Someone claiming to be an agency or support wants business access. What should I check before approving?
The short answer
Use this guide while you or a trusted colleague can still inspect the business. Pause the request and verify the person and purpose independently. Meta has documented attackers adding themselves as business administrators; an access request deserves a separate check even when nobody asks for a password. If management access is already lost, use the Page-access recovery guide instead.
What this answer is based onWhat to do
Make a small access list: who or which partner, which asset, which permission, why needed, and who confirmed it. Keep screenshots private; redact unrelated staff or customer details when asking for help.
- Record the request before changing anything: requester name and ID if shown, portfolio and asset names/IDs, requested permissions, date and the message making the claim. Open Facebook or Meta Business Suite independently, not through the message. Check whether the screen is inviting you into another business or asking you to give someone access to yours; these are different decisions. Verify any known agency through contact details you already trust. Do not grant access just to discover what an unfamiliar request does. For a claimed partner, confirm the business ID with that known contact, not only its display name.
- With an authorized colleague, inspect the access details actually available for the selected portfolio and its affected assets. Review people and partner organizations separately where shown, and distinguish pending requests from existing permissions. Identify the legitimate administrator whose access must remain. Do not remove yourself or the only trusted person able to manage access. For a verified working relationship, compare the requested powers with the agreed task; do not accept broad control merely because the requester calls it standard. For an unwanted request or grant, use only the relevant decline, edit or removal control that your account offers, read its warning and confirm the exact target. Do not delete the Page, portfolio or ad account as a shortcut.
- Reopen the affected access details and verify the actual result. If an approval is pending, an error appears or you cannot inspect the permissions, do not assume access has ended: save the message and time, ask the remaining trusted administrator to check, or use the help available within the official business interface. Prepare the asset IDs, timeline and before/after evidence, without passwords or login codes. If there are unauthorized changes or suspicious downloads as well, secure the personal account and device through the compromised-account guidance; reviewing permissions alone is not enough. If your own management access disappears, switch to the Page-access recovery route.
The situation
An unfamiliar “support partner” says a shop must grant full control to avoid losing its Page. The owner opens Meta independently and checks the request with their actual agency using an existing contact, rather than approving under pressure.
The situation and an improvement
Approve under pressure or remove every name without checking who keeps control.
Verify the requester, preserve legitimate administration, make a targeted change and check its result.
More examples
A real contractor asks for more than the job needs
Your agreed task is preparing posts, but the request asks for broad management powers.
What to do
Confirm the scope with the contractor through an existing contact and review the permissions available. Leave the request unapproved until you understand and agree to the access.
An unknown name is already listed
You discover an existing access entry, not just a pending invitation.
What to do
Check with your team before identifying it as an intruder. Preserve evidence and legitimate administration, use the applicable control if authorized, then verify the result and investigate any unauthorized changes.
What this answer is based on
Meta · Business administrator security and access auditingabout.fb.comMeta Engineering · Business-admin permissions targeted by malwareGuide based on Meta’s materialReview details
Source reviewed:
We read the official source listed for this topic. Other Meta rules are reviewed separately.
Checked 7 November 2026: two Meta security reports dated 3 May 2023 were read. They document attackers adding business administrators and the importance of access auditing and device security. Current Facebook Help pages for Page permissions and partner removal returned login or temporary-block screens, so their instructions were not verified. The checklist and scenarios are ClearRules advice, not a tested current menu sequence or a claim that a particular invitation is fraudulent.
Material published: May 3, 2023
Include the guide link, language and wording that needs checking. Add an official source link if you have one. Do not send passwords, login codes or photos of identity documents.
Examples are made up to explain the guidance. Meta decides individual account and content cases.
Sources and related topicsPolicy Graph · Demo in development