized posts and unauthorized messages as signs that a TikTok account may have been hacked.

  2. Step 2. Secure the email address and the phone number

    Confirm both are legitimate and under the owner’s control. TikTok recommends keeping more than one contact method, so a single compromised one is not the only way back in.

  3. Step 3. Remove unfamiliar devices

    In the TikTok app: open Profile, then Menu, then Settings and privacy, then Security and permissions, then Manage devices.

    TikTok advises changing the password after removing an unrecognized device.

  4. Step 4. Run Security Checkup

    • Verified email address
    • Verified phone number
    • 2-step verification
    • Trusted devices
    • Security activity
    • Passkey, where it is available

  5. Step 5. Review what changed on the profile

    • Videos
    • Drafts
    • Deleted content
    • Messages
    • Comments
    • Bio
    • Website link
    • Username
    • Connected accounts
    • Commercial settings
    • Shop links

  6. Step 6. Review the profile’s advertising relationships

    Then review every live ad running under that identity.

    • Business Centers it is assigned to
    • Advertiser accounts using it
    • Partner Business Centers
    • Spark Ads
    • Catalogue or Shop advertising
    • People with ad-delivery or broader account permissions

  7. Step 7. Continue with the Business Center audit

    Securing the public profile does not prove that advertiser-account and Business Center access is clean. They are separate grants.

The profile is secure. Continue with the full post-recovery audit.

Path 5

Advertiser account suspended after suspicious activity

Enforcement and compromise are two different findings, and the order of work matters.

When this path applies

  • The advertiser account was suspended after unfamiliar activity
  • Enforcement followed campaigns you did not create
  • Ads Manager is showing a review or an appeal prompt
  • Delivery stopped without a change you made

  1. Step 1. Secure the compromised access before you appeal

    An appeal is not a containment step. If an unauthorized person may still hold access, appealing on its own leaves them there.

    • TikTok for Business login
    • Registered email
    • Registered phone number
    • Business Center members
    • Partners
    • Advertiser-account permissions
    • Authorized devices

    A suspension is an enforcement decision, not proof that your account was compromised, and a compromise is not always what triggered one. Work out which you are dealing with before you describe it to TikTok.

  2. Step 2. Read what the suspension actually says

    TikTok currently routes advertising-policy suspensions through the Account Health page in Ads Manager, and other enforcement can point to Account Settings instead. Read the notice inside your own account rather than assuming which one applies to you.

    • The stated reason
    • The date and time
    • The affected advertiser account
    • The relevant campaigns
    • The unauthorized changes
    • Any documents requested
    • Any deadline the notice states

  3. Step 3. Submit one appeal that explains the compromise

    • That the advertiser account may have been compromised
    • Which activity was unauthorized
    • When it began
    • When the account was secured
    • Which members or partners were removed
    • Which campaigns were paused
    • Which charges are disputed
    • Which supporting documents are attached

    Submitting an appeal does not guarantee that an account is restored. TikTok decides the outcome, and nothing on this page can influence it.

  4. Step 4. Track the appeal in one place

    TikTok’s current Account Health process lets an advertiser submit an appeal, follow its status and reply to the review team.

    If TikTok asks for more information, the current appeal interface gives 48 hours to reply. That is the only response window the interface states. TikTok publishes no general reply time for appeals or support cases, so do not plan around one.

  5. Step 5. Do not file competing appeals

    Use the existing appeal and the existing support case rather than opening several with different explanations of the same incident.

The appeal is in. Continue with the full post-recovery audit.

Path 6

Lost access to everything

No route into the login, Ads Manager, Business Center or the connected profile.

When this path applies

  • You cannot reach the TikTok for Business login
  • You cannot reach TikTok Ads Manager
  • You cannot reach TikTok Business Center
  • You cannot reach the registered email or phone number
  • You cannot reach the connected TikTok profile

  1. Step 1. Start support and containment in parallel

    • Managed advertiser: contact your assigned TikTok representative
    • Unmanaged advertiser who can still sign in: follow TikTok’s current Business Support instructions
    • Locked out of TikTok for Business: use the Business Support and login-troubleshooting instructions, including for a lost registered email or phone number
    • Public TikTok profile taken over: use the consumer account-recovery route

    Do not wait for one route to finish before asking a remaining trusted administrator to contain active spend. Which support entry points appear depends on your login state, role, region, account type, whether a TikTok representative manages the account, and eligibility.

  2. Step 2. Ask a remaining trusted administrator to contain it

    If another legitimate Business Center Admin still has access, they can act while you recover.

