“Your Facebook business assets are worth protecting. A scam that looks this legitimate is exactly the kind of thing that catches smart, careful people off guard. Knowing what to look for is your first line of defence.”

Kat Milner
Business Growth Mentor, Systems Strategist & Chief Tech Ninja
Simplify Your Brand | Simplify Your Tech

Helping coaches build businesses that attract clients consistently by making their messaging, strategy, and tech work together seamlessly.

Introduction:

I got the email. My first thought was: Did I miss something? What if this is actually real?

That moment of doubt is exactly what scammers are counting on.

There is a scam circulating right now that is catching people off guard, not because it is poorly disguised, but because it triggers a genuine Facebook notification email. It looks real because part of it is. And it is almost too easy to fall for it.

Here is exactly what it looks like and what to do about it.

1. Why this scam is different from everything else in your inbox

Most of us know what a phishing email looks like. Dodgy sender address. Bad grammar. A link that does not quite look right. We have learned to spot those and scroll past.

This one is different.

A bad actor sends a partner request through Facebook Business Manager. Because it goes through Facebook's own system, the notification email you receive is completely real. It comes from [email protected]. It is signed and mailed by business.facebook.com. It uses standard encryption. Gmail may even flag it as important.

There is nothing in the email itself that tells you something is wrong. That is what makes it dangerous.

2. What it actually looks like when it arrives

The subject line reads: You've received a Business Manager partner request.

Inside the email you will see:

•A warning from Meta that the sender is not part of or affiliated with Meta

•An explanation that partners are businesses you work with on Facebook and that approving gives them access to your business assets

•A prompt to visit Meta Business Suite to view and respond to the request

•A blue button labelled View request

Here is what scammers are counting on: that warning from Meta is right there in the email. Most people miss it because the rest of the email looks so official. The button is right there. It is easy to click. And that doubt creeps in: what if I did sign up for something and forgot?

3. What you hand over if you click "Approve"

If you click through to Business Manager and approve the request, you are giving a stranger controlled access to your Facebook business assets. Depending on what you grant, that includes:

•Your Facebook Pages

•Your ad accounts and your ad budget

•Your pixels and all the tracking data you have built up

•Your Instagram accounts connected to Business Manager

Once access is granted, a scammer can run ads using your billing details, change your page settings, lock you out, or harvest your audience data. Your ad budget can disappear fast. Some of this damage is very difficult to reverse.

4. The one rule that keeps your business assets safe

Only approve partner requests from people and businesses you know personally and are actively working with.

That is it. That is the whole rule.

A legitimate agency or business partner will always reach out to you directly through a channel you already use before sending any kind of access request.

If a request arrives without that conversation happening first, it is not legitimate. Do NOT click View request. Do not investigate. Do not reply to the email. Ignore it or report it to Meta.

5. How to check who already has access to your Business Manager

It is worth checking your Business Manager right now, even if you have not received a suspicious request. Many coaches are surprised by what they find.

1.Go to business.facebook.com

2.Click Settings in the left menu

3.Under Users, click Partners

4.Review the list carefully

5.Remove anyone you do not recognise or did not intentionally add

If you see something unexpected, remove the access first and ask questions later.

6. What to do if you already clicked

If you have already approved a request and are not sure it was legitimate, move quickly:

1.Go to Business Manager Settings and remove partner access immediately

2.Check your ad accounts for any unauthorised activity or new campaigns

3.Review your Pages for changes to settings, admins, or published content

4.Change your Facebook password and turn on two-factor authentication

5.Report the incident to Meta through the Help Centre

The sooner you act, the less damage can be done.

7. Why your Facebook assets are worth protecting

Client attraction often begins to feel easier when the path through your business becomes simple to follow.

When people recognise themselves in your message, understand the outcome of working with you, and can easily see how to begin, the experience changes.

There isn’t always a dramatic moment where everything suddenly transforms. Instead, the experience of running your business begins to feel different.

You notice that conversations about your work become easier. When someone asks what you do, the explanation comes out more naturally. People seem to understand more quickly who your work is for and whether it applies to them.

Potential clients start recognising themselves in your message sooner.

Your website feels easier to navigate because there’s a clear path through it. Your content becomes simpler to write because you’re no longer trying to speak to everyone at once. The next step in your business becomes visible instead of hidden behind layers of explanation.

When that clarity is present, your systems and technology begin supporting your work rather than complicating it.

Clients no longer have to figure things out on their own. They can see where the path begins and decide whether they want to follow it.

That shift may appear subtle from the outside, but it often changes the entire experience of attracting clients.

A Few Final Thoughts

Your Facebook Page is where potential clients find you. Your pixel carries months or years of audience data you cannot get back. Your ad account holds your billing information and your campaign history.

These are not just tech assets. They are business infrastructure. And the coaches who know what access exists, who holds it, and how to revoke it quickly are the ones who catch these things before they become a crisis.

You do not need to be a tech expert to stay safe. You just need the one rule: if you did not initiate it, do not approve it.

The rule is simple: only approve partner requests from people and businesses you know personally and are actively working with. If the request arrived without a prior conversation, it is not legitimate.

Tell me: Have you received one of these requests? Or found unexpected partner access in your Business Manager?

Your next step...

If reading this has you wondering whether the next step in your own business is as clear as it could be, Clarity Means Clients is designed to help you explore exactly that.

It’s a live, guided session where we step back from the day-to-day activity of running your business and look at the foundations underneath it. Together we work through the questions that help clarify who your work is really for, what transformation you offer, and how potential clients move forward once they discover you.

Many coaches try to solve these questions alone, which can make the process feel much harder than it needs to be. Having a structured environment and supportive conversation often makes those insights appear much more quickly.

If this article has sparked a sense that your own client journey could become clearer, you’re welcome to take a look and see whether Clarity Means Clients feels like the right next step for you.

Learn more here.

If you haven't already joined the Facebook group, click here to be part of Simplify Your Tech with the Tech Ninja.