Google Ads Account Hacked: Your First 24 Hours

You log into Google Ads and find campaigns you never created, unfamiliar destinations, new users, or unexplained spend. Those are warning signs—not proof by themselves—but they justify immediate containment and investigation.

Key takeaways

• Pause campaigns you cannot verify and preserve evidence before deleting anything.
• Change the Google Account password immediately, review unfamiliar devices and sessions, and audit Ads users, managers, and integrations.
• Report the compromise through Google's official flow and document each disputed transaction.
• Recovery and reimbursement depend on Google's investigation; neither is guaranteed.

First, Confirm the Signals

Google identifies unfamiliar ads or destinations, spend increases, and changes to account owners, managers, or users as possible signs of compromise in its Google Account security guidance. Check:

• campaigns, ads, budgets, rules, and final URLs you did not authorize;
• unfamiliar users, pending invitations, or linked manager accounts;
• billing transactions or payment details you cannot reconcile;
• Google security alerts, devices, and recovery details you do not recognize.

Review Google Ads Change history and filter by user and date. Treat it as evidence, not a verdict: automated or system-originated changes may appear there, and an unusual timestamp alone does not establish session theft. Confirm questionable activity with teammates and agencies while you contain exposure.

Hour One: Contain the Incident

1. Preserve evidence. Capture timestamps, customer and campaign IDs, unauthorized user or manager IDs, budget changes, automated rules, ads, destinations, and transaction IDs. Google specifically asks for a timeline and evidence such as unauthorized user additions, manager IDs, and unusual budget or rule changes in its compromised-account instructions.
2. Pause campaigns you cannot verify. If the scope is unclear and spend is continuing, pausing all campaigns may be the safest temporary choice. Do not delete suspected rogue campaigns before recording them.
3. Secure the Google Account immediately. From a trusted device, change the password and review security events. Then review and sign out unfamiliar devices or sessions promptly. Google advises an immediate password change when another person may be signed in and provides separate steps to review and remove unfamiliar devices.
4. Protect the payment method. Notify the card issuer promptly about possible fraud and ask how to preserve dispute deadlines. In Google Ads, review Billing activity and note the date, amount, and transaction ID for each questionable charge.

Do not assume that removing a card is always possible or that it replaces account security. Billing controls, available actions, and consequences differ by payment setup.

Hours Two to Six: Remove Access Paths

Turn on 2-Step Verification, verify recovery email addresses and phone numbers, and remove anything unfamiliar.

Inside Google Ads, open Admin → Access and security and review:

• Users: remove unauthorized users and cancel unfamiliar pending invitations.
• Managers: unlink manager accounts you did not approve.
• Security: where available, require 2-Step Verification and review invitation-domain settings.

Also review your Google Account's third-party connections and remove access you do not recognize. For API integrations, a developer token is not sufficient by itself to provide persistent account access. The Google Ads API requires a developer token and OAuth credentials associated with a user or service account that has account access, as Google's OAuth documentation explains. Review OAuth grants, service accounts, linked managers, and the permissions behind each integration.

If you suspect malware, isolate the affected device and use a trusted device for containment. Scan and remediate the affected device before signing back in.

Hours Six to Twelve: Report the Compromise

Use Google's official compromised Google Ads account form as soon as possible. AdFence's Google Ads recovery guide provides a separate emergency checklist you can keep open while completing the platform process. Include:

• the timeline of unauthorized activity;
• customer, campaign, and manager account IDs;
• screenshots or exports from Change history;
• unauthorized users, rules, ads, budgets, and destinations;
• disputed transaction dates, amounts, and transaction IDs;
• the security steps already completed.

Complete evidence can reduce follow-up questions, but no evidence package guarantees a response time or outcome. Google support does not charge a recovery fee. That does not mean every paid consultant is fraudulent; independently verify any third party and never provide passwords, recovery codes, or unnecessary account control.

Hours Twelve to Twenty-Four: Handle Billing and Suspension

Google says suspected unauthorized activity may trigger a temporary suspension while it secures the account, and that suspension timing depends on the activity involved. It also says reimbursement is available only if its investigation confirms that a compromise caused unauthorized ad spend; see Google's compromised-account process.

For charges attached to an Ads account you recognize, review account activity and contact Google Ads support. For a bank-statement charge tied to an account you do not recognize, Google says a chargeback is often an appropriate first step and advises canceling or replacing the compromised card. Its charge-dispute guide explains both paths.

Coordinate with Google and your issuer rather than applying a universal “never charge back” rule. Google lists chargebacks, suspicious payment activity, and unpaid balances among possible suspension reasons in its suspensions overview, so reversing a charge that belongs to your known Ads account can affect account status.

If the account is suspended, use the compromised-account flow and the instructions in the suspension notice. Do not route a compromised-account appeal through Policy Manager unless the notice specifically directs you there.

After Access Is Restored

Before resuming campaigns:

1. verify every user, manager, OAuth grant, service account, rule, payment setting, ad, and destination;
2. remove unauthorized assets only after preserving evidence;
3. confirm conversion tracking and landing pages have not changed;
4. resume verified campaigns gradually and watch billing and delivery.

For the next month, consider a daily review of Change history, access, billing, and destinations. That is an editorial risk-control recommendation, not a Google requirement. Which signals can be monitored automatically depends on the connected integration and its permissions. See our guide to ad spend alerts for Meta, Google, and TikTok for alert-design options.

FAQ

Will Google refund unauthorized Google Ads charges?

Possibly. Google states that it will reimburse unauthorized ad spend when its investigation confirms the spend resulted from an account compromise. Approval and timing are case-specific; reimbursement is not automatic.

Why was the account suspended?

Google may temporarily suspend an account when it detects unauthorized access so it can stop ads and secure the account. Other billing or policy issues can also cause suspension, so follow the specific notice and official suspension guidance.

How do attackers get access?

Possible paths include phishing, reused credentials, malicious software or extensions, stolen sessions, unauthorized users or managers, and OAuth or service-account access. The evidence in your account—not the time of day—is what should drive the conclusion. Our guide to how ad accounts get hacked explains these paths in more detail.

Platform recovery, billing review, and reimbursement remain with Google and the payment provider. Detection, prevention, recovery, and refunds are not guaranteed.