    • Pause suspicious campaigns
    • Remove or restrict the compromised member
    • Remove unfamiliar partners
    • Review the finance roles
    • Preserve account and transaction records
    • Contact TikTok
    • Stop any further asset sharing

  3. Step 3. Secure any recovery method you can still reach

    Secure the registered email or phone number if it is still available. If the registered mailbox is compromised, recover it before relying on password-reset or verification messages sent there. This runs alongside support contact and trusted-admin containment; it is not a prerequisite for either.

  4. Step 4. Gather identifiers from outside the account

    Invoices, billing emails, TikTok notifications, agency records and earlier support cases carry the identifiers you can no longer read from inside.

    • TikTok for Business email
    • Business Center ID
    • Advertiser account IDs
    • TikTok profile username
    • TikTok account ID
    • Campaign IDs
    • Billing invoices
    • Transaction IDs
    • Payment-method details
    • Partner Business Center IDs
    • Previous support cases

  5. Step 5. Keep one incident timeline

    • When access was lost
    • When unauthorized activity began
    • Which accounts and assets were affected
    • Who still has access
    • Which campaigns are still running
    • Which support route was used
    • Every case number and reply

Access is coming back. Continue with the full post-recovery audit.

Who owns the advertiser account?

TikTok Business Center distinguishes an advertiser account owned by your own Business Center from one owned by a partner. Ownership affects who can change sharing and partner permissions; billing and support actions also depend on assigned roles, access state and the workflow TikTok offers.

Advertiser-account ownership

All three answers are shown. Choose one to narrow this to your situation.

This answer is not saved, and it does not change which recovery paths are open. All three answers are shown until you pick one.

Your Business Center owns the account

An Admin in the owning Business Center can review members, partner access and asset-level permissions, then change sharing or partner permissions where their role allows. Confirm separately who has the advertiser-account, finance and support access needed for the remaining actions.

  • An Admin in the owning Business Center can change member and partner access where TikTok grants that permission
  • Advertiser-account roles determine who can change account settings and campaign delivery
  • Finance roles determine who can view or manage billing
  • Confirm which authorized user can access TikTok’s available support workflow and keep the case number
  • Keep suspicious campaigns paused while the authorized account users audit

Being an Admin does not automatically give you finance permissions. Finance Analyst and Finance Manager are separate roles, so check them before assuming the billing view in front of you is the whole picture.

A partner or an agency owns the account

An Admin in the owning Business Center may be required to change sharing or partner permissions. Whether you or the owner can pause delivery, view or manage billing, or use a support workflow depends on each person’s assigned roles and current access. Tell the owner immediately, then agree who does what.

  • Notify the owning partner or agency immediately
  • Confirm who can pause delivery right now
  • Confirm who can remove members and partner access
  • Confirm who controls the payment method and the invoices
  • Confirm who contacts TikTok and holds the case number
  • Ask for the campaign, budget, targeting and destination changes in writing

Removing an individual member does not remove a partner’s access, and removing a partner does not remove a person assigned directly to the account. Check both lists; some sharing and partner-permission changes require an Admin in the owning Business Center.

You are not sure who owns it

Do not wait on the answer. Contain the spend first, then establish ownership from the account itself.

  • Filter the advertiser-account list in Business Center by ownership and by status
  • Compare the Business Center listed as owner with the one currently managing the account
  • Check which business receives the invoices
  • Ask whoever originally set the account up
  • Until you know, ask every party who may hold Admin to pause delivery

Ownership is a fact about the account, not a judgement about who is at fault. Establish it before agreeing with anyone about who is contacting TikTok.

Regaining access does not mean the incident is over.

Once access is restored, inspect the complete TikTok advertising setup before resuming campaigns.

Login and devices

  • TikTok for Business password
  • Registered email
  • Registered phone number
  • 2-step verification
  • Authorized devices
  • TikTok profile devices
  • Email sessions
  • Recovery methods

Business Center access

  • Admin members
  • Standard members
  • Finance Analysts
  • Finance Managers
  • Partner Business Centers
  • Account Groups
  • Asset assignments
  • Inactive users
  • Former agencies
  • Former employees

Advertiser accounts

  • Owned accounts
  • Partner-owned accounts
  • New accounts
  • Suspended accounts
  • Disabled accounts
  • Account settings
  • Assigned members
  • Assigned partners

Campaigns and spend

  • Campaigns
  • Ad groups
  • Ads
  • Budgets
  • Bids
  • Objectives
  • Schedules
  • Automated rules
  • Spend by day
  • Spend by account
  • Newly activated advertising

