Picture this: an email lands in your marketing inbox with the subject line "You've received a Business Manager partner request." The branding is perfect. The sender is a real Meta address. It even passes your email security checks, because it genuinely came from Meta's own servers. One click on Approve, and a stranger now has access to your Facebook Page, your ad account, and the payment card attached to it.

This is not a hypothetical. Through late 2025 and into 2026, security researchers have tracked multiple phishing campaigns that abuse legitimate Meta Business Manager features to target businesses, including Canadian ones. Because the emails come from Meta's real infrastructure, they sail past the filters that catch ordinary phishing.

If your business runs Facebook or Instagram ads, this post is for you. We'll walk through how the scam works, why it beats traditional email security, what it costs when it lands, and the practical steps that keep your ad account (and your money) where it belongs.

Why criminals wants your ad account

A Facebook ad account is a strange kind of asset. It's not money, but it spends money. It holds a live payment method, an approved advertising history, and an audience your business spent years building. To an attacker, that combination is more useful than a stolen credit card.

Once inside a compromised Business Manager, criminals typically do one or more of the following:

• Run their own ads on your dime. Crypto scams, fake storefronts, and malicious links, all billed to your card or credit line until you notice.
• Hijack your Page. Posting to your followers, messaging your customers, and trading on the trust attached to your name.
• Steal your audience data. Custom audiences and customer lists can be exported and used for follow-on scams against your customers.
• Lock you out and resell the account. Aged ad accounts with clean histories and active payment methods have real resale value on criminal marketplaces.

💡  Think of your Business Manager like the master key cabinet for your storefront. It doesn't hold cash itself, but everything it opens does.

How Facebook ad account phishing actually works

Most phishing relies on a fake sender address or a lookalike domain. The current wave is different, and that's what makes it dangerous. Attackers create their own Meta business accounts, then abuse Meta's real partner-request and notification features to deliver the lure.

In a campaign documented by Huntress in July 2026, attackers used a legitimate Meta service that connects businesses with third-party social media managers. The resulting emails came from a genuine Meta address, so they passed the standard authentication checks (SPF, DKIM, and DMARC) that email security relies on. A related campaign analyzed by LevelBlue's SpiderLabs team in April 2026 sent over 40,000 of these emails to more than 5,000 organizations across the US, Europe, Canada, and Australia.

The trick sits in the account name. Instead of a normal business name, attackers name their fake Business Manager something like "Account Restriction" or "Ad Violations," or they embed a link in the name itself. Meta's notification system then dutifully inserts that scare text or link into an otherwise authentic email.

Click through, and you land on a counterfeit Meta login or help page (often hosted on free platforms to dodge blocklists). The page harvests your email, password, and in the newer variants your two-factor authentication code in real time. Some versions even route you to a chatbot posing as Meta support on Messenger to keep the deception going while your credentials are exfiltrated.

⚠️  A phishing page that asks for your 2FA code isn't blocked by having 2FA enabled. If you type the code into the fake page, the attacker uses it immediately to complete a real login.

The three lures to watch for

1. The account restriction scare

An email warns that your ads have been suspended or your Page is about to be disabled for a policy violation, sometimes citing advertising rules or privacy regulations for authenticity. It pressures you to "appeal" through a link before a deadline. Real Meta policy notices exist, but they don't usually come with countdown-timer urgency, and they never require you to log in through an emailed link.

2. The agency partner invitation

An invitation to join an exclusive Meta agency or partner program, or a Business Manager partner request from something named like "Certified Partner Program" or "Compliance Network." There is no legitimate Meta program that recruits businesses through unsolicited partner requests. If you didn't initiate it, treat it as hostile.

3. The fake support chat

Newer variants push you into a Facebook Messenger conversation with a "support agent" (often a bot with a Meta logo). The agent asks for screenshots of your business account, walks you through a "system check" that captures your password, or offers a "2FA setup guide" that hands control of your authentication to the attacker.

The most dangerous version never asks for a password

Here's the part that surprises most business owners. Some of these attacks don't steal credentials at all. A genuine Business Manager partner request, sent by an attacker's account, simply asks you to click Approve. Do that, and you've granted their Business Manager persistent access to whatever assets you authorize: Pages, ad accounts, pixels, and audiences.

No password stolen. No 2FA bypassed. Nothing for your email filter or antivirus to catch. The entire compromise happens inside Meta's own permissions system, using a feature working exactly as designed. That also makes it harder to detect after the fact, because there's no malware and no suspicious login, just a partner you never should have approved.

