Google Ads Account Hacked: What to Do Now, Step by Step

Last checked against Google's documentation. By Muhammed Abdul Kalam. Account at risk

Quick fix

Google Ads account hacked? Report it to Google straight away and follow the guided recovery steps. Google temporarily suspends the account, pauses only the campaigns the attacker created or changed, removes their access and emails you a change log to review. Change your Google account password.

  • Report the compromised account to Google Ads now.
  • Note when unauthorised changes started and which login you think was stolen.
  • If you still have access, check change history for changes you do not recognise.
  • If unexpected charges appear on your card, also call your bank or card issuer.

Can't fix it yourself? Send me the details

What this error means

Someone without permission got into the account, usually to run their own ads on your budget. When Google suspects this, it suspends the account temporarily, and may disable the linked Google account, while it secures things.

Google says a compromised account is temporarily suspended to stop ads from serving.

Why it happens

1A login was stolen

Someone used credentials they shouldn't have. Google asks you to summarise which logins you think are compromised.

How to tell if this is you: Change history shows users, campaigns or budget changes you did not make.

2An unauthorised manager account was linked

Attackers can link their own manager account or create sub-accounts. Google unlinks unauthorised managers and sets new sub-accounts to a zero spending limit.

How to tell if this is you: Your account hierarchy shows a manager account you do not know.

How to fix it

Report and recover

  1. Report the compromised account to Google Ads as soon as possible.
  2. Gather timestamps of unauthorised access, unknown manager account IDs, evidence of budget or rule changes, and your current IP address.
  3. Follow the guided recovery steps and answer the questions confirming it is your account.

Review the change log

  1. Watch for the change log email. Only admins from before the compromise date can approve it.
  2. Update your Google account password; it is required to submit the cleanup decision.
  3. Choose carefully: a cleanup decision can't be changed after you submit it.
  4. Then review all users with administrative access and remove anyone unauthorised.

How long it takes

Google says the timeline for lifting the temporary suspension depends on the compromised activity. Campaigns the attacker did not touch keep running.

How to stop it happening again

  • Review users with administrative access regularly.
  • Check change history if spend changes unexpectedly.
  • Report anything suspicious through Google's form straight away.

From my desk

Weak or reused passwords, an old shared login on someone's phone or email, and missing two step verification are the usual suspects. I review who has access and the recent changes, then follow Google's own steps for a compromised account.

Muhammed Abdul Kalam

When to get help

  • The attacker ran up spend on your card and you need to dispute charges with your bank while Google investigates.
  • You can't get back in and none of your admins can approve the change log.
  • Several client accounts under one manager account were affected.

Stuck on this? Send me the details.Tell me what the platform shows and what you've tried so far.

Send me the details

FAQs

What happens when Google finds my account was hacked?

It temporarily suspends the account, pauses only campaigns the attacker created or changed, removes their access, unlinks unauthorised manager accounts and emails you a change log.

Will my normal campaigns stop?

No. Google only pauses campaigns created or modified by the unauthorised user; untouched campaigns keep running.

Who can approve the change log?

Only users who were admins before the confirmed compromise date.

Can I undo my cleanup decision?

No. Once submitted, a cleanup decision can't be changed or reverted.

Should I contact my bank about charges?

Report the account to Google first so it can secure it. For card charges you don't recognise, also contact your bank or card issuer.

Sources