How to check an agency access request is real before you accept it

A real agency request shows up inside your own Meta Business Suite when you open it yourself, and it comes from the business you hired. The agency never needs your password, a login code or a photo of your ID. Check those things before you accept, and approve only the access the agency needs for its work. An email from Meta's own address is not proof on its own, because Meta warns that partner requests with phishing links have been sent through its real notification emails.

This page is for business owners who got a partner request, an invitation or a link, and want to be sure before they click anything.

Why the email itself proves nothing

Meta's help pages on phishing carry a warning: Meta has seen partner requests that include phishing links, and these notifications come from a legitimate Meta domain, facebookmail.com. Meta's advice is that if you do not know the person or business in the partner request, you should not click any links.

The security firm Huntress has described how this worked. The attackers created their own business account and used Meta's partner-request feature to reach their targets. Where the business name should be, they wrote a short sentence with a web address in it, so Meta's own email seemed to tell people to visit the attackers' page. Those pages imitated real Meta programs, such as an agency partner program, a verification badge and monetization, and asked for login details, two-factor codes, phone numbers, email addresses and a photo of an ID or passport. Huntress reports that Meta has since added detections for business names that contain a web address.

So even an email that really comes from one of Meta's domains does not tell you who asked Meta to send it. Judge the request, not the email.

Where a real request shows up

You can find a real request without the email. Type the address into your browser yourself, rather than clicking a link.

• Meta. Go to business.facebook.com, open Settings and look under Requests. Meta describes Requests as the place to see invitations from others. A request for a Facebook Page is listed under Requests > Other requests, with details about the business that is asking.
• Google Ads. Sign in to Google Ads, open Admin > Access and security and select the Managers tab. A manager account that wants to link to yours is listed under Link request, with Accept and Decline in the Actions column.

If you cannot find the request there, do not use the email to look for it. Ask the agency what it sent and from which business.

You can also skip requests entirely. Ask the agency for its business portfolio ID and give the access yourself, from Settings > Partners > Add > Give a partner access to your assets. Then nothing arrives from outside for you to judge. The steps are in how to give an agency partner access.

Checks before you accept

1. You expected it. You hired this agency, and it told you a request was coming. Huntress lists the unexpected arrival of an invitation to an exciting opportunity as a red flag, and Meta says not to click links in a partner request from a business you do not know.
2. The name is the agency's name. Compare the business name in the request with the agency's business name. A name that is a sentence, contains a web address, or talks about your account, a violation, a badge or a partner program should stop you. Meta also notes that fake emails often claim a business broke its standards, or warn that something will happen to the account.
3. You confirmed it with a person you know. If anything looks off, call or write to your contact at the agency, using details you already have.
4. It asks for what the agency told you. Look at which assets and which access the request names. Meta lets you approve or deny a partner request, or change which asset types and permissions you share. Remove anything the agency did not mention.
5. You sign in only on Meta's own site. You approve a request inside Meta Business Suite, or on your Page, after opening it yourself; Meta may ask you to re-enter your Facebook password there. If a page you reached from a link asks for your password or a code, check the address bar before you type anything. Meta's advice is to check the website's address before entering your login information, and to type www.facebook.com into your browser when in doubt.

What an agency never needs from you

• Your password. Partner access works with the agency's business portfolio ID. You stay signed in as yourself, and the agency works from its own business portfolio.
• Your login codes. A two-factor code proves that it is you signing in. Passing it on can let someone else sign in as you.
• A photo of your ID or passport. An agency has no use for it, and it is what the phishing pages Huntress describes asked for.

The same goes for anyone who says they are from Meta: Meta says its representatives never ask for a password, payment details or other sensitive information over chat, text, email or phone.

Give the smallest access

When the request is real, approve only what the work needs. On Meta that means partial access with named tasks, such as Ads and Insights on a Facebook Page, rather than full control. Full control matters here: Meta says a partner with full control of a Page can give access to others and remove anyone from the Page. The guide to access levels lists the working level for each Meta and Google account.

You can change the access later. Meta says permissions can be changed at any time, so you can start small and raise it if a job needs more.

Two more settings help. Meta recommends that two active people have full control of your business portfolio, which it calls second admin approval: a second person then has to approve sensitive actions. And for Google Ads, Google's account security page advises giving each user the minimum access they need.

If you accepted something you should not have

1. Remove the partner. In Meta Business Suite, go to Settings, click Partners, click Options in the top right, select Remove from business portfolio and click Remove partner. You need full control of the business portfolio. Check People too, in case anyone was added there. The full steps are in how to remove an old agency's access.
2. If you typed a password or a code on a page from a link, secure your account. Meta's phishing recovery steps start with reporting your account as compromised, which you can do whether or not you can still log in. Then reset your password, remove logins and devices you do not recognize, and review your activity log and the recent emails from Facebook.
3. Check your business portfolio. A person with full control can export a file of people's permissions from People in Settings, and you can download the business history, a file of important events such as changes to the portfolio, its assets and its people. Look for anything you did not do. Meta Business Support Home shows the status of your business accounts.
4. Report it. Report the phishing email to phish@fb.com and to the provider of the mailbox it arrived in, as Meta asks. If you see suspicious or unauthorized activity in your business portfolio, Meta asks you to contact its support team. If payments were made that you did not authorize, contact your bank.

For Google Ads, Google's account security page gives the steps if you think your account is compromised: scan your devices for malware, change your Google Account password, turn on 2-Step Verification, and tell Google through its account security form. The same page has forms for reporting suspicious emails and webpages.