Targeting and delivery

  • Countries
  • Regions
  • Languages
  • Audiences
  • Placements
  • Devices
  • Demographics
  • Optimization events
  • Exclusions

Creative and identity

  • TikTok identities
  • Spark Ads
  • Videos
  • Ad text
  • Calls to action
  • Display names
  • Profile links
  • Landing-page URLs
  • Tracking parameters

Data and commerce assets

  • Pixels
  • Events
  • Catalogues
  • Product sets
  • Audiences
  • Leads
  • Shops
  • Ecommerce integrations
  • Shared data assets

Billing and finance

  • Payment methods
  • Transactions
  • Account balances
  • Credit lines
  • Billing groups
  • Invoices
  • Billing threshold
  • Billing date
  • Finance permissions
  • Unrecognized charges

Do not restart campaigns simply because access has been restored. Resume advertising only after permissions, campaigns, targeting, identities, destinations, tracking, assets and billing have been verified.

Give TikTok a clear incident record.

TikTok support should be able to see what happened, which activity was unauthorized, and what financial impact is being disputed.

Information to collect

  • TikTok for Business login email
  • Business Center ID
  • Advertiser account ID
  • TikTok profile username
  • Campaign IDs
  • Ad-group IDs
  • Ad IDs
  • The first suspicious event
  • The time the incident was contained
  • Unknown members
  • Unknown partners
  • Permission changes
  • Budget changes
  • Destination changes
  • The unauthorized amount
  • The currency
  • Payment transaction IDs
  • Screenshots
  • TikTok notifications
  • The support case number
  • Actions already taken

A timeline in this shape is enough

  1. 01:42Unknown Business Center member added
  2. 01:48Member assigned to an advertiser account
  3. 01:55New campaign created
  4. 02:02Daily budget increased
  5. 02:08Landing-page destination changed
  6. 07:14Incident discovered
  7. 07:19Campaigns paused
  8. 07:31Unknown member removed
  9. 08:05TikTok support contacted

Then write it as one short statement

  1. 1.What was compromised
  2. 2.Which accounts and assets were affected
  3. 3.Which activity was unauthorized
  4. 4.How much was spent
  5. 5.When the incident began and ended
  6. 6.Which containment steps were completed
  7. 7.Which resolution you are asking for

TikTok describes a compromised-account process that can include investigating unauthorized activity and reimbursing charges it determines resulted from that activity. That is a description of a process, not an entitlement. Eligibility, the amount, the timing and the outcome are decided by TikTok and the relevant payment provider, and nothing on this page can promise a reimbursement or say when one would arrive. If you are considering a payment dispute with your card issuer, speak to TikTok and to your issuer directly. A dispute can affect billing and account standing, and nothing on this page is legal or financial advice.

Close every route back into the account.

TikTok for Business

  • Use a unique password
  • Secure the registered email
  • Verify the registered phone number
  • Turn on 2-step verification
  • Remove unfamiliar authorized devices
  • Review recovery access
  • Never share one login between team members

Business Center

  • Require 2-step verification
  • Turn on the email domain allowlist
  • Limit the number of Admins
  • Use Standard roles where they are enough
  • Remove inactive members
  • Review partners regularly
  • Remove former agencies
  • Review asset assignments
  • Separate the finance permissions
  • Keep more than one trusted administrator

Advertiser account

  • Reserve Admin access for trusted operators
  • Give campaign operators only what they need
  • Use Analyst access for reporting-only users
  • Review Account Groups
  • Verify who owns each advertiser account
  • Document client and agency ownership
  • Remove permissions after every staffing or agency change

Finance

  • Limit Finance Manager access
  • Use Finance Analyst where a view-only role is enough
  • Review payment methods
  • Review billing thresholds
  • Download transaction records regularly
  • Remove finance access during offboarding

TikTok profile

  • Run Security Checkup
  • Verify the phone number and the email address
  • Turn on 2-step verification
  • Review trusted devices
  • Review security activity
  • Add a passkey where it is available
  • Inspect the connected advertising relationships

TikTok recommends regular access reviews, removing inactive users, granting the minimum necessary permissions, 2-step verification and email-domain restrictions for Business Center security.

A note on TikTok’s changing menu names

TikTok updates Ads Manager and Business Center regularly, so the exact labels on your screen may not match a guide written a few months ago. Where a menu name here does not exist in your interface, look for the nearest equivalent under User Settings, Account Security, Account Health or the Business Center member and partner lists rather than assuming the setting was removed.

