Unknown admin or finance access on your Meta Business portfolio? How to remove them safely, lock payments and check what changed.
If an unknown person was added as admin or with finance access in your Meta Business portfolio, remove them from People while you still can, then review ad accounts, payment methods and partners. Secure the Facebook logins that own the portfolio and watch for new spend. This guide focuses on a newly added unknown admin.
SummaryYou open Meta Business Suite and see a name you do not recognise under People. The role shows full access, or finance access. You did not add them. Your ad account still has a card on file. You need them out before they remove you or spend on your budget.
Alpha Cyber's November 2026 analysis of DUCKTAIL, NodeStealer and SYS01 describes malware families that take over Facebook Business accounts and notes a practical first step: list everyone with admin or finance rights and remove anyone you cannot name. This guide focuses on that moment, when an unknown admin or someone with finance access has just appeared. For wider Business Manager compromise and chargeback paths, see Facebook Business Manager hacked and Meta Business Manager hacked ad spend chargeback. One wrong step can cost you the account, so know what you are doing before you start.
Last checked: 5 November 2026.
If an unknown person was added as admin or with finance access in your Meta Business portfolio, remove them from People while you still can, then review ad accounts, payment methods and partners. Secure the Facebook logins that own the portfolio and watch for new spend. This guide focuses on a newly added unknown admin.
Meta's business portfolio permissions page says a business portfolio lets organisations manage Pages, Instagram accounts and other assets in one place, and manage who can work on them. People can have full access or partial access, plus advanced options for finance access.
People with full access can manage portfolio settings, people and assets, claim or remove assets or people, and delete the portfolio. That is why an unknown person with full access is urgent: they may be able to remove your access next.
| Check now | Action if unknown |
|---|---|
| People list and roles | Remove anyone you cannot name, starting with full access and finance |
| Ad accounts | Remove their access and pause campaigns you did not approve |
| Payment methods | Remove cards you do not control and watch bank alerts |
| Pages and Instagram assets | Remove unknown admins and review recent posts |
| Partners | Remove partner businesses you did not invite |
| Personal Facebook sessions | End unknown sessions on each login that can manage the portfolio |
Meta's add people page explains how people are added to a portfolio and assigned assets. Use the same People tools in reverse to remove access you did not grant.
Business access rides on personal Facebook accounts. Facebook's phishing page and hacked account page cover password changes and recovery if a login was stolen. Visit facebook.com/hacked on a known device if you cannot secure a login the usual way.
If ads already charged your card, see Facebook hacked ads charged my card. If a Page admin was removed, see Facebook Page hacked admin removed.
Malaysian SMEs and agencies commonly share one portfolio across staff and freelancers. That habit can hide an added admin until spend appears. Keep a written list of who should have access, and review People after any staff change or suspicious email.
Meta decides how Business support and disabled ad accounts are handled. Your part is to remove unknown people quickly, secure the controlling logins and document unauthorised spend for your bank.
Someone with finance access may reach payment tools without holding every portfolio switch. Full access is broader and can include removing people and assets. Either role in unknown hands is urgent. Remove the person from People first while your own access still works, then strip asset by asset access if anything remains.
Write down the exact name, time seen and role before you remove them. That note helps if you later talk to your bank about unauthorised ad spend or if Meta Business support asks what changed.
If you were already removed before you saw the unknown admin, you need Meta's Business support paths and the wider Business Manager guides linked above, not only this removal order.
Agencies that hold client portfolios should treat an unknown person with finance access as an incident: notify the client contact, pause spend you do not recognise, and document the People list before and after removal.
Do not log into Business Suite from a public computer while you remove people. Use a known device, then end the session when you finish.
Shared logins between founders are common in Malaysian SMEs and make it harder to see who added the unknown person. Move each founder to their own Facebook login with two factor authentication, then review People again.
Export a CSV or screenshot of People and of ad account roles before and after the removal. Store them offline with the date. That paper trail matters when a client asks who had finance access.
If your bank already declined a charge, keep the decline SMS. It supports a later dispute if spend continues from another card still on the ad account.
Train staff that unexpected People invites by email are not routine. Confirm additions in person or on a known company chat before anyone accepts portfolio access.
If a second unknown person appears after you remove the first, stop and secure every controlling login again before you touch ads. Repeat additions point to an active session thief.
Getting help is safer when you were already removed as admin, when spend is still running, or when several client portfolios are linked through the same login. Acting in the wrong order can lock you out while the attacker keeps access.
If you are unsure about any step, or the portfolio matters to your income or clients, having an experienced team check it is the safer choice. AwareXone does this work. See our Business Manager recovery page.
A case review helps when you need a removal order across People, ads and payments without losing your own access. We are a Malaysia-based team, independent of Meta, and we use only the official routes. We do not ask for your password or codes, and we cannot promise a result. See our trust page.
More free guides on the same kind of problem.
