How do I lock down my Facebook ad account?

Three moves cover most of the risk: turn on two-factor authentication for everyone who has access, give each person the smallest role that lets them do their job (admin should be rare), and remove anyone who no longer needs access. Most account takeovers come from a stolen password with no 2FA behind it, or an old admin who left months ago and still holds the keys. You can close both gaps in about ten minutes, at no cost.

What's the single most important security setting for an ad account?

Two-factor authentication, switched on for every person with access — not only the owner. Turn it on in Accounts Center under Password and Security, and prefer an authenticator app or a security key over SMS codes. In Business Manager you can require it for everyone in the business, so no one can quietly skip it. Once 2FA is on, a stolen password on its own can't get in.

Who should have admin access to my ad account?

Admin access should be rare — ideally just you and one trusted backup, because an admin can change the payment method, add or remove people, and lock you out. Give your media buyer, agency, or assistant an Advertiser role so they can run campaigns without touching ownership, and give report-only people an Analyst role. When unsure, grant the smaller role; you can always upgrade later.

How do I check who has access to my ad account?

In Business Settings, review People and Partners: list everyone who can get in, ask whether each still needs access at that level, remove former staff and past agencies, downgrade anyone over-permissioned, and revoke connected apps you don't recognise. Do this at least once or twice a year, and every time someone leaves or an engagement ends — it's the removals you forget that turn into the risk.

What's the safe way to give an agency access to my ad account?

Never share your password or a one-time code. Add the agency through Business Manager partner access, or as a user with a specific role, and give them the narrowest role that does the work — usually Advertiser, not Admin. Remove that access the day the engagement ends. This leaves you a clean audit trail and easy off-boarding, which sharing a login never does.

How to Lock Down Your Facebook Ad Account (2FA, Admin Roles, and a 10-Minute Cleanup)

A textile showroom owner once called after noticing his card had been charged for ads he was sure he'd paused. Nothing had been hacked. A freelancer he'd stopped working with a year earlier was still an admin on the account — and had quietly relaunched an old campaign. No drama, no clever attacker: just an open door nobody remembered to close. That is what most ad-account trouble actually looks like — not a break-in, a door left unlocked.

The whole lock-down is three moves: turn on two-factor authentication for everyone with access, give each person the smallest role that does their job, and remove anyone who no longer needs to be there. You can do all three in about ten minutes, and none of it costs anything. Here's the order that matters.

What's the single most important thing to turn on?

Two-factor authentication (2FA) — and not just on your own login, but on every person who can get into the ad account. A password on its own can be phished, guessed, or reused from some other site that leaked. With 2FA on, a stolen password isn't enough to get in.

Turn it on in your Facebook / Meta Accounts Center → Password and Security → Two-factor authentication.
Prefer an authenticator app (or a physical security key) over SMS where you can — text codes can be intercepted, and SIM-swap fraud is real.
In Business Manager you can require 2FA for everyone in the business, so no one with access can skip it.

Meta moves these screens around often, so if a menu isn't where it's described, reconfirm the current path against Meta's own Business Help Centre. If you do only one thing from this article, do this.

Who should actually be an admin?

Admin access should be rare. An admin can add and remove people, change the payment method, and take actions that can lock you out — so the fewer admins there are, the smaller your exposure. A good rule: you, the owner, and at most one trusted backup. Everyone else gets a narrower role.

Match the role to the job:

Admin / full control — you and one backup only. Can change everything, including who else has access.
Advertiser / can manage campaigns — your media buyer, agency, or assistant. Can build and run ads, but can't change ownership or remove people.
Analyst / view only — someone who just needs to read reports. Can look, can't touch.

When you're unsure, grant the smaller role. Upgrading someone later takes ten seconds; walking back an over-broad grant after something goes wrong takes a lot longer.

How do I check who has access right now?

Do this today, then set a reminder to repeat it. In Business Settings → People (and Partners, if an agency is connected), go down the full list:

List everyone who has access — people, partner agencies, and connected apps alike.
Ask "does this person still need this, at this level?" for each one, honestly.
Remove anyone who's left — a former employee, a past freelancer, an old agency you parted ways with.
Downgrade the over-permissioned — an analyst doesn't need admin; a buyer rarely does either.
Revoke connected apps you don't recognise or no longer use.

The freelancer from the top of this article would have shown up on that list in five seconds. The old admin nobody remembers is the most common quiet risk on any account — and the easiest one to fix.

There's a privacy side to this too. Your ad account holds customer and lead data, and under India's Digital Personal Data Protection Act (DPDP), 2023, you're accountable for who can see it. An ex-agency still holding access to your leads isn't only a spend risk — it's data sitting with someone who has no business reason to hold it any more.

What's the safe way to give an agency or freelancer access?

Never share your password, and never read out a one-time code to anyone — no legitimate agency ever needs either. Add people properly instead, so you can grant a limited role and pull it back cleanly:

Use Business Manager partner access (or add them as a user with a specific role) rather than handing over login details.
Give the narrowest role that lets them do the work — usually Advertiser, not Admin.
Remove access the day the engagement ends — don't let it linger "just in case".

Sharing a login gives someone everything, forever, with no record of who did what. Adding them as a user with a role gives you control, an audit trail, and a clean goodbye when the work is done.

How do I protect the payment method?

The payment method — the card or funding source the account bills to — is the part that actually costs you money if the wrong person reaches it, so it deserves its own thought:

Keep it behind admin only. Because only admins can change payment settings, the shorter your admin list, the fewer people can quietly swap in a different card or lift a spend cap.
Watch for changes you didn't make. A new payment method you don't recognise, or a limit that moved on its own, is worth checking the same day.
Turn on billing notifications so a charge or a payment-method change reaches you by alert, not by surprise on a statement weeks later.

None of this needs a tool — it's a two-minute look at who can touch the money, done on the same schedule as your access audit.

What else should I set once and mostly leave?

A few extras that quietly lower the risk:

Keep your recovery email and phone current — if you're ever locked out, this is how you get back in.
Use a business email as the account owner, not a personal one that might get abandoned when someone leaves.
Make sure the ad account sits inside a Business Manager, not on a personal profile — a personal-profile account is far harder to recover and secure.
Review login alerts — switch on notifications for unrecognised logins so you hear about a problem early, not after the damage.

And a word on the messages that push you to act fast: if you get a "verify your account or it will be disabled" note, slow down. Never type your password into a link from it, and never share a one-time code to "confirm" anything. Open Meta directly and check there. The urgency is the tell — a real warning will still be there when you arrive on your own.

How often should I re-check all of this?

Run the full access audit at least once or twice a year, and immediately whenever someone leaves, an engagement ends, or you switch agencies. Security here isn't a one-time setup — it's mostly the removals you remember to make. Put a recurring reminder in your calendar so the list never drifts, and the door the freelancer walked back through never gets left open on your account.