# Unknown Admin Added to Your Meta Business Portfolio? > Unknown admin or finance access on your Meta Business portfolio? How to remove them safely, lock payments and check what changed. - URL: https://www.awarexone.com/research/meta-business-portfolio-unknown-admin-finance-editor-added-ad-stealer - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-11-05 - Topics: Meta Business, Ads, Hacked, Malaysia - Related service: Business Manager recovery: https://www.awarexone.com/business-manager-recovery ## Short answer If an unknown person was added as admin or with finance access in your Meta Business portfolio, remove them from People while you still can, then review ad accounts, payment methods and partners. Secure the Facebook logins that own the portfolio and watch for new spend. This guide focuses on a newly added unknown admin. ## Summary - Meta Business Suite lets people hold full or partial access on a portfolio, including advanced finance options. - Security research on ad account stealers shows attackers adding themselves to business accounts after stealing sessions. - Remove unknown people before they remove you, then review ad accounts, payment methods and partner connections. - Change passwords on the personal Facebook logins that control the portfolio and end unknown sessions. - One wrong step can cost you the account, so know what you are doing before you start. You open Meta Business Suite and see a name you do not recognise under People. The role shows full access, or finance access. You did not add them. Your ad account still has a card on file. You need them out before they remove you or spend on your budget. Alpha Cyber's [November 2026 analysis](https://alpha-cyber.com/facebook-ad-account-stealers-ducktail-nodestealer-sys01/) of DUCKTAIL, NodeStealer and SYS01 describes malware families that take over Facebook Business accounts and notes a practical first step: list everyone with admin or finance rights and remove anyone you cannot name. This guide focuses on that moment, when an unknown admin or someone with finance access has just appeared. For wider Business Manager compromise and chargeback paths, see [Facebook Business Manager hacked](https://www.awarexone.com/research/facebook-business-manager-hacked-malaysia) and [Meta Business Manager hacked ad spend chargeback](https://www.awarexone.com/research/meta-business-manager-hacked-ad-spend-chargeback). One wrong step can cost you the account, so know what you are doing before you start. Last checked: 5 November 2026. ## Quick Answer If an unknown person was added as admin or with finance access in your Meta Business portfolio, remove them from People while you still can, then review ad accounts, payment methods and partners. Secure the Facebook logins that own the portfolio and watch for new spend. This guide focuses on a newly added unknown admin. ## What Full Access and Finance Rights Can Do Meta's [business portfolio permissions page](https://www.facebook.com/business/help/442345745885606) says a business portfolio lets organisations manage Pages, Instagram accounts and other assets in one place, and manage who can work on them. People can have full access or partial access, plus advanced options for finance access. People with full access can manage portfolio settings, people and assets, claim or remove assets or people, and delete the portfolio. That is why an unknown person with full access is urgent: they may be able to remove your access next. ## Portfolio Audit Sheet *Portfolio audit sheet by AwareXone, based on Meta Business Help Centre read 5 November 2026.* | Check now | Action if unknown | | --- | --- | | People list and roles | Remove anyone you cannot name, starting with full access and finance | | Ad accounts | Remove their access and pause campaigns you did not approve | | Payment methods | Remove cards you do not control and watch bank alerts | | Pages and Instagram assets | Remove unknown admins and review recent posts | | Partners | Remove partner businesses you did not invite | | Personal Facebook sessions | End unknown sessions on each login that can manage the portfolio | ## Removal Order So They Cannot Remove You First 1. Sign in on a device and network you trust. 2. Open Meta Business Suite, go to People, and remove the unknown person while your own full access still works. 3. Remove their access from each ad account, Page and Instagram asset. 4. Remove unknown partners. 5. Change the password on every personal Facebook login that has full access to the portfolio. 6. Turn on two factor authentication on those logins and end sessions you do not recognise. 7. Review payment methods and recent ad spend. Meta's [add people page](https://www.facebook.com/business/help/2169003770027706) explains how people are added to a portfolio and assigned assets. Use the same People tools in reverse to remove access you did not grant. ## Secure the Facebook Logins Behind the Portfolio Business access rides on personal Facebook accounts. Facebook's [phishing page](https://www.facebook.com/help/166863010078512) and [hacked account page](https://www.facebook.com/help/1216349518398524) cover password changes and recovery if a login was stolen. Visit facebook.com/hacked on a known device if you cannot secure a login the usual way. If ads already charged your card, see [Facebook hacked ads charged my card](https://www.awarexone.com/research/facebook-hacked-ads-charged-my-card). If a Page admin was removed, see [Facebook Page hacked admin removed](https://www.awarexone.com/research/facebook-page-hacked-admin-removed). ## Malaysian SMEs and Shared Ad Accounts Malaysian SMEs and agencies commonly share one portfolio across staff and freelancers. That habit can hide an added admin until spend appears. Keep a written list of who should have access, and review People after any staff change or suspicious email. > Warning: **Session stealers skip your password prompt.