Google Ads account hacked? How to check and secure it

To check if your Google Ads account was hacked, look in two places: the list of people and manager accounts that can use it, under Admin > Access and security, and Change history. If you find a user, invitation or change you didn’t make, report it to Google straight away, then turn on 2-Step Verification or passkeys so it’s harder next time. Already seeing changes you didn’t make? Go straight to what to do if your account was hacked.

5 things to check today

You need Admin access to change anything below. Standard and Read-only users can see users and managers, but can’t remove them.

1. Who has access, and at what level

1. Go to Admin > Access and security.
2. Read every name on the list and its Access level.
3. For anyone who has left or no longer works on your ads, select Remove access in the Actions column.
4. To lower someone’s level, hover over their access level and use the arrow to pick a new one.

Google’s advice is to give each person the lowest level they need, and never to share one login between people. Admins can add users, change access levels and unlink manager accounts, so Admin is the level to keep small.

Say the list shows four people: you (Admin), your office manager (Standard), a freelancer you stopped using last year (Admin, on a Gmail address) and your current agency (Admin). Remove the freelancer today. Then ask whether the agency needs Admin: Google’s own Security Agent suggests moving admins who never do admin tasks down to Standard. And if you’re the only admin, Google suggests adding a second one, so you don’t lose access to your tags if one admin becomes unavailable.

A pitfall Google’s help doesn’t spell out: if someone else set the account up for you, you may not be an Admin of your own account. Then you can see the list but can’t remove anyone. Ask to be made an Admin now, while you’re on good terms.

2. Invitations and security requests you didn’t send

On the same page, look under Pending invitations. An invitation you don’t recognise is someone waiting to get in. Admins can cancel it: select Revoke in the Actions column.

Accounts with more than 3 admins also get multi-party approval: adding or removing a user, or changing a role, needs a second admin to approve. Open the Security requests tab to see what’s waiting, and Deny anything you didn’t expect. Requests expire after 20 days, and Google Ads support can’t approve or deny them for you.

3. Linked manager accounts

Select the Managers tab. Every manager account listed can reach your account, and if a manager account has ownership, its admins can also change your users and managers.

• Under Link request, select Decline for any request you don’t expect.
• For a manager you no longer work with, select Remove access in the Actions column, check the preview, then select Unlink.

4. 2-Step Verification and passkeys

Google says 2-Step Verification can keep attackers out even if they have your password. To turn it on for the account, open the Security tab in Access and security, then under “Verification during sign-in” open 2-Step Verification and select Turn on.

Passkeys go a step further. Google may ask for one when you do something sensitive, such as adding a user or changing account links. A passkey can’t be shared, guessed or copied, and Google says that makes it more secure against phishing.

1. See who has one: on the Access and security list, read the Passkey status column. To see only the people without one, select the Filter icon, then Passkey Status, then Disabled.
2. Create yours: in your Google Account, open the Passkeys and security keys page and select Create a passkey. Use the Google Account you sign in to Google Ads with, and not a shared device.
3. Do it before you need it. Google says a new passkey takes about 1 to 2 days to pair with Google Ads, and up to 7 days to be fully active.

Some accounts also have Admin > Account > Security > “Require passkeys for sensitive actions”. Google says it can’t be turned off once it’s on, so turn it on only after every admin, agency included, has their own passkey.

If everyone who should use the account has an email at your company’s domain, you can also limit invitations to it: on the Security tab, open Allowed domains, select Add domain, then Save.

5. Change history and security insights

Open the Campaigns menu and select Change history. Set the last 30 days and read the User column. Look for the changes Google asks about when you report a takeover: new users, budget increases and automated rules, plus campaigns nobody on your side created. Our guide to seeing what your agency changed explains the filters. A sudden jump in cost is worth checking the same way; see why spend suddenly jumps.

Then go back to the Security tab in Access and security. If you see a Security insights section, it holds suggestions from Google’s Security Agent, such as risky users or email domains. Google suggests looking at it at least once a month.

