Meta has two phone checks, and only one of them belongs to the business

Check one: advertiser phone verification

This is the business-level one. Meta says “new Meta advertisers can verify their phone number, which may be required before publishing ads”, and it is not optional for everyone: “Marketing API advertisers … must verify their phone number using one of these services” (Meta). The channels it lists are text message, phone call and WhatsApp, and “Confirmation codes expire after 30 minutes.”

A number tied to the business rather than to whoever happened to run the campaign is the right answer here, and it is the part of Meta's stack where a company line genuinely fits.

Check two: two-factor, and it is personal

• Meta Business Help, on two-factor for a business portfolio

  “People must set up two-factor authentication using their personal Facebook profile.”

  https://www.facebook.com/business/help/865384580786591

• Facebook Help, on who profiles are for

  “Profiles are for individual use only. You can create a Page for a business, organization or idea.”

  https://www.facebook.com/help/112146705538576

So there is no shared second factor to build, and no honest way to sell one. Everyone who touches the portfolio sets 2FA up on their own profile: “everyone it applies to must set up two-factor authentication on their personal Facebook account before they can access the business portfolio” (Meta). People are invited by an email address that “must match the one used for their Facebook account” (Meta).

When Meta starts insisting

The requirement arrives on a timer. “Business portfolios less than 90 days old: Two-factor authentication is optional”, and “For security reasons, Meta automatically requires two-factor authentication for some business portfolios that are more than 90 days old.” If that lands on yours, “you cannot turn off the requirement” (Meta).

The consequence of ignoring it is commercial: “If two-factor authentication isn't turned on, Meta may restrict or remove people's access to advertising, remove their permission to manage or edit their shop” (Meta). And “advertisers may be required to complete two-factor authentication in order to publish ads”, including “users with advertising access targeting certain regions and certain business portfolios that are more than 90 days old.”

How often the code is asked for

• Meta Business Help, on business portfolio access

  “Two-factor authentication is a security feature that requires people to enter a security code each time they try to access their business portfolio … from a browser or mobile device Meta doesn't recognize.”

  https://www.facebook.com/business/help/865384580786591

In practice that can mean far more often than it sounds. Meta warns that “If you use private browsing mode or have your browser set to clear history when it closes, Meta cannot remember your device”, with the result that “you may need to enter a verification code every time you log in, even from the same computer”. Third-party tools trigger it too: “If you use a third-party app to manage the Facebook Pages or ad accounts … you will be asked to enter a verification code the next time you sign in” (Meta).

What Meta publishes about number type

Nothing. Across the business and personal help pages we read, Meta never mentions VoIP, virtual numbers or landlines. It names delivery channels — text message, phone call, WhatsApp — and stops there. There is no rule to satisfy and none to quote. What makes a number non-VoIP explains the check that services run anyway, whether or not they publish the result.

Setting it up

Requiring two-factor across a portfolio, from Meta's instructions (Meta):

1. 01In Meta Business Suite, open Settings.
2. 02Go to Business portfolio info, then Business options.
3. 03Open the dropdown next to Two-factor authentication.
4. 04Choose Admins only, Everyone or No one.

Each person then enrols on their own profile: profile picture → Settings and privacy → Settings → Accounts Center → Password and security → Two-factor authentication, then “Choose the security method you want to add and follow the on-screen instructions” (Meta). The three methods offered are a security key, a third-party authentication app, and text message codes.

If the number is gone

Recovery codes first — “one-time backup codes that you can generate from your Facebook Security and Login Settings” — or an already-signed-in device: “If you are already logged in to Facebook from a different browser, phone, or tablet, check your Facebook notifications on that device.” Failing both, it becomes identity proof: “a photo of a government-issued ID (such as a driver's license or passport), answering security questions about your account” (Meta).

Where a Cleat line fits

On the advertiser verification and the business's own contact number, not on anybody's personal profile. A Cleat line is a real US mobile number, not VoIP, held by one identity-verified person, with an inbox a team can read, at $24.99 a month. For an agency, Cleat for teams sets out the model that survives an engagement ending: the client owns the line and invites you, and your access stops when they remove you.

When Cleat is the wrong answer here

• Personal profile 2FA. Covered above. Each person, their own profile, their own factor — ideally a security key or an authenticator app.
• A profile in a business's name. Meta says profiles are for individual use only and that pretending to be anything or anyone is not allowed.
• Getting back into a restricted portfolio. A new number is not a new person, and Meta's recovery path runs through government ID.
• Sending anything. The line receives texts and transcripts of incoming calls. It cannot reply or dial, and it cannot reach 911.

Keep reading

TikTok Ads Manager · Google Workspace · LinkedIn · Every service in this section