There is a version of the page theft approach that catches even experienced admins, because it does not look like an approach at all. It looks like an official notification.
What you see
A notification arrives on the page or on your personal profile saying that a business wants access to your page, or that a Business Manager has requested to add it. The wording is administrative. There is a button to accept. Nothing about it looks like a message from a stranger, because strictly speaking it is not: it is a real platform notification generated by a real request.
Why it works
Most scams ask you to do something unusual. This one asks you to approve something that happens legitimately every day between agencies and their clients. Admins who would never give out a password click accept without much thought, because the interface itself is presenting the request.
Once the request is approved at the wrong level, whoever made it can remove the existing admins. The page is then inside a business account you have no way to reach.
How to handle it
- Never accept a Business Manager or page access request you did not initiate yourself.
- If you were expecting one from a genuine partner, confirm it through a separate channel before accepting.
- Check what level of access is being requested. Full control is never appropriate for a third party.
- Review page roles and connected businesses regularly and remove anything unfamiliar.
- Keep two factor authentication on the account that owns the page.
If you are selling
This is the reason we never ask a seller for access before payment, and the reason a middleman exists. Access and money should move together, with someone sitting between both sides. Anyone who needs access first is telling you what they are. Our longer write up of the method is in the Business Manager invite scam.
Thinking of selling?
We give free valuations with no obligation. Send us the page URL and a representative replies with a figure, usually within one business day. Looking to buy instead? Register as a buyer.
