Meta Business Account Security Checklist (2026)
Your Meta business account holds your Pages, ad accounts, pixels, and billing — everything an attacker needs to burn your budget or lock you out. Most compromises aren’t sophisticated hacks; they’re preventable mistakes. Run through this checklist today.
Why Business Accounts Get Compromised
The usual story: a team member clicks a fake “Meta Business” email, enters their password on a lookalike page, and the attacker adds themselves as an admin — quietly. Or an ex-freelancer still has full control months after the project ended. Almost every case traces back to access hygiene, not zero-day exploits.
The Checklist
1. Turn on two-factor authentication — for every admin
Not just you. Every single person with portfolio access needs 2FA on their personal Facebook account. One unprotected admin is an open door for the whole business. Use an authenticator app rather than SMS when possible.
2. Audit who has access, right now
Go to Business Settings → Users → People. For each person ask: do they still work with us? Do they need this level of access? Remove ex-employees, finished contractors, and old agencies immediately. Downgrade anyone with full control who only needs partial access.
3. Use work emails and real identities
Everyone should access the portfolio through an identifiable work email — not shared logins, not personal emails you can’t revoke. Shared credentials mean you can never truly remove someone.
4. Learn to spot phishing
Fake Meta emails are the #1 attack vector. Red flags:
- Urgency and threats (“your account will be deleted in 24 hours”).
- Links that don’t go to facebook.com / meta.com (hover before clicking).
- Requests to “verify” by entering your password or 2FA code somewhere.
- Attachments you didn’t ask for.
Rule: never log in from an email link. Open business.facebook.com yourself and check notifications there.
5. Lock down connected apps and system users
Review Business Settings → Integrations and remove apps you don’t recognize or no longer use. Check system users and tokens — revoke anything stale. Each forgotten integration is a potential entry point.
6. Keep at least two active admins
Security isn’t just keeping attackers out — it’s surviving legitimate lockouts too. Two admins with working 2FA means one lost phone doesn’t become a business crisis.
7. Prepare recovery information in advance
Store your legal business documents, domain registration proof, and a list of current admins somewhere safe outside Meta. If you ever need an ownership review, you’ll need these — and you won’t want to scramble.
What To Do If You Suspect a Compromise
- Secure the personal accounts of all admins (password reset + 2FA check).
- Remove any unknown people, partners, or system users from Business Settings immediately.
- Check ad accounts for unfamiliar campaigns or billing changes — pause anything suspicious.
- Review connected apps and revoke unknown ones.
- Report to Meta through official support channels with a timeline of what happened.
Act fast: attackers often start with small test charges before scaling up.
FAQ
Is SMS 2FA enough?
It’s far better than nothing, but authenticator apps resist SIM-swap attacks better. Upgrade your admins when you can.
How often should we audit access?
Quarterly at minimum — and immediately whenever someone leaves or a project ends.
Can Meta recover a stolen business portfolio?
Sometimes, with proof of legal ownership — but it’s slow and not guaranteed. Prevention is dramatically cheaper than recovery.
Want a Professional Security Review?
We review business portfolios for access risks, stale permissions, and phishing exposure. Message us on WhatsApp to book a checkup.