Skip to main content

Under attack · TikTok ads

TikTok Ads account hacked? Start here.

Choose what was affected and follow the relevant steps to contain unauthorized spend, recover access, inspect connected assets and secure the account.

Find my recovery pathNeed TikTok to act? Open support (opens in a new tab)

Before you go further

  • AdFence is an independent advertising-security platform. It is not TikTok, is not affiliated with or endorsed by TikTok, and cannot access, restore or recover your account through this guide. Account access, suspension, investigation and reimbursement decisions remain with TikTok.
  • This guide cannot promise account recovery, the identification of whoever did this, the reversal of a suspension, or the removal of any charge. It sets out the order to work in and what to record.
  • Never type a password, verification code, recovery code, payment-card number, identity document or the contents of a support case into this page or send them to AdFence. Nothing on this page asks for them, and no legitimate recovery route needs them from a third party.
  • TikTok Shop and Seller Center are a separate system from TikTok Ads Manager, and TikTok Shop operates in some markets only. If the Shop itself was taken over, use the Shop support route on this page for it. This is an advertising guide and does not cover Shop recovery.

Last reviewed . Official TikTok destinations and menu names on this page are reviewed every quarter.

Do these first, whichever TikTok setup you use.

These three apply before the account-specific recovery paths below.

  1. 01

    Contain unauthorized spend

    Review every active campaign, ad group and ad, and pause anything you cannot verify. If the attacker is still making changes, stopping delivery comes before a perfect investigation. If you have lost access, do not spend time trying to force a pause. Ask a Business Center Admin who still has access to contain the activity and restrict the compromised user, then go to the recovery path that matches your situation.

    • Anything you did not create
    • An unfamiliar ad identity
    • An unexpected budget
    • An unfamiliar location
    • An unfamiliar destination
    • Activation at an unusual time
    • An unknown catalogue or product set

  2. 02

    Secure the login and the connected email

    Secure the TikTok for Business account and the email address or phone number attached to it. If the mailbox is compromised, secure it before relying on verification codes or reset messages.

    • Password
    • Registered email
    • Registered phone number
    • 2-step verification
    • Authorized devices
    • Email recovery settings
    • Email forwarding rules
    • Unknown login sessions

  3. 03

    Preserve the essential evidence

    Capture what you can see before removing suspicious users or changing settings, where that is practical. Do not delay urgent containment solely to collect screenshots.

    • Business Center ID
    • Advertiser account ID
    • TikTok account username and ID
    • Unknown members or partners
    • Campaign, ad-group and ad IDs
    • Budget and targeting changes
    • Destination URLs
    • Unauthorized spend and transaction IDs
    • Payment-method changes
    • Timestamps
    • Relevant emails from TikTok
    • Support case numbers

Which part of your TikTok setup was compromised?

Select one or more. A compromised login can reach several advertiser accounts and more than one Business Center, so the paths below open in the order they should be worked through.

Select everything that happened.

No recovery paths selected yet.

Your selection is saved only in this browser, on this device. It is never sent to AdFence.

Recovery paths

Open the path that matches your situation. Any path can be opened at any time, and more than one usually applies.

Not sure yet is a valid answer. Every recovery path can be opened below, and the final checklist covers the whole setup.

Go to the final checklist

Path 1

TikTok for Business login compromised

The login identity that reaches Ads Manager, your advertiser accounts and Business Center.

  1. Step 1. Contact TikTok if you need TikTok to act

    If you need TikTok to recover access, investigate the compromise, suspend an affected account, or take another platform-side action, use the route that matches your situation.

    • Managed advertiser: contact your assigned TikTok representative first
    • Unmanaged advertiser who can still sign in: follow TikTok’s current Business Support instructions, including the Ad Assistant entry inside TikTok for Business
    • Unable to sign in: start with TikTok’s login-troubleshooting article
    • Public TikTok profile taken over: that is a separate consumer support route

    Ad Assistant requires a working TikTok for Business session. TikTok’s Business Support article also describes a Feedback and Help route for someone unable to log in, while the login-troubleshooting article covers lost recovery methods. Availability varies by role, region, account type, whether a TikTok representative manages the account, and eligibility. No route is guaranteed to be available to every advertiser.

