lol'd at FB customer support. sometime in late 2017 someone with a Pakistan IP has somehow made 2 pages about flowers on my FB account, created an ad account and ran 2 ad campaigns on them.

weirdly enough they paid for the first campaign, but removed their card details afterwards.

FB nags me on my wall to update my credit card info for a failed payment of ~20$, a year after I wrote two emails to them explaining the situation.