🚨  Never approve a Business Manager partner request you did not explicitly initiate or expect. One click can expose every Page and ad account you manage.

This risk multiplies for anyone managing multiple accounts. A marketing coordinator or agency employee with access to a dozen client Business Managers can expose all of them with a single approval.

Legitimate meta email or phishing? A quick comparison

Because the sender address alone can't be trusted anymore, you need to judge these emails on behaviour, not branding. Here's how the real thing compares to the scam:

✅  The single most reliable habit: never act on an email link. Open a browser, type business.facebook.com yourself, and check for the alert or request there. If it doesn't exist inside the platform, the email was the attack.

How to protect your ad account

Good news: the defences here are mostly process, not products. A few habits close off nearly all of these attacks.

• Audit who has access. In Business Manager settings, review every person and partner with access to your Pages and ad accounts. Remove former employees, old agencies, and anyone you can't identify.
• Use two-factor authentication properly. Require 2FA for everyone in your Business Manager, and prefer an authenticator app over text messages. Then remember the rule above: never type a code into a page you reached from an email.
• Set spending guardrails. Account spending limits and billing alerts won't stop a takeover, but they cap the damage and give you an early warning if fraudulent ads start running.
• Separate roles. Not everyone needs admin. Give employees the minimum access their job requires, so one phished team member can't hand over the whole account.
• Train the people with the keys. Everyone with admin or editor access to your Page should know these lures exist. The technical controls don't protect against a colleague clicking Approve.

📋  Make it a standing team rule: all Meta account issues get verified by logging in directly, and all partner requests get confirmed by phone with the requesting party before anyone clicks Approve.

Already clicked? Do this now

Speed matters more than embarrassment. If you or someone on your team entered credentials or approved a suspicious request, work through this sequence right away:

1. Change your Facebook password immediately, along with the password on the email account attached to your Facebook login.
2. End all active sessions in your Facebook security settings, so anyone logged in with stolen credentials gets kicked out.
3. Remove the attacker's access. In Business Manager, check Partners and People, and remove any partner or user you don't recognize. Check that your admin role hasn't been demoted.
4. Check ad activity and billing. Pause any campaigns you didn't create, and contact your card issuer about disputed charges.
5. Reset 2FA if you shared a code or followed a "setup guide," since your authentication may now point to the attacker's device.
6. Report it. Use Meta's hacked-account recovery flow, and report the fraud to the Canadian Anti-Fraud Centre (CAFC) at 1-888-495-8501 or through its online reporting portal, even if you caught it before losing money.

If customer data may have been exposed (for example, exported audience lists containing personal information), talk to your IT provider about your obligations under PIPEDA, Canada's federal privacy law, which can require notifying affected individuals after a breach.

Frequently Asked Questions

How can a phishing email come from a real Meta address?

Attackers abuse legitimate Meta features, like partner requests and business notifications, that send email on Meta's behalf. The message is generated by Meta's own systems, so it passes authentication checks. The malicious part is the content the attacker controls, such as the account name or an embedded link. Meta has added guardrails against specific campaigns as researchers report them, but the underlying tactic keeps evolving.

I have 2FA enabled. Am I safe?

Safer, but not immune. Modern phishing pages capture your 2FA code the moment you type it and use it in real time to log in. And the partner-request version of the attack needs no credentials at all. 2FA is still essential; it just isn't a substitute for verifying requests inside the platform.

What does a legitimate Meta email address look like?

Meta's genuine notifications come from a small set of domains such as facebookmail.com and business.facebook.com. The catch is that this campaign uses those real domains too. Sender checks still filter out lazier scams, but for anything involving your Business Manager, verify inside the platform rather than trusting the sender line.

We use an outside agency for our ads. Does that change anything?

It raises the stakes. Agencies receive legitimate partner requests all the time, which is exactly the reflex these scams exploit, and one compromised agency login can expose every client they manage. Ask your agency how they verify partner requests and who on their team holds admin access to your assets.

Is this only a Facebook problem?

No. The same Business Manager typically controls Instagram advertising, and similar account-takeover phishing targets Google Ads, LinkedIn, and TikTok business accounts. The habits in this post (verify in-platform, least-privilege access, guarded approvals) protect all of them.

Not sure who has the keys to your ad accounts? Always Beyond can train your team to spot these lures before anyone clicks Approve. And if you don't already have a partner managing your Meta presence, our partners at Catch Digital can help you keep it in good hands. Reach out to start the conversation.