Every official destination on this page

Make the next incident easier to catch.

This part is about AdFence. It comes last on purpose: nothing here helps you recover the account you are trying to recover today.

If AdFence was already connected

  • User and permission changes
  • Partner access changes
  • Campaign changes
  • Budget changes
  • Unexpected targeting
  • Untrusted domains and destinations
  • Pixel and tracking changes
  • Account status
  • Billing signals

Monitoring is read-only by default. Where a response action is supported for a platform, an authorized user confirms and dispatches it; an action runs automatically only where a response policy and its actions were explicitly configured and pre-approved beforehand. Which signals and which actions are available varies by advertising platform, so treat the list above as the alerts that may be supported for a TikTok account rather than as a guarantee for yours.

If AdFence was not connected

AdFence cannot reconstruct activity that happened before the advertiser account was connected. Once legitimate access has been restored, it can begin monitoring the TikTok signals the integration supports, from that point forward.

An Evidence Pack organizes the activity AdFence recorded after connection into a documented timeline for support, disputes and internal review. It only ever documents recorded activity, and it does not guarantee a reimbursement.

Secure the account you recovered

Read-only monitoring by default. Any response permission stays under your control.

Questions people ask mid-incident

What should I do first if my TikTok Ads account is hacked?
Pause unauthorized campaigns where you still can, secure the TikTok for Business login and the connected email, preserve the essential evidence, and contact TikTok through the route that matches whether you can still sign in.
Should I delete the unauthorized campaigns?
Pause them first. Record campaign IDs, budgets, destinations, timestamps and spend before deleting anything, where that is practical. Do not delay urgent containment solely to preserve evidence.
What is the difference between TikTok Ads Manager and Business Center?
Ads Manager is the individual advertiser account where campaigns run. Business Center is the higher management layer used for people, partners, advertiser accounts, TikTok accounts, assets and finance access.
What if an unfamiliar Business Center member has Admin access?
Record the member’s details and assigned assets, then have a legitimate Admin remove or restrict them. Review partners and asset-level permissions separately, because access can exist through more than one route.
What if the advertiser account belongs to an agency or a partner?
Notify the owning partner immediately. Confirm who owns the advertiser account, who controls billing, who can pause campaigns and who is responsible for contacting TikTok. You may not be able to remove a partner’s access yourself.
Can TikTok refund unauthorized advertising spend?
TikTok describes investigating reports of compromised accounts and reimbursing charges it determines resulted from unauthorized activity. Whether a particular charge qualifies, how much is returned and when are decided by TikTok and the relevant payment provider. No reimbursement is guaranteed.
How long does TikTok take to respond?
TikTok does not publish a general response time for support cases or appeals. The one window its current appeal interface states is 48 hours to reply when TikTok asks an advertiser for more information. Treat anything else you read as a guess.
Can AdFence recover access to a hacked TikTok account?
No. Login, advertiser-account and Business Center recovery remain with TikTok. AdFence helps monitor and document the supported signals it can reach after an account is connected.
Can I connect AdFence after being hacked?
Yes, once legitimate access has been restored. Monitoring starts at connection and cannot recreate a history of what happened before it.
What if suspicious activity caused the advertiser account to be suspended?
Secure the access first, then use the appeal route shown in Ads Manager, which TikTok currently manages through Account Health. A suspension is not proof that the account was compromised, and an appeal does not guarantee that an account is restored.
Does AdFence support every TikTok feature it supports for Meta?
No. Advertising platforms expose different information and different controls, so the supported signals and any available response actions vary by platform. This page shows only what applies to TikTok.

Before you consider the incident closed

Your own record of what you have done. Ticking a step records your note to yourself; it is not confirmation from TikTok that the step was accepted or that the incident is closed.

Your browser’s print dialog can also save it as a PDF.

0 of 24 steps recorded.

Saved only in this browser. Not sent to AdFence. On a shared or borrowed device, clear this before you hand it back. Reset removes the record from this browser only.

Back in control? Keep it that way.

AdFence monitors the supported TikTok advertising signals for the changes that turn a compromised login into lost spend.

Start protecting your accounts

Related reading

Not published yet

  • Google Ads account hacked

That emergency guide is not written yet. It will be linked from here when the route exists, never before.

AdFence is an independent advertising-security platform. It is not TikTok, is not affiliated with or endorsed by TikTok, and cannot access, restore or recover your account through this guide. Account access, suspension, investigation and reimbursement decisions remain with TikTok. Your selection is saved only in this browser, on this device. It is never sent to AdFence.