  2. Step 2. Recover the registered email address and phone number

    Confirm both are still under legitimate control. If the mailbox itself is compromised, secure it before relying on verification codes or password-reset messages.

    • Password changes
    • Unknown sessions
    • Recovery addresses
    • Recovery phone numbers
    • Deleted messages from TikTok
    • Email forwarding rules
    • Inbox filters
    • Spam, trash and archive folders

  3. Step 3. Change the TikTok for Business password

    • Unique to TikTok for Business
    • Not reused from another service
    • Not shared between team members
    • Stored in a password manager

    Do not simply add a number to the previous password.

  4. Step 4. Turn on 2-step verification

    Open TikTok for Business User Settings, select Account Security, and configure the verification methods your account offers. TikTok currently recommends 2-step verification for TikTok for Business accounts.

  5. Step 5. Review authorized devices

    Open TikTok for Business User Settings and remove any browser or device you do not recognize.

    TikTok describes authorized devices as able to skip repeated verification prompts on that device and browser. The feature is described as in testing and may not be available on your account, so treat its absence as normal rather than as evidence of tampering.

  6. Step 6. Inspect every Business Center and advertiser account the login could reach

    One login commonly reaches several advertiser accounts and more than one Business Center. Work through the Ads Manager and Business Center paths even if you have not yet seen unauthorized advertising.

My login is secure. Check my advertiser accounts next.

Path 2

TikTok Ads Manager advertiser account compromised

You can still sign in, but the advertiser account holds activity you did not create.

  1. Step 1. Stop suspicious delivery

    Pause anything you cannot verify. If the attacker is still making changes, containment comes before a perfect investigation.

    • Campaigns
    • Ad groups
    • Ads
    • Schedules
    • Daily and lifetime budgets
    • Bid settings
    • Optimization goals
    • Automated rules, where you use them

  2. Step 2. Inspect what changed

    • New campaigns
    • Reactivated campaigns
    • Large budget increases
    • Changed bid strategy
    • Unfamiliar objectives
    • New ad identities
    • Unfamiliar videos or creative
    • Changed landing-page URLs
    • New catalogue or product ads
    • Changed tracking links
    • Changed targeting or locations

  3. Step 3. Review who can reach the account

    If the advertiser account is managed through Business Center, the access list is in two places at once: the people assigned to the account, and the partners the Business Center shares it with.

    • Business Center members
    • Users assigned to the advertiser account
    • Partner access
    • Account Groups
    • Asset assignments
    • Ownership

    TikTok advertiser-account permissions currently include Admin, Operator and Analyst. Admins manage account settings, Operators can create and edit advertising without managing those settings, and Analysts have reporting access without campaign editing.

  4. Step 4. Confirm who owns the advertiser account

    Business Center distinguishes an advertiser account it owns from one owned by a partner, and administrators can filter the advertiser-account list by ownership and by status, including approved, suspended and disabled.

    • The owning Business Center
    • The Business Center currently managing it
    • Partner businesses with access
    • People assigned directly to the account
    • Who controls billing
    • Who raises the support case

    Ownership identifies the Business Center that owns the advertiser account. Permission changes, billing access and support actions still depend on each person’s Business Center role, advertiser-account permission, finance role, assigned assets, current access and the support workflow available. The advertiser-ownership question further down this page sets out what to check in each case.

  5. Step 5. Review billing and transactions

    • Payment methods
    • Account balance
    • Billing option
    • Transaction history
    • Billing threshold
    • Billing date
    • Credit-line allocation
    • Invoices
    • Unrecognized charges
    • Recent payment failures

    Business Center separates finance access into Finance Analyst and Finance Manager roles, and transaction, balance, billing and invoice access follows those permissions rather than Business Center membership.

  6. Step 6. Inspect the connected assets

    • TikTok accounts
    • Pixels
    • Catalogues
    • Audiences
    • Leads
    • Shops
    • Account Groups
    • Shared assets
    • Partner-owned assets

    If a TikTok Shop or Seller Center account was taken over, that is a separate system with its own support route, and TikTok Shop operates in some markets only. Use the Shop route for the Shop, and keep using this page for the advertising side.