What to do if your Google Ads account was hacked

1. Report it to Google as soon as you can, with the Report your compromised account form, and follow its recovery steps. Gather these first: the times of changes you didn’t make (such as new users), any manager account IDs you didn’t link, evidence of budget increases or new automated rules, and your current IP address.
2. Expect a pause. Google says it suspends the account for a while to secure it, and may disable the Google Account too, which locks you out of Gmail and YouTube. It pauses only campaigns the attacker created or changed, removes the attacker’s users and invitations, unlinks unknown manager accounts and re-invites people the attacker removed.
3. Talk to your other admins before anyone answers Google’s change log. Google emails it to people who were admins before the takeover date, but won’t say which ones. Only one admin can submit a decision, and it can’t be changed. Choosing “Restore this account as is” tells Google no hijacking happened, which rules out a refund. Edits you make while the decision is pending won’t be saved.
4. Clean your computers, then change your password. Google asks you to run a malware scan on every computer you use for Google Ads first, because malware can capture a new password.
5. Go through the five checks above. Pause or delete campaigns you didn’t create, and check your advertiser verification. If the account was suspended for policy, remove the attacker’s ads first, then appeal.
6. Ask for a refund once recovery is done and 2-Step Verification is on. Google says billing investigations take 10 to 15 business days, and credits show as a “Service Adjustment” on your next monthly invoice.

How takeovers happen

Google says most security problems come from passwords stolen through phishing. The tricks reported in 2025 and 2026 all try to get you to type your Google sign-in into a fake page:

• Search ads posing as Google Ads that lead to a look-alike sign-in page (BleepingComputer, January 2025).
• Emails dressed up as a Google Ads “sync” or maintenance notice, linking to a look-alike website with a fake sign-in form (Security Boulevard, July 2026).
• Fake client enquiries sent to agencies, which try to get account access or a manager link (PPC Land, April 2026). Google’s Ads Product Liaison replied that “phishing schemes are a common method to gain unauthorized access to accounts.”

Once inside, attackers add users, link manager accounts, raise budgets or add automated rules, and run their own ads. Owners have reported being locked out “for weeks or even months” (AdExchanger, December 2025).

A real email from Google has “@google.com” or “@ads.google.com” in both the From address and the Return-Path, and Google says it will never send an unsolicited message asking for your password. Before you click a link, right-click it, copy the link address and check that it goes to a page on google.com. Our own advice: open Google Ads from a bookmark or by typing ads.google.com, never from an ad or an email, because the fake pages above are reached exactly that way.

Let SpendCanary run the checks

SpendCanary’s account safety check looks for admins without a passkey, users added in the last 30 days, pending invitations, changes waiting for multi-party approval, linked manager accounts, and whether you have admin access to your own account at all. It needs Sign in with Google. Google blocks scripts from reading who has access (we tried it on our own account and the request was refused), so the copy-paste script scan skips this check. Sign in with Google, connect your Google Ads account and scan it free. We hide most of each email address as we read it (j***@example.com) and never keep the full address. For the rest of the account, the Google Ads audit checklist covers what to look at by hand.

On the Fix and Freelancer plans, a takeover alarm checks the account every hour and sends an email and a phone alert if someone else starts spending your money. It looks for a login that has never changed the account creating campaigns, ads or budgets, an ad pointing to an unfamiliar website, a new ad that doesn’t look like yours, or a new admin, user or manager link. You can then pause every campaign in one click and switch the same ones back on later. It works alongside Google’s passkeys, which guard who gets in, and its Security Agent, which suggests clean-ups. The alarm watches the campaigns and alerts you outside Google Ads. It spots changes but can’t stop them. If someone removes your access, ours usually goes too, and the alarm tells you.

Sources

• Google Ads Help: What to do if your account is compromised, Manage access, Access levels, Multi-party approval, Link requests from manager accounts, Unlink a manager account, Passkeys for sensitive actions, 2-Step Verification, Allowed email domains, Best practices, Security Agent, Suspicious emails or calls.
• News reports on how takeovers work: BleepingComputer (2025-01-15), AdExchanger (2025-12-03), PPC Land (2026-04-10), Security Boulevard (Cofense, 2026-07-21), linked above.
• The four-person access list is our own illustration. The script test was run on our own Google Ads account on 2026-11-06.