Does this mean we were hacked?

Not always. Unusual logins from staff can trigger it too.

Should we make a new portfolio?

No. That can link the new one to this flag.

Who makes the final decision?

Meta does. No outside service can decide for Meta.

Business Manager disabled for suspicious activity: how to secure it and get it back

This flag is about who is using the portfolio. Before you ask for a review, make the access clean: every admin on two-factor, unknown people, partners and apps removed, and a short honest note of what changed recently.

By the Restore Ad Account team · Published 30 October 2026 · Last updated 30 October 2026

Do this now

Every admin changes their password and turns on two-factor.
Each admin checks login activity on their profile.
In Business settings, remove unknown people, partners and connected apps.
Write down recent changes: new admins, new countries, new cards.
Request a review on the portfolio in Account Quality.

What to write

"Business portfolio [ID] was disabled for suspicious activity on [date]. On [date] we [added an admin / logged in while travelling / changed payment]. All admins now use two-factor and unknown access was removed."

Deadlines

Act today. Follow any date Meta shows on the notice.

What to avoid

Paying anyone who asks for your codes or password.
Creating new assets while recovery is open.

Official sources

Meta changes its help pages, menus and forms often. Follow the wording on your own screen and the current Help Center. Restore Ad Account is an independent service and is not affiliated with Meta.