How do I lock down my Facebook ad account?

Three moves cover most of the risk: turn on two-factor authentication for everyone with access, give each person the lowest role that lets them do their job (admin access should be rare), and remove anyone who no longer needs access. Most takeovers come from a stolen password with no 2FA, or an old admin who still has the keys. You can close both gaps in about ten minutes at no cost.

What's the most important security setting for a Facebook ad account?

Two-factor authentication, turned on for every person with access — not just the owner. Enable it in Accounts Center under Password and Security, prefer an authenticator app or security key over SMS, and in Business Manager you can require 2FA for everyone in the business so no one can skip it. A stolen password alone can't get in once 2FA is on.

Who should have admin access to my ad account?

Admin access should be rare — ideally just you and one trusted backup, because an admin can change payment methods, add or remove people, and lock you out. Give your media buyer, agency, or VA an Advertiser role, and give report-only users an Analyst role. When in doubt, grant the smaller role; you can upgrade later.

How do I audit who has access to my Facebook ad account?

In Business Settings, review People and Partners: list everyone who has access, ask whether each still needs it at that level, remove former employees and past agencies, downgrade over-permissioned users, and revoke connected apps you don't recognize. Repeat at least once or twice a year and whenever someone leaves or an engagement ends.

What's the safe way to give an agency access to my ad account?

Never share your password. Use Business Manager partner access or add them as a user with a specific role, give them the narrowest role that lets them do the work (usually Advertiser, not Admin), and remove access the day the engagement ends. This gives you a clean audit trail and easy off-boarding, which sharing a login does not.

How to Lock Down Your Facebook Ad Account (2FA, Admin Roles, and the 10-Minute Setup)

The whole lock-down is three moves: turn on two-factor authentication for everyone with access, give each person the lowest role that lets them do their job, and remove anyone who no longer needs to be there. Most ad-account takeovers and mystery-spend incidents don't come from clever hackers — they come from a stolen password with no 2FA behind it, or an old admin who left months ago and still has the keys. You can close both gaps in about ten minutes, and none of it costs anything.

What's the single most important thing to turn on?

Two-factor authentication (2FA) — and not just on your own account, but on every person who has access to the ad account. A password alone can be phished or reused; 2FA means a stolen password isn't enough to get in.

Turn it on in your Facebook / Meta Accounts Center → Password and Security → Two-factor authentication.
Prefer an authenticator app (or a security key) over SMS where you can — text codes can be intercepted.
In Business Manager, you can require 2FA for everyone in the business under Security Center, so no one with access can skip it.

If you do only one thing from this article, do this.

Who should actually be an admin?

Admin access should be rare. An admin can add and remove people, change payment methods, and take actions that can lock you out — so the fewer admins, the smaller your risk. A good rule: you (the owner) and at most one trusted backup. Everyone else gets a narrower role.

Match the role to the job:

Admin / full control — you and one backup only. Can change everything, including who else has access.
Advertiser / can manage campaigns — your media buyer, agency, or VA. Can create and run ads, but not change ownership or remove people.
Analyst / view only — someone who just needs to see reports. Can look, can't touch.

When in doubt, grant the smaller role — you can always upgrade someone later.

How do I audit who has access right now?

Do this today, then put a reminder to repeat it. In Business Settings → People (and Partners, if an agency is connected), review the full list:

List everyone who has access — people, partner agencies, and connected apps.
Ask "does this person still need this, at this level?" for each one.
Remove anyone who's left — former employees, past freelancers, an old agency you no longer work with.
Downgrade over-permissioned users — an analyst doesn't need admin.
Check connected apps/integrations and revoke any you don't recognize or no longer use.

The ex-employee or old agency who still has admin is the most common quiet risk — and the easiest to fix.

What's the safe way to give an agency or contractor access?

Never share your password. Add them properly instead, so you can grant a limited role and remove it cleanly later:

Use Business Manager partner access (or add them as a user with a specific role) rather than handing over login details.
Give the narrowest role that lets them do the work — usually Advertiser, not Admin.
Remove access the day the engagement ends — don't let it linger.

Sharing a login gives someone everything, forever, with no audit trail. Adding them as a user with a role gives you control and a clean off-boarding.

What else should I set once and forget?

A few extras that quietly reduce risk:

Keep your recovery email and phone current — if you ever get locked out, this is how you get back in.
Use a business email for the account owner, not a personal one that could be abandoned.
Make sure the ad account sits inside a Business Manager, not on a personal profile — a personal-profile ad account is harder to recover and secure.
Review login alerts — turn on notifications for unrecognized logins so you hear about a problem early.

How often should I re-check all this?

Run the full access audit at least once or twice a year, and immediately whenever someone leaves, an engagement ends, or you switch agencies. Security isn't a one-time setup — it's the removals you remember to do. Set a recurring calendar reminder so the list never drifts.

If the worst has already happened and ads you didn't create are running, this is prevention after the fact — start with recovering the account first (#), then come back and harden it with the steps above. And if you ever get a "verify your account" message while doing this, check whether it's real before you act on it (#).