Ad Account Security: Locking Down Business Manager

Think about what sits behind your Meta login: a payment method, a pixel full of customer behavior, a Page and a history that took years to earn. A thief does not need to understand any of it. They only need your sign-in.

In February I wrote about the phishing wave that arrives right after you publish a campaign. This is the defense side: the short list of controls that make one bad click survivable.

Why is a Meta ad account such an attractive target?

Because it turns stolen access into money immediately.

Meta describes the pattern in its own words. Threat actors disguise malware inside innocuous-looking files, apps or browser extensions, and malicious groups often go after the personal accounts of people who manage or are connected to business pages first.⁴ Some malware families try to evade two-factor authentication and scan for links between a personal account and business accounts. The goal is to run unauthorized ads from the compromised business account.⁴

Two details in that post change how I think about defense. First, the malware can re-compromise accounts after the owner recovers them, so changing a password on an infected device fixes nothing.⁴ Second, the front door is the personal profile, not the business asset. That is why the weakest login is the real perimeter.

That post is from May 2023, so treat its numbers as a snapshot. Meta said it had detected and disrupted nearly ten new malware strains that year and had blocked and shared more than 1,000 malicious links with industry peers since March 2023.⁴ The tactics are the useful part. They have not gone away.

What does a phishing attempt look like now?

Like a reasonable message at an unreasonable moment.

CISA's list of warning signs still holds: urgent or emotional language, requests for personal or financial information, shortened links and look-alike addresses. It adds a warning I think every operator should absorb: poor grammar is no longer a reliable tell, because AI can produce flawless messages.²

The habit that beats nearly all of it is independent verification. CISA's advice is to avoid the links and phone numbers in the message and go to the company's site yourself, by typing the address or searching, or contact the sender another way.² For an ad account that means one rule: no one signs in to Meta from a link in a message. Ever. Open Business Settings from your own bookmark.

Which sign-in method should you use?

The strongest one your team can actually adopt, which is usually passkeys.

Why passkeys beat codes

A passkey is a cryptographic credential stored on your phone, computer or hardware key, and you approve sign-in with your fingerprint, face or device PIN. The FIDO Alliance says passkeys are phishing-resistant and that the server holds no secret to steal.³ CISA says the same thing in plainer terms: FIDO/WebAuthn authentication blocks login attempts when a user is tricked into visiting a fake site.¹ A six-digit code typed into a fake page is a code the attacker now has. A passkey has nothing to type.

Meta announced passkeys for Facebook on mobile on June 18, 2025, and added Messenger support on September 23, 2025.⁵ Meta also said passwords remain available as an alternative way in.⁵ I take that to mean the password stays a live path, so I keep it unique and in a manager even after the passkey is set up.

If you cannot go phishing-resistant yet

CISA's fallback for organizations that cannot adopt phishing-resistant MFA is number matching, to block mobile push bombardment and SMS-based attacks.¹ Use an authenticator app over text messages, and treat a prompt you did not trigger as an attack, never as a glitch.

How should you set roles and access?

On a need-to-do basis, with names attached to every login.

A help guide adapted from Meta's documentation says people with full control of a business portfolio can require two-factor authentication for admins only or for everyone, from Business Settings.⁶ Turn on the stricter option. Expect third-party apps that manage Pages or ad accounts to ask for a login code the next time they connect.⁶ Menu names move, so check your own account.

That table is my own practice, not a Meta rule. It follows one idea: every extra person with full control is another personal profile an attacker can aim at.

Audit the list quarterly

Open the people and partners lists and ask of each name: do they still work here, do they still need this level, and do I recognize the address? Anyone who fails any of the three loses access today.

What should you prepare for recovery?

Everything you will need on the worst day, stored where a thief cannot reach it.

Meta's own guidance for businesses is plain: delete suspected malware from the device right away, enable two-factor authentication, reset passwords and never reuse them, turn on login alerts and review active sessions, enable business notifications so changes in Business Manager reach you, and use the Security Checkup tool.⁴ I would add two things that live outside Meta. Put a spending limit and transaction alerts on the card attached to the account, so a hijacker cannot run unlimited spend while you sleep. And make sure those alerts go to a person who will read them.

Your 30-minute lockdown

You can finish most of this in one sitting.

If you want a wider review of the account itself, my year-end ad account audit covers structure, tracking and spend checks, and Mid-Year Account Hygiene covers the naming and exclusions side.

Security feels like overhead until the day it is the only thing that matters. I have run Meta ads since 2014, and the client results only exist because the accounts stayed standing. One careless afternoon should not be able to undo years of work. Make the safe path the easy one, set it up once and let it run.

Keep building.Ekai