  7. Step 7. Contact TikTok if you need TikTok to act

    If you need TikTok to investigate the compromise, restore access, review unauthorized spend, or take another platform-side action, attach these facts to the support request.

    • TikTok for Business login email
    • Business Center ID
    • Advertiser account ID
    • Suspicious campaign IDs
    • The unauthorized amount and the currency
    • The date and time you discovered it
    • Screenshots
    • Unknown members or partners
    • Actions you have already taken
    • Whether suspicious delivery is still running
    • TikTok for Business: contact Business Support (opens in a new tab)

      TikTok’s current instructions for reaching Business Support. Ad Assistant requires a working TikTok for Business session, while the article also describes a Feedback and Help route for someone unable to log in. The exact routes offered vary by role, region, account type and eligibility. If a TikTok representative manages your account, contact them first.

Delivery is contained. Check the Business Center next.

Path 3

TikTok Business Center compromised

The central layer for members, partners, advertiser accounts, assets and finance access.

  1. Step 1. Identify the remaining trusted administrator

    A Business Center Admin can add or remove members and partners, create or request advertiser accounts, assign assets, control security settings and manage business verification. Confirm which legitimate Admins still have access, and do not remove the last one.

  2. Step 2. Review every member

    • Email address
    • Business Center role
    • Assigned accounts
    • Assigned assets
    • Date added, where it is shown
    • Finance permissions
    • Whether the person still works with the business
    • Whether that person’s own identity may be compromised

    Business Center uses Admin and Standard member roles. Standard members reach only what is assigned to them. Record identifying details before removing anyone, where that is practical.

  3. Step 3. Review the finance roles separately

    Finance permissions are separate advanced roles, so a Business Center Admin does not automatically hold every financial access.

    • Finance Analyst
    • Finance Manager
    • Recent transactions
    • Billing changes
    • Invoice access

  4. Step 4. Review the connected partners

    An unfamiliar member and an unfamiliar partner are two different access paths. Removing one does not remove the other.

    • Partner name
    • Partner Business Center ID
    • Assets shared to the partner
    • Advertiser-account access
    • TikTok-account access
    • Pixel access
    • Catalogue access
    • Audience access
    • Finance or media-agency relationships
    • Whether the partnership is still legitimate

  5. Step 5. Review account and asset permissions

    TikTok supports account-level and asset-level permissions, so a membership list alone does not show the full access a person or a partner holds.

    • Advertiser accounts
    • TikTok accounts
    • Shops
    • Pixels
    • Catalogues
    • Audiences
    • Leads
    • Account Groups

  6. Step 6. Review every advertiser account, not only the noisy one

    • Newly created advertiser accounts
    • Partner-owned accounts
    • Accounts transferred into the Business Center
    • Suspended accounts
    • Disabled accounts
    • Accounts with activity nobody recognizes
    • Accounts the legitimate team does not use

  7. Step 7. Review the Business Center security settings

    • The 2-step verification requirement
    • Email domain allowlist
    • Approved email domains
    • Business verification
    • Administrative users
    • Account-recovery contacts

    Business Center supports 2-step verification controls and an email domain allowlist that restricts invitations to approved domains.

  8. Step 8. Review the Enterprise structure, where one exists

    An Enterprise Business Center can hold several tiers and centralize user, security, reporting and finance controls across Standard Business Centers, so access can be granted a level above the one you are looking at.

    • Parent Enterprise Business Center
    • Child Business Centers
    • Standard Business Centers
    • Cross-region access
    • Finance hierarchy
    • Central security settings
    • Claimed Business Centers

The Business Center is under control. Check the connected TikTok profile.

Path 4

Connected TikTok profile taken over

The public TikTok account used for organic content, identity and Spark Ads.

  1. Step 1. Reset the TikTok account password

    In the TikTok app: open Profile, then Menu, then Settings and privacy, then Account, then Password.

    TikTok names changed passwords, changed account information, unauthorized posts and unauthorized messages as signs that a TikTok account may have been hacked.

  2. Step 2. Secure the email address and the phone number

    Confirm both are legitimate and under the owner’s control. TikTok recommends keeping more than one contact method, so a single compromised one is not the only way back in.

