Facebook Business Manager partner request: real, or a scam?

The e-mail looks official. It comes from a real Meta address, it carries the Meta logo, and it says a business you have never heard of wants to become your partner. Before you click the button, take two minutes to read this.

What a partner request is

Meta lets one business give another business access to its Facebook Page, its Instagram account or its ad account. Meta calls that other business a partner. It is how agencies and freelancers work on a client's accounts without ever knowing the client's password.

A partnership can start in two ways:

• You add the partner. You open your business settings, paste the partner's business ID and choose what they can work on. Nothing is sent to you, because you started it.
• The partner asks you. Another business requests access to your Page or ad account, and Meta e-mails you to review the request.

The second way is the one that lands in your inbox, and it is the one scammers have learned to use.

Why a genuine Meta e-mail can still be a trap

Security researchers at Huntress and at CyberHUB-AM described the same kind of campaign in 2026. Attackers create business accounts with official-sounding names, such as "Agency Partner Program", and send partner requests through Meta's own system. Meta then e-mails the request to you. The message is not forged: it really is sent by Meta, so it passes the checks your mail provider uses to catch fakes.

The people behind it want one of two things:

• Your approval. If you accept, a stranger gets lasting access to whatever you tick: your Page, your ad account, your customer lists. CyberHUB-AM lists what follows: ads run on the victim's credit line, posts published without the owner knowing, audience data copied out.
• Your login. Some requests carry a link inside the business name. It leads to a copy of a Meta page that asks for your password, your security code, and in some cases a photo of your ID. Huntress saw the stolen details sent straight to the attackers.

Huntress traced the campaign back to late 2025, so this is not a one-week wave.

How to check a request in two minutes

1. Do not click anything in the e-mail, not even "View request".
2. Open a new browser tab, type business.facebook.com yourself and log in.
3. Go to Settings, then Requests, and look at what is listed under Received.
4. Nothing waiting there? Then the e-mail is not a request you need to answer. Delete it.
5. A request from a business you do not know? Decline it. A real partner will get in touch another way.

A request is safe only when three things are true: you were expecting it, you know the business that sent it, and you have checked their business ID with them by phone or in person.

When a partner request is perfectly fine

If you have just hired an agency, a freelancer or a service like ours, they need access, and the partner system is the right tool for it. It is far safer than handing over your password.

The safest version is the one where you do not wait for a request at all. Ask the people you hired for their business ID and add them yourself: Settings, then Users, then Partners, then Add, then "Give a partner access to your assets". You choose exactly what they can touch, and nothing arrives by e-mail that a scammer could imitate.

That is how we work with every customer. We never send partner requests. You add us from your own settings, following a step-by-step guide in your account, and you can remove us with one click.

If you already clicked or accepted

1. Open Settings, then Users, then Partners. Remove every partner you do not recognize.
2. Change your Facebook password, and turn on two-factor authentication if it is off.
3. Open your ad account and look for campaigns you did not create. Pause them, then check the billing page for charges.
4. Check who has access to your Page and remove anyone who should not be there.
5. If you typed card details on a page you reached from the e-mail, call your bank.

Three habits that keep your Page yours

• Two-factor authentication on every Facebook account that manages your Page.
• Two people with full control, so one lost phone does not lock the business out of its own Page.
• Access by role, never by password. People and partners can be removed in a click. A shared password cannot be taken back.

Is your Meta setup a tangle of old Pages, former employees and an ad account nobody can log in to? We can sort it out with you on a single call. It is one of the one-time jobs on our pricing page.