Updated: July 2026 | 6 min read
Most accounts are lost in the first 48 hours. Not by Facebook’s algorithm running a routine check — by the buyer doing something that looks completely normal but triggers an instant restriction. Changing your password. Updating 2FA. Editing your recovery email. All three actions look safe. All three can destroy a newly received account before a single ad runs. Here’s the rule that prevents it.
In This Article:
What the 72-Hour Rule Is
The 72-hour rule is a post-purchase protocol: for the first 72 hours after receiving a new Facebook account, you don’t change any security settings, add any payment methods, or modify any account credentials. You log in. You browse. You let the account settle.
It’s not a Facebook policy written anywhere in their documentation. It’s the observed behavior of their security system — and buyers who don’t know it lose accounts at a disproportionate rate compared to those who do. The difference between a working account a week later and an instant restriction is often this single rule.
Why Facebook Enforces It
Facebook’s security system tracks what it calls “account consistency” — whether the device accessing the account, the location of access, and the account’s recent behavior all match the expected pattern for that user. When an account is created or transferred, there’s a baseline period where the system is building that consistency record.
When a buyer receives an account and immediately changes the password, Facebook sees this pattern: new unrecognized device + first login + immediate credential change. This exact sequence matches the pattern of an account takeover — when an attacker compromises someone’s account and immediately locks them out by changing the password. The security system doesn’t know you’re the legitimate new owner. It reacts to the pattern.
The 72-hour window lets the device relationship establish first. After 72 hours of normal, consistent behavior from one device, a password change looks like routine account maintenance — not a takeover. Related: Why Facebook Ad Accounts Get Restricted: 7 Real Reasons
What to Avoid in the First 72 Hours
Four categories of actions trigger restrictions during the 72-hour window. Avoid all of them without exception.
Password changes. The most common mistake. Feels like the obvious first step for security — it’s the most common first cause of restriction. Don’t change the password until hour 72 minimum.
Two-factor authentication modifications. Adding, removing, or changing the 2FA method — authenticator app, phone number, or backup codes — all trigger the same security flag as a password change. Leave 2FA settings exactly as they are until after the 72-hour window.
Recovery email changes. Updating the account recovery email signals to Facebook that someone is trying to lock out the original owner by redirecting recovery access. Even if your intent is legitimate, the pattern is flagged identically to a malicious takeover.
Adding payment methods immediately. Adding a card or payment method within the first few hours of a new device login triggers a payment risk flag. Wait until security settings are updated and the account has established a stable device history — typically after the 72-hour window.
What’s Safe to Do
During the first 72 hours, your goal is to look like a normal user — because to Facebook’s system, that’s exactly what builds device trust. Safe actions during this window:
- Logging in consistently through the same antidetect browser profile
- Browsing the news feed — scrolling, reading posts
- Liking and commenting lightly on content (don’t over-engage immediately)
- Viewing Pages and Groups without joining rapidly
- Checking the Business Manager structure (viewing, not modifying)
- Setting up your antidetect browser profile properly before first login
The antidetect browser profile should be set up before you log in for the first time. If you haven’t done this yet, read: Antidetect Browser Setup for Facebook Ads: The 2026 Guide
What Happens If You Break It
The most common sequence when a buyer breaks the 72-hour rule:
Hour 0: Account received, login on new device. Hour 1: Password changed “for security.” Hour 2-4: Facebook flags the credential change on an unrecognized device. Hour 6-12: Security checkpoint appears — phone verification or ID upload requested. Hour 24: Account fully restricted pending review.
The restriction isn’t guaranteed to be permanent. But recovering from it requires passing a phone verification, sometimes an ID check, and waiting 24-72 hours for review. If the phone number on the account is inaccessible, recovery becomes much harder. It’s recoverable — but it’s entirely avoidable. Don’t break the rule.
If this has already happened before you read this: stop making additional changes, don’t log in from multiple devices to investigate, and contact Telegram (@priadsfb) to check whether the situation falls under warranty.
After Hour 72: The Right Order
Once 72 hours of consistent, normal account activity have passed, make security changes in this order — not all at once:
- Change the password first. Wait 24 hours after the password change before any other modifications.
- Update the recovery email — 24 hours after the password change.
- Update 2FA method — 24 hours after the recovery email change.
- Add payment method — only after all security settings are stable.
- Create your first ad — only after payment is confirmed and the account is stable for 48+ hours.
Making all changes simultaneously triggers the same flag as making them too early. Spread them out. The account has time. The full first-login protocol is at: Account Setup Recommendations
Does the Rule Apply to Business Managers?
Yes — with a BM-specific extension. For Business Managers, the 72-hour rule applies to the BM structure itself: no admin changes, no payment method additions, no ad account modifications in the first 72 hours after accepting the invite.
BM invite acceptance has its own timing rule on top of this: accept the invite on day 2 (24-47 hours after receiving it, not immediately). Then the 72-hour account stability window starts from the moment you first access the BM. Don’t create ad accounts or add clients until that window closes.
For the full BM invite process: How to Accept a BM Invite Without Verification Checkpoints
Your Next Step
If you’re waiting out your 72-hour window on a current account — good. If you need a clean account to apply this protocol correctly from the start:
- Fresh Facebook Account — from $10 — Clean account, no prior restriction history
- Old Real User Account — from $20 — Aged profile with established trust history
- BM1 Fresh — $30 — Clean Business Manager to build on
If you broke the rule and the account is now restricted, check if it qualifies under warranty: Refund & Account Warranty
Questions about the setup timeline? Telegram (@priadsfb) — same-day replies.
Frequently Asked Questions
How long should you wait before changing your Facebook password?
Wait at least 72 hours after first login. Changing it earlier triggers Facebook’s security system, which reads rapid credential changes on new devices as an unauthorized account takeover pattern.
Why does changing my password trigger a Facebook restriction?
Facebook reads rapid password changes on newly accessed accounts as a takeover pattern. The security system flags it and may lock the account pending phone or ID verification.
What should I do in the first 72 hours of a new Facebook account?
Log in consistently through your antidetect browser profile. Browse normally — view the news feed, like posts, scroll. Don’t change any security settings, add payment cards, or run ads. Let the device relationship establish first.
What if I already changed settings before 72 hours?
Stop making further changes. Wait 48 hours without touching the account. If a checkpoint appears, don’t log in from multiple devices. If the restriction doesn’t resolve within 24 hours, contact Priads support.
Does the 72-hour rule apply to Business Managers too?
Yes. For Business Managers, no security changes, no payment methods, no admin modifications in the first 72 hours. Accept the BM invite on day 2, then wait before making any structural changes.
About the author: The Priads team has helped 4,000+ media buyers, agencies, and e-commerce brands set up stable Facebook ad operations since 2020. We write from direct experience — not theory. For setup questions: Telegram → @priadsfb | Community → @priads