  3. Step 3. Remove unfamiliar devices

    In the TikTok app: open Profile, then Menu, then Settings and privacy, then Security and permissions, then Manage devices.

    TikTok advises changing the password after removing an unrecognized device.

  4. Step 4. Run Security Checkup

    • Verified email address
    • Verified phone number
    • 2-step verification
    • Trusted devices
    • Security activity
    • Passkey, where it is available

  5. Step 5. Review what changed on the profile

    • Videos
    • Drafts
    • Deleted content
    • Messages
    • Comments
    • Bio
    • Website link
    • Username
    • Connected accounts
    • Commercial settings
    • Shop links

  6. Step 6. Review the profile’s advertising relationships

    Then review every live ad running under that identity.

    • Business Centers it is assigned to
    • Advertiser accounts using it
    • Partner Business Centers
    • Spark Ads
    • Catalogue or Shop advertising
    • People with ad-delivery or broader account permissions

  7. Step 7. Continue with the Business Center audit

    Securing the public profile does not prove that advertiser-account and Business Center access is clean. They are separate grants.

The profile is secure. Continue with the final checklist.

Path 5

Advertiser account suspended after suspicious activity

Enforcement and compromise are two different findings, and the order of work matters.

  1. Step 1. Secure compromised access before deciding whether to appeal

    An appeal, if needed, is not a containment step. If an unauthorized person may still hold access, appealing on its own leaves them there.

    • TikTok for Business login
    • Registered email
    • Registered phone number
    • Business Center members
    • Partners
    • Advertiser-account permissions
    • Authorized devices

    A suspension is an enforcement decision, not proof that your account was compromised, and a compromise is not always what triggered one. Work out which you are dealing with before you describe it to TikTok.

  2. Step 2. Read what the suspension actually says

    TikTok currently routes advertising-policy suspensions through the Account Health page in Ads Manager, and other enforcement can point to Account Settings instead. Read the notice inside your own account rather than assuming which one applies to you.

    • The stated reason
    • The date and time
    • The affected advertiser account
    • The relevant campaigns
    • The unauthorized changes
    • Any documents requested
    • Any deadline the notice states

  3. Step 3. If you need TikTok to review the suspension, submit one appeal

    Use the appeal route only when the notice or Account Health offers it and you need TikTok to review the enforcement decision. Explain the compromise and the remediation.

    • That the advertiser account may have been compromised
    • Which activity was unauthorized
    • When it began
    • When the account was secured
    • Which members or partners were removed
    • Which campaigns were paused
    • Which charges are disputed
    • Which supporting documents are attached

    Submitting an appeal does not guarantee that an account is restored. TikTok decides the outcome, and nothing on this page can influence it.

  4. Step 4. If you submitted an appeal, track it in one place

    TikTok’s current Account Health process lets an advertiser follow a submitted appeal and reply to the review team.

    The current appeal interface gives 48 hours to reply if TikTok asks for more information or if you have questions about the review result. TikTok publishes no general reply time for appeals or support cases, so do not plan around one.

  5. Step 5. If an appeal exists, do not file competing appeals

    Use the existing appeal and support case rather than opening several with different explanations of the same incident.

The suspension route is clear. Continue with the final checklist.

Path 6

Lost access to everything

No route into the login, Ads Manager, Business Center or the connected profile.

  1. Step 1. Start support and containment in parallel

    • Managed advertiser: contact your assigned TikTok representative
    • Unmanaged advertiser who can still sign in: follow TikTok’s current Business Support instructions
    • Locked out of TikTok for Business: use the Business Support and login-troubleshooting instructions, including for a lost registered email or phone number
    • Public TikTok profile taken over: use the consumer account-recovery route

    Do not wait for one route to finish before asking a remaining trusted administrator to contain active spend. Which support entry points appear depends on your login state, role, region, account type, whether a TikTok representative manages the account, and eligibility.

  2. Step 2. Ask a remaining trusted administrator to contain it

    If another legitimate Business Center Admin still has access, they can act while you recover.

