Module 25

Account safety, ad accounts and agencies

6 lessons, 40 stepsOne instruction at a time, each with the result to expect. Tick steps as you go; Helix remembers.

Outcome: every account that runs your business is locked down and owned by you. You know what to do in the first hour of a hack, how to get a disabled ad account reviewed, and how to work with or leave an agency without losing your history.

Related: Module 7 Meta ads in practice, Module 20 Ad analysis, audiences and campaign setup, Module 16 Founder rhythm, team and resilience, Module 10 Email, SMS and messaging

In plain words

Stage: Grow (keep more of every sale, then scale). Every lesson below is tagged with its stage; see Attract, Convert, Grow.

What it is: Keep your ad accounts, store and email safe, and owned by you.

Why it matters: A hacked or disabled ad account can stop your sales overnight or spend thousands of dollars in hours.

Do this:

Turn on two-factor sign-in with an app on every account and add a second trusted admin.

Own your business portfolio and ad account; give agencies partner access only.

Set an account spending limit and know the first-hour steps if you are hacked.

Words to know:

Two-factor authentication: A second check, like a code from an app, needed to log in. It stops most account takeovers.

Business portfolio: Meta's home for your business assets: ad accounts, Pages, pixels and the people who can use them.

Partner access: Letting an agency or freelancer use your ad account through their own business, while you keep ownership.

All words are explained in the glossary.

Lesson 25.1: Lock down every accountGrow

Why this matters

One stolen password can cost more than a bad month of sales. Thieves target ad accounts because they can spend your money fast. An hour of lock-down work closes most doors.

0 of 7 steps done

Step 1 of 7

List every account the business depends on: email and domain, Shopify, Meta, Google, TikTok, your email tool, payment providers, bank and domain registrar.

Expected result

You have one list of every account.

Lesson 25.2: Set up your Meta business the safe wayGrow

Why this matters

Meta keeps your ad accounts, Pages, pixel and people in a business portfolio (formerly Business Manager). Whoever owns the portfolio controls everything in it, so it must be you.

0 of 7 steps done

Step 1 of 7

Create the business portfolio yourself with your business email, and make yourself and one trusted person admins (see Meta Business Help Centre).

Expected result

You own the portfolio and have a backup admin.

Lesson 25.3: When your ad account is disabled or restrictedGrow

Why this matters

Ad accounts get restricted for failed payments, policy flags, identity checks or unusual activity. Most cases can be fixed if you stay calm and follow Meta's process.

0 of 7 steps done

Step 1 of 7

Open Account Quality in Meta and read the exact reason.

Expected result

You know why the account is restricted.

Lesson 25.4: Hacked: the first hourGrow

Why this matters

Speed matters. A hacked ad account can spend thousands in a few hours, so work through these steps in order.

0 of 8 steps done

Step 1 of 8

Turn off every active campaign you did not create, then pause all campaigns.

Expected result

Nothing is spending.

Lesson 25.5: Working with agencies, and leaving oneGrow

Why this matters

An agency can save time, but your accounts, data and history must stay yours. See also Lesson 16.7.

0 of 7 steps done

Step 1 of 7

Before you sign, list what you must own: ad accounts, pixel and datasets, Shopify, domain, email tool and Google Ads, and give the agency partner or user access only.

Expected result

Every account is owned by you.

Lesson 25.6: Trusted sender names for texts and emailsGrow

Why this matters

Phone networks and inbox providers now check that messages really come from you. Unregistered senders get labelled or sent to spam.

0 of 4 steps done

Step 1 of 4

In your email tool's settings, authenticate your sending domain with SPF, DKIM and DMARC (three records that prove email is really from you).

Expected result

The tool shows the domain as authenticated.

Words to know in this module

Campaign: The top level in an ad account. It holds the goal, like getting sales.
Business portfolio: Meta's home for your business assets: ad accounts, Pages, pixels and the people who can use them.
Partner access: Letting an agency or freelancer use your ad account through their own business, while you keep ownership.
Two-factor authentication: A second check, like a code from an app, needed to log in. It stops most account takeovers.
Domain: Your store's web address, like yourbrand.com.
Pixel: A small piece of code on your store that tells Meta when someone views, adds to cart or buys.
GST: Goods and services tax: 10% in Australia (15% in New Zealand), added to most sales once you are registered.
Organic: Unpaid: posts, search results and word of mouth that you do not pay to show.
Session: One visit to your store. One person can make several visits.
Chargeback: When a customer asks their bank to reverse a card payment. The bank takes the money back until you prove the sale.
Profit: What is left from sales after product cost, shipping, payment fees, discounts, refunds and ads. This is the number Helix cares about most.
Creative: The ad itself: the picture or video plus the words.

All words to know