Account access

My Google Ads account was hacked. How do I get it back and stop the charges?

By The Tofu team ·

Report it on Google's compromised account form right away, and pause any campaign you didn't create if you can still sign in. Once Google confirms the hack, it suspends the account, pauses the intruder's campaigns, removes unknown users and unlinks unknown manager accounts. An admin reviews a change log and picks a cleanup. Once the account is back and 2-Step Verification is on, you can ask Google to reimburse the unauthorized charges; credits show up as a "Service Adjustment" on your invoice. Secure the Google Account behind the login too, on a malware-free device.

Ask Tofu next

Pick a question and Tofu Ads Agent answers it in chat.

As of October 2026.

How do I stop the charges right now?

Save the evidence, stop the spend, remove the intruder, then report. If you can still sign in:

  1. Save the evidence. Screenshot or export change history with timestamps, the unknown user emails, any unknown manager account IDs and any budget or automated rule changes. Google asks for these in the report.
  2. Pause or delete campaigns you didn't create. Google pauses them too once it secures the account, but your own edit stops spend sooner.
  3. Remove unknown users. Go to Access and security in the Admin menu, find the user, and select Remove access in the "Actions" column.
  4. Remove unknown managers. On the Managers sub-page of Access and security, select Remove access next to the manager account, review the preview, then select Unlink.
  5. Report it (next question).

If you can't sign in, report anyway. Google says it suspends a compromised account "to stop your ads from serving." You may get a passkey prompt or need a second admin's approval to remove users; see why Google Ads asks for a passkey.

How do I report a hacked Google Ads account?

Use the compromised account form linked from Google's "What to do if your account is compromised" page, as soon as possible. Google asks you to summarize the timeline of unauthorized changes and say which logins you think were compromised. Before you start, gather:

  • Timestamps from change history that show the break-in, such as users you didn't add
  • The IDs of manager accounts you didn't authorize
  • Budget increases or automated rules that don't match how you normally manage the account
  • Your current IP address, for verification

If the Google Account itself was taken over, start at Google's account recovery page. Google's tips: use a device, browser and location you normally sign in from, and answer every question, guessing if you must. Google may also disable the Google Account to limit the damage, so Gmail and YouTube on that login can stop working too. Have your 10-digit customer ID ready; Google says support often asks you to complete 2-Step Verification to confirm who you are.

Why can't I see the hacker under Access and security?

Because people with Standard or Admin access in a linked manager account can edit your account through that manager, without being on your own Users list. Change history shows the email behind each change made in Google Ads. If that email isn't on your Users list, check the Managers sub-page for manager accounts you don't recognize. Google sends link requests to admins of your account and to people with access to a manager account that owns it, so check those logins first. Agencies can check the Related managers tab in a manager account, which shows client accounts also linked to managers outside your hierarchy. It doesn't show who has access to those other managers.

What happens after I report it?

If Google confirms unauthorized activity, it secures the account straight away:

  • It suspends the account while it secures it. Google says the timeline for lifting the suspension "will differ depending on the compromised activity."
  • It pauses only the campaigns the intruder created or changed, and deletes none.
  • It removes compromised users, deletes unauthorized user and manager account invitations, unlinks unauthorized manager accounts, and sets spending limits to zero on new sub-accounts created without permission.
  • It automatically re-invites team members the intruder removed.

Then admins who held the Admin role before the break-in (except the compromised login) get an emailed change log. One admin submits a decision, and it can't be changed:

ChoiceWhat happens
Clean up this accountGoogle removes and reverts every flagged change
Restore this account as isChanges stay. You're confirming no hijacking happened, so this event can't be reimbursed
Additional investigation is neededSupport reviews the changes you're unsure about

You must re-authenticate with 2-Step Verification (or another multi-factor method) and update your Google Account password before you can submit. If the intruder only touched campaigns or users, Google unsuspends the account once it's secured. If they changed the account structure, it stays suspended until an admin consents to the cleanup. Edits you make while your decision is pending won't be saved. If the change log marks a step "Failed" (for example, a user re-invite), do that step yourself.

Will Google refund the fraudulent spend?

It can. Google says that if its investigation finds the account was compromised and you were billed for unauthorized charges, "you may be eligible for reimbursement." You have to finish recovery first: once the account is reactivated and 2-Step Verification is on, submit a reimbursement request through Contact us in Google Ads Help. You must have chosen "Clean up this account" or "Additional investigation is needed" in the change log. Google says billing investigations can take 10 to 15 business days, and credits appear as a "Service Adjustment" on your next monthly invoice.

Should I dispute the charge with my bank instead?

Try Google's process first, and know the risk. Google's billing policy says that if you ask your bank to reverse a charge "paid against a legitimate Google Ads balance," your account may be suspended. Google doesn't say how it treats a dispute over hijacked spend. If your bank has a dispute deadline, ask Google in writing how a dispute would affect your case before that date passes.

My account was suspended for cloaking after the hack. What now?

Fix the security problem first, then appeal once. Google calls policy suspensions "a known side effect" of hijacking, because intruders create ads, keywords or site content that break policies such as Circumventing Systems or Unacceptable Business Practices. Remove every ad, campaign and landing page the intruder made, finish the user, manager and campaign checks above, then appeal the specific policy, explaining that unauthorized access caused it and what you did to secure the account. Don't send repeat appeals: Google may not process too many for the same suspension. Also check advertiser verification, which hijackers' edits can undo, and look for certifications (such as Healthcare and medicines) you weren't asked for before. You can dismiss those recommendations on the Advertiser verification page; Google says they go away within 30 days if you don't act on them.

How did they get in if we had 2-Step Verification?

Google's pages point to two routes: passwords stolen through phishing, which its Security Agent page calls the cause of most security issues, and cookie theft, which Google says its identity checks for sensitive actions help protect against. So scan every computer used for Google Ads for malware before you change passwords. Google warns that changing a password while malware is still present risks the malware capturing the new one. Google also says it only contacts you from "@google.com" addresses and never sends an unsolicited message asking for your password.

How do I stop it happening again?

Layer Google's account controls:

ControlWhat it doesWhere
2-Step VerificationRequires a second step at sign-inAdmin > Access and security > Security tab > "Verification during sign-in" > 2-Step Verification drop-down > Turn on
Manager account security mandatesMakes every account a manager owns require 2-Step Verification or Advanced ProtectionIn the manager account: Security tab > Authentication
PasskeysPhishing-resistant check that Google can require for account linking and user access changesYour Google Account; our passkey guide
Multi-party approvalA second admin must approve adding or removing users or changing roles; Google Ads support can't approve for youNo on/off setting is documented. Google's multi-party approval page says it applies to accounts with "more than 3 administrators" (so 4 or more), but its email domain page says "3 or more active administrators"
Allowed domainsOnly email addresses on your domains can be invitedSecurity tab > Allowed domains
Security AgentFlags unusual users, logins and email domains, and suggests downgrading Admins who don't need itSecurity tab > "Security insights"
Expiring accessRemoves temporary users on a date you setWhen you invite a user

Also remove users who have left, give each person the lowest access level they need, and never share one login.

What if it's my Microsoft Advertising account?

Contact Microsoft Advertising Support. Its blocked-access page says that when Microsoft detects unusual activity it suspends the account and blocks sign-in "as a security precaution," and tells you to contact Support to resolve it. The steps on this page are Google's process only.

Sources

Related answers

More on

Let an agent build your next campaign.

Tofu Ads Agent reads your CRM, plans the funnel, builds the audience and creative, and stages full