Never share your own personal credentials.
Never give admin access to your own Facebook account. Instead, create a business manager account and then assign assets to the agency’s Business manage an account, but just for the assets that they are managing for you.
At no time do you need to provide admin access to your own business manager account, Just assign the assets and set the permission level for the agency’s Business Manager account?
The agency can then perform all the necessary tasks base on whatever assets and permission levels you have allowed.
The owner of the ad account controls the payment method.
If the agency is paying for the ad spend then they should create their own ad account. If you give them access to your ad account they will most likely be spending your money.
The last I checked you can open no more than 2 ad accounts per business manager account, but you can open additional business manager accounts as needed. Your agency might need to open a new business manager account if they are going to be paying the ad to spend the bill.
I’m sure there are agencies that do this, however, I don’t think that it is fair to say that a business is stealing something when they paid for it in advance. Generally speaking, the entity that pays for work is the one that owns it.
Furthermore, a client’s marketing data and insights are crucial to the ongoing success of their business. A wise owner will hold this data closely and never relinquish control.
This tactic seems to be more of a way of holding a client hostage by denying them the rightful owners for which they paid. If a client agrees to such terms then it is fair game, provided they have informed consent. I’m sure that it a mistake they will make only once.
On the other hand, I do see what motivates an agency to seek this type of arrangement. There are many FB advertisers that don’t want to sign a contract and will drop a campaign prematurely expecting the agency to eat all the upfront expenses. Agencies need a way to mitigate this risk.