    • Pause suspicious campaigns
    • Remove or restrict the compromised member
    • Remove unfamiliar partners
    • Review the finance roles
    • Preserve account and transaction records
    • Contact TikTok
    • Stop any further asset sharing

  3. Step 3. Secure any recovery method you can still reach

    Secure the registered email or phone number if it is still available. If the registered mailbox is compromised, recover it before relying on password-reset or verification messages sent there. This runs alongside support contact and trusted-admin containment; it is not a prerequisite for either.

  4. Step 4. Gather identifiers from outside the account

    Invoices, billing emails, TikTok notifications, agency records and earlier support cases carry the identifiers you can no longer read from inside.

    • TikTok for Business email
    • Business Center ID
    • Advertiser account IDs
    • TikTok profile username
    • TikTok account ID
    • Campaign IDs
    • Billing invoices
    • Transaction IDs
    • Payment-method details
    • Partner Business Center IDs
    • Previous support cases

  5. Step 5. Keep one incident timeline

    • When access was lost
    • When unauthorized activity began
    • Which accounts and assets were affected
    • Who still has access
    • Which campaigns are still running
    • Which support route was used
    • Every case number and reply

Access is coming back. Continue with the final checklist.

Who owns the advertiser account?

TikTok Business Center distinguishes an advertiser account owned by your own Business Center from one owned by a partner. Ownership affects who can change sharing and partner permissions; billing and support actions also depend on assigned roles, access state and the workflow TikTok offers.

Advertiser-account ownership

All three answers are shown. Choose one to narrow this to your situation.

This answer is not saved, and it does not change which recovery paths are open. All three answers are shown until you pick one.

Your Business Center owns the account

An Admin in the owning Business Center can review members, partner access and asset-level permissions, then change sharing or partner permissions where their role allows. Confirm separately who has the advertiser-account, finance and support access needed for the remaining actions.

  • An Admin in the owning Business Center can change member and partner access where TikTok grants that permission
  • Advertiser-account roles determine who can change account settings and campaign delivery
  • Finance roles determine who can view or manage billing
  • Confirm which authorized user can access TikTok’s available support workflow and keep the case number
  • Keep suspicious campaigns paused while the authorized account users audit

Being an Admin does not automatically give you finance permissions. Finance Analyst and Finance Manager are separate roles, so check them before assuming the billing view in front of you is the whole picture.

A partner or an agency owns the account

An Admin in the owning Business Center may be required to change sharing or partner permissions. Whether you or the owner can pause delivery, view or manage billing, or use a support workflow depends on each person’s assigned roles and current access. Tell the owner immediately, then agree who does what.

  • Notify the owning partner or agency immediately
  • Confirm who can pause delivery right now
  • Confirm who can remove members and partner access
  • Confirm who controls the payment method and the invoices
  • Confirm who contacts TikTok and holds the case number
  • Ask for the campaign, budget, targeting and destination changes in writing

Removing an individual member does not remove a partner’s access, and removing a partner does not remove a person assigned directly to the account. Check both lists; some sharing and partner-permission changes require an Admin in the owning Business Center.

You are not sure who owns it

Do not wait on the answer. Contain the spend first, then establish ownership from the account itself.

  • Filter the advertiser-account list in Business Center by ownership and by status
  • Compare the Business Center listed as owner with the one currently managing the account
  • Check which business receives the invoices
  • Ask whoever originally set the account up
  • Until you know, ask every party who may hold Admin to pause delivery

Ownership is a fact about the account, not a judgement about who is at fault. Establish it before agreeing with anyone about who is contacting TikTok.

Need TikTok to act? Prepare one short case.

Only create a TikTok case when you need help recovering access, a platform-side action or appeal, or a review of unauthorized spend or reimbursement. If none applies, skip this section.

Which TikTok support routes you are offered depends on whether you can still sign in, your role, your region, your account type, whether a TikTok representative manages your account, and your eligibility. Work through the routes below in order rather than expecting a particular chat, form or ticket to appear.

