Google Ads account hacked: what to do
Google AdsIf campaigns you didn't create appear in your Google Ads account, report it straight away through Google's form for compromised accounts, then recover and secure your Google account: change the password and turn on 2-step verification. Google reimburses unauthorized charges only after the account is recovered with 2-step verification on, and billing investigations can take 10 to 15 business days. Then check users, manager account links, payment profiles and campaigns.
By the stopfakeclicks team. Google's steps checked on Oct 15, 2026.
It happened to us
Around midnight, two campaigns we had never made appeared in our Google Ads account, with daily budgets of £15,000 and £5,000.
Google's security alert arrived the next evening.
We reported it through Google's form. The account was suspended, and there was no one at Google to talk to.
The hours between the first strange campaign and anyone noticing are where the money goes. That's why we built Account guard.
Signs your account has been hijacked
- Campaigns you didn't create, often with very high daily budgets.
- A budget that jumps overnight, or automated rules you didn't set up.
- Ads that lead to a website that isn't yours.
- Users or manager accounts you don't recognise.
- Payment profiles or billing details that changed.
What to do, in Google's order
- 1Report it with Google's form, “Report your compromised account to Google Ads”. Have ready the times in the change history that show changes you didn't make, any unknown manager account IDs, and any budget increases or rules that aren't yours.
- 2Recover and secure your Google account with the guided recovery steps. Google may suspend the Google Ads account to stop ads from serving, and the Google account itself may be disabled for a while, Gmail included.
- 3Change your password and turn on 2-step verification for every admin. Google requires 2-step verification before it reimburses unauthorized charges.
- 4Review the change log. Only one eligible admin can submit the cleanup decision, and it can't be undone. Choosing to restore the account as it is makes the event ineligible for reimbursement.
- 5Check the whole account: users, manager account links, payment profiles, campaigns and advertiser verification. Remove admin access nobody needs.
- 6Scan every computer used to sign in for malware, then change your Google password. Google puts this first in its advice on staying safe.
Getting the money back
Google reimburses charges caused by unauthorized activity once the account is recovered and 2-step verification is on. Billing investigations can take 10 to 15 business days. If you restore the account as it is instead of letting Google clean it up, you lose the right to a refund.
Catch the next one within an hour
stopfakeclicks Account guard checks your Google Ads account every hour through a script in your own account. A campaign you didn't make, a budget that jumps or ads that lead to someone else's site are paused until you confirm it was you, and you get an email. If the script stops running, often an intruder's first move, we email you too.
What it can't do: it doesn't stop anyone signing in, and if an intruder removes the person who authorised the script, the hourly checks stop. That's why we tell you when it goes quiet.
Account guard is part of the one $9.99 plan, together with click fraud protection.