** Some malware steals a logged in browser session, so a password change alone may not be enough if the device is still infected. Use a clean device, update your password there, and remove unknown people again if they reappear. ## What Only Meta Can Decide Meta decides how Business support and disabled ad accounts are handled. Your part is to remove unknown people quickly, secure the controlling logins and document unauthorised spend for your bank. ## Finance Access Versus Full Access Someone with finance access may reach payment tools without holding every portfolio switch. Full access is broader and can include removing people and assets. Either role in unknown hands is urgent. Remove the person from People first while your own access still works, then strip asset by asset access if anything remains. Write down the exact name, time seen and role before you remove them. That note helps if you later talk to your bank about unauthorised ad spend or if Meta Business support asks what changed. ## After Removal: Watch for Re-Adds - Check People again the next day. - Review whether a partner business can still add users. - Confirm two factor authentication on every controlling Facebook login. - Pause ad accounts that show spend you did not approve. If you were already removed before you saw the unknown admin, you need Meta's Business support paths and the wider Business Manager guides linked above, not only this removal order. Agencies that hold client portfolios should treat an unknown person with finance access as an incident: notify the client contact, pause spend you do not recognise, and document the People list before and after removal. Do not log into Business Suite from a public computer while you remove people. Use a known device, then end the session when you finish. ## Payment Methods After a Scare - Remove cards the unknown person could have seen. - Set bank alerts for Meta or Facebook charges. - Download recent billing statements from Ads Manager while you still can. - Tell your finance teammate which campaigns stay paused. Shared logins between founders are common in Malaysian SMEs and make it harder to see who added the unknown person. Move each founder to their own Facebook login with two factor authentication, then review People again. Export a CSV or screenshot of People and of ad account roles before and after the removal. Store them offline with the date. That paper trail matters when a client asks who had finance access. If your bank already declined a charge, keep the decline SMS. It supports a later dispute if spend continues from another card still on the ad account. Train staff that unexpected People invites by email are not routine. Confirm additions in person or on a known company chat before anyone accepts portfolio access. If a second unknown person appears after you remove the first, stop and secure every controlling login again before you touch ads. Repeat additions point to an active session thief. ## When It Is Safer to Get Expert Help Getting help is safer when you were already removed as admin, when spend is still running, or when several client portfolios are linked through the same login. Acting in the wrong order can lock you out while the attacker keeps access. If you are unsure about any step, or the portfolio matters to your income or clients, having an experienced team check it is the safer choice. AwareXone does this work. See our [Business Manager recovery](https://www.awarexone.com/business-manager-recovery) page. ## When a Case Review Makes Sense A case review helps when you need a removal order across People, ads and payments without losing your own access. We are a Malaysia-based team, independent of Meta, and we use only the official routes. We do not ask for your password or codes, and we cannot promise a result. See our [trust page](https://www.awarexone.com/trust). ## Frequently Asked Questions ### Someone I do not know has finance access on my Business portfolio. What first? Remove them from People while you still have access, then review payment methods and ad accounts. ### Why would an attacker want finance access? Finance and full access can reach payment methods and ad accounts. Security research on ad stealers focuses on business accounts for that reason. ### I changed my password but the unknown admin came back. Why? A stolen session or an infected device can let them back in. Use a clean device, end sessions and remove them again. ### Is this the same as a full Business Manager hack guide? No. This guide focuses on an unknown admin or someone with finance access who was just added, and on removing them before they remove you. ### Should I pause all ads? Pause campaigns you did not approve and remove unknown access first, then restart only what your team confirms. ## Official sources - [Official: About business portfolio and business asset permissions in Meta Business Suite, Meta Business Help Centre (read 5 November 2026)](https://www.facebook.com/business/help/442345745885606) - [Official: Add people to a business portfolio and assign a business asset, Meta Business Help Centre (read 5 November 2026)](https://www.facebook.com/business/help/2169003770027706) - [Official: Protect yourself from phishing on Facebook, Facebook Help Centre (read 5 November 2026)](https://www.facebook.com/help/166863010078512) - [Official: Recover a hacked account, Facebook Help Centre (read 5 November 2026)](https://www.facebook.com/help/1216349518398524) --- AwareXone is an independent provider serving clients worldwide, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.