Google Ads account hacked: how to stop the charges and get it back

If your Google Ads account has been hacked, the money is moving while you read this. Someone is spending your budget on their ads, on your card. The steps below stop the spending first, then get the account back, then put you in line for a refund.

Signs your Google Ads account was taken over

• Campaigns you didn't create, often for products or countries you've never advertised in.
• Budgets or bids that jumped overnight.
• New users or a linked manager account you don't recognize.
• Charges on your card that don't match what you normally spend.
• You can't sign in, or Google has suspended the account. Google may suspend a compromised Ads account to stop the ads running, and may also disable the Google account behind it for a while, which takes Gmail and YouTube with it.

The first ten minutes: stop the spending

1. Call your card issuer. Tell them about the charges and ask what they can do to block or dispute further ones. Google has its own reimbursement process, covered below, but your bank decides what happens to the card.

2. If you can still sign in, pause what isn't yours. Pause any campaign you didn't create, and turn budgets back down. Don't delete anything; you'll want it as evidence.

3. Secure the Google account you sign in with. Change its password to one you've never used anywhere else, sign out every other session, and turn on 2-Step Verification. If this same Google account runs your Gmail or Google Workspace, treat that as hacked too and follow what to do in the first hour after a work email is hacked.

4. Remove anyone you don't know. In Google Ads, open Admin, then Access and security. Remove unknown users and any manager account you didn't approve, and cancel pending invitations.

Report it to Google, with the evidence ready

Google asks you to report a compromised account as soon as possible. Before you do, gather what it asks for:

• Times from the change history showing the unauthorized access, such as users being added
• The IDs of any manager accounts linked without your permission
• Evidence of budget increases or automated rules that don't match how you normally run the account
• Your current IP address, for verification

If you can't sign in at all, start with Google's account recovery and answer the questions to prove the account is yours.

What Google does next

Once Google confirms unauthorized activity, it secures the account. According to Google:

• The account is suspended while it's secured.
• Only the campaigns the intruder created or changed are paused. Your other campaigns keep running, and nothing is deleted.
• Compromised users are removed, along with any unauthorized user or manager account invitations.
• Unauthorized manager accounts are unlinked, and any new sub-accounts get a spending limit of zero.

You then get an email with a log of every change made during the attack, and you choose how to clean it up. Read this part carefully: choosing "Restore this account as is" tells Google no hijacking happened, which makes the event ineligible for reimbursement. If all the changes were the attacker's, choose to clean up the account. If some were yours, ask for more investigation. The choice can't be undone.

Getting your money back

Google says that if its investigation confirms the account was compromised and you were billed for unauthorized charges, you may be eligible for reimbursement. To qualify, you have to finish the account recovery, and 2-Step Verification must be on before you can submit the request.

How ad accounts get taken over

• A fake sign-in page. An email or ad that looks like a Google Ads warning, leading to a page that looks like Google's sign-in. See what to do if you clicked a phishing link.
• A reused password from a site that leaked it. See your passwords on the dark web.
• Old access nobody removed: a former employee, a freelancer or an agency that still has Admin.
• Malware on the computer used to manage the account, which can steal a signed-in session.

What stops the next one

• 2-Step Verification, or better, a passkey, on every account with access. Google now supports passkeys for sensitive Google Ads actions. See multi-factor authentication explained.
• Multi-party approval, a Google Ads feature that makes a second administrator confirm sensitive changes.
• A short access list. Give agencies Standard access rather than Admin, and remove people the day they stop working with you.
• A password manager, so each account has its own password. See password managers for small businesses.
• Spending alerts from your bank, so a jump in charges reaches you the same day.

What it costs, against what's at stake

	What it comes to
Our Business plan for five people	$870 a month. Includes dark web monitoring, Microsoft 365 and Google account monitoring, and a 24/7 security team on every computer.
A hijacked ad account	Whatever is spent before you notice, plus days without your own ads while it's secured
The same password on your email	Everything in the mailbox, and every account that resets through it

We don't run your ad campaigns. We look after the accounts and computers behind them, so one stolen password can't open everything.

If this is happening right now

1. Call your card issuer.
2. Secure the Google account and turn on 2-Step Verification.
3. Report the compromised account to Google.

Then check the other accounts customers see: if your Google Business Profile was taken over, and if your business Facebook or Instagram was hacked. If you'd like help finding where else the same password was used, book a free Security Check.