Include only the essentials

  • TikTok for Business login email
  • Business Center ID
  • Advertiser account ID
  • Affected campaign, ad-group or ad IDs
  • The first suspicious event and containment time
  • The unauthorized amount and currency
  • Screenshots
  • Actions already taken

What you need the platform to do

  • What was compromised
  • What activity or spend was unauthorized
  • When it started and what you already did
  • Which resolution you are asking for
  • TikTok for Business: contact Business Support (opens in a new tab)

    TikTok’s current instructions for reaching Business Support. Ad Assistant requires a working TikTok for Business session, while the article also describes a Feedback and Help route for someone unable to log in. The exact routes offered vary by role, region, account type and eligibility. If a TikTok representative manages your account, contact them first.

TikTok describes a compromised-account process that can include investigating unauthorized activity and reimbursing charges it determines resulted from that activity. That is a description of a process, not an entitlement. Eligibility, the amount, the timing and the outcome are decided by TikTok and the relevant payment provider, and nothing on this page can promise a reimbursement or say when one would arrive.

If you are considering a payment dispute with your card issuer, speak to TikTok and to your issuer directly. A dispute can affect billing and account standing, and nothing on this page is legal or financial advice.

Before you consider the incident closed

Your own record of what you have done. Ticking a step records your note to yourself; it is not confirmation from TikTok that the step was accepted or that the incident is closed.

Open the final checklist

Your browser’s print dialog can also save it as a PDF.

0 of 24 steps recorded.

Saved only in this browser. Not sent to AdFence. On a shared or borrowed device, clear this before you hand it back. Reset removes the record from this browser only.

Questions people ask mid-incident

What should I do first if my TikTok Ads account is hacked?

Pause unauthorized campaigns where you still can, secure the TikTok for Business login and connected email, and preserve the essential evidence. Use TikTok’s official support route only if you need access recovery, a platform-side action, an appeal, or review of unauthorized spend.

Should I delete the unauthorized campaigns?

Pause them first. Record campaign IDs, budgets, destinations, timestamps and spend before deleting anything, where that is practical. Do not delay urgent containment solely to preserve evidence.

What is the difference between TikTok Ads Manager and Business Center?

Ads Manager is the individual advertiser account where campaigns run. Business Center is the higher management layer used for people, partners, advertiser accounts, TikTok accounts, assets and finance access.

What if an unfamiliar Business Center member has Admin access?

Record the member’s details and assigned assets, then have a legitimate Admin remove or restrict them. Review partners and asset-level permissions separately, because access can exist through more than one route.

What if the advertiser account belongs to an agency or a partner?

Notify the owning partner immediately. Confirm who owns the advertiser account, who controls billing, who can pause campaigns and who is responsible for contacting TikTok. You may not be able to remove a partner’s access yourself.

Can TikTok refund unauthorized advertising spend?

TikTok describes investigating reports of compromised accounts and reimbursing charges it determines resulted from unauthorized activity. Whether a particular charge qualifies, how much is returned and when are decided by TikTok and the relevant payment provider. No reimbursement is guaranteed.

How long does TikTok take to respond?

TikTok does not publish a general response time for support cases or appeals. Its current appeal interface gives an advertiser 48 hours to reply if TikTok asks for more information or if the advertiser has questions about the review result. Do not plan around a general response time.

Can AdFence recover access to a hacked TikTok account?

No. Login, advertiser-account and Business Center recovery remain with TikTok. AdFence helps monitor and document the supported signals it can reach after an account is connected.

Can I connect AdFence after being hacked?

Yes, once legitimate access has been restored. Monitoring starts at connection and cannot recreate a history of what happened before it.

What if suspicious activity caused the advertiser account to be suspended?

Secure the access first, then read the suspension notice in Ads Manager. If Account Health offers an appeal and you need TikTok to review the decision, submit one through that route. A suspension is not proof that the account was compromised, and an appeal does not guarantee that an account is restored.

Does AdFence support every TikTok feature it supports for Meta?

No. Advertising platforms expose different information and different controls, so the supported signals and any available response actions vary by platform. This page shows only what applies to TikTok.

After recovery

Make the next incident easier to catch.

Monitoring is read-only by default and starts after connection. Capabilities vary by advertising platform, integration, permissions, configuration and plan. Where a response is supported, an authorized user confirms and dispatches it; automatic actions run only when explicitly configured and pre-approved.

Secure the account you recovered