How to secure your Meta Business account: 5 checks to do today

Why do hackers target Meta Business accounts?

A Meta ad account is worth money even when it holds none. It has a payment method attached, a spending history Meta trusts and Pages with real followers. Criminals use hijacked accounts to run scam ads on your card, or they sell access to someone who will.

The same research describes how a takeover usually plays out. Attackers add their own admins, downgrade the real owner to a limited role, run up spend and swap payment methods. Mimecast notes that a newly compromised account with a $5,000 monthly budget can be drained within hours.

How attackers usually get in

• Fake “Meta Business Support” emails or messages claiming a policy violation, with a login page that steals your password and your one-time code.
• Fake partner requests, copyright notices, job offers or brand deal briefs that lead to the same kind of page.
• Infostealer malware hidden in downloads, which copies saved passwords and logged-in browser sessions.
• A personal Facebook profile with a reused password. Business access is tied to personal profiles, so one weak profile is enough.

The good news: most of these attacks rely on settings you can fix in one sitting. Here are the five checks.

Check 1: How do I turn on two-factor authentication for my business portfolio?

Two-factor authentication (2FA) means a stolen password alone is not enough to log in. It is the single most effective step on this list.

That study covers Microsoft accounts, not Meta, but the principle is the same. Do it at two levels.

1. 1On your own Facebook profile, open Accounts Center, then Password and security, then Two-factor authentication. Choose an authenticator app as your method.
2. 2Save the recovery codes Meta gives you somewhere safe and offline, like a password manager or a printed sheet in a drawer.
3. 3In Meta Business Suite, a person with full control opens Settings, then Business portfolio info, and scrolls to Business options.
4. 4In the dropdown next to Two-factor authentication, choose Everyone, not just Admins only.
5. 5Tell your team. Anyone without 2FA on their own profile will lose access to the portfolio until they turn it on.

Check 2: Who should be an admin on my Meta Business account?

Every person with full control is a door into your business. Most small businesses we audit have too many: a former employee, an old freelancer, a friend who helped set things up years ago.

1. 1Open Settings in Meta Business Suite and go to People.
2. 2List everyone with full control. Keep two or three people you trust and who will still be around next year. Mimecast recommends two to three backup admins with full control.
3. 3Downgrade everyone else to partial access, limited to the specific ad account or Page they work on.
4. 4Remove anyone who has left the company or has not logged in for months.
5. 5Repeat this review every quarter, and the same day someone leaves.

Check 3: How do I check partner access in Meta Business Suite?

Partners are other business portfolios, like an agency, that you have shared assets with. They are easy to forget, and Mimecast points out that partners can keep access to your assets even after you change your password. Attackers also abuse fake partner requests as a phishing lure.

1. 1In Business Suite settings, open Partners and list every business that has access to your assets.
2. 2For each one, check which assets they can reach: ad accounts, Pages, Pixels or datasets, catalogs.
3. 3Remove any partner you no longer work with, and any you do not recognize.
4. 4For active partners, reduce access to only the assets they need for the current work.
5. 5Ignore partner requests you were not expecting. Confirm with the agency by phone first.

Also check the assets you might not think about. A Pixel or dataset shared with an old agency still sends them your conversion data. Connected apps and system users deserve the same review.

Check 4: How do I protect the payment method on my ad account?

When an account is hijacked, the payment method is what pays for the damage. Make it hard to drain and quick to notice.

• Use a dedicated card for ads, not the card that runs payroll. A virtual card with its own limit works well.
• Set an account spending limit in Billing and payments, a little above your normal monthly budget. Raise it on purpose when you need to.
• Turn on payment and spend notifications, and send them to an inbox someone actually reads.
• Ask your bank or card issuer for real-time transaction alerts.
• Look at Billing once a week for unfamiliar charges, new campaigns or a new payment method you did not add.

Check 5: How do I recover a hacked Meta Business account?

Recovery is much easier when you prepare for it before anything happens. Set this up today.

• Recovery codes for every admin’s Facebook profile, stored offline.
• A second trusted admin with full control, as covered in check 2.
• A secured email inbox. The email on your profile is the key to password resets, so give it its own strong password and 2FA.
• A current phone number on each admin profile.
• A short written note of who owns what: which profile owns the business portfolio, which ad accounts and Pages sit inside it.

If you think you have been hacked

1. 1Pause all campaigns if you still have access, and take screenshots of unknown ads, users and charges.
2. 2Change the passwords on your Facebook profile and your email, turn on 2FA, and log out of all other sessions.
3. 3Remove unknown people and partners from the business portfolio.
4. 4Remove unfamiliar payment methods and call your card issuer right away.
5. 5Report the account through Meta’s official help center at facebook.com/hacked.

Your 1-hour Meta security checklist

None of this needs a developer or special software. It needs one focused hour and a calendar reminder. If you would like a second pair of eyes, we review access, partners and billing as part of every Meta ads account we take over.

Frequently asked questions