Meta Business Security

Summary

If you use Facebook Business Manager, Instagram Business, or run ads on Meta platforms, securing your business account is critical. A hijacked business account can drain your ad budget, steal customer data, and damage your brand reputation. The good news: most account takeovers are preventable with basic security hygiene.

What You Need to Know

• Use a business email address: Don’t use a personal Gmail or Yahoo address for your Business Manager account. Use your company’s domain email (e.g., admin@yourcompany.com). Monitor this email closely for security notifications.
• Require 2FA for everyone: Every person with access to your Business Manager—employees, partners, contractors—must have two-factor authentication enabled on their personal Facebook account.
• Monitor ad spending weekly: Check your active ads and billing regularly. Unauthorized ad spend can rack up thousands of dollars in days if not caught early.
• Use Security Checkup: Meta’s free Security Checkup tool reviews your account, removes unrecognized devices, and enables login alerts.
• Recognize scams: Scammers impersonate Meta support, claiming your account is suspended or compromised. They ask for login credentials or request remote access. Meta will never call unsolicited.

Take Action Today

1. Run Security Checkup — Go to facebook.com/security/checkup and complete the review.
2. Verify your team’s 2FA — Check each team member’s account at facebook.com/settings → Security and Login → Two-Factor Authentication.
3. Set up billing alerts — Configure email notifications for any ad spend over $X so you’re notified of unusual activity immediately.

If Your Account Is Compromised

• Immediate: Change your password and run Security Checkup
• Secure admin access: Review Business Manager roles at business.facebook.com/settings and remove unknown admins
• Report: Use Meta’s Security Checkup to report unauthorized access
• Recover ad accounts: File a report at facebook.com/hacked

Related Pages

• password-management — Credential hygiene for all accounts
• fido-passkeys — Passkeys as a phishing-resistant MFA alternative
• cisa-cyber-essentials — General account protection practices
• cyber-resource-center — Master page with all resources

Sources

• Tips to Keep Your Business Manager Accounts Secure (Meta for Business)
• Using Security Checkup (Meta Help Center)
• Spam, Scams and Phishing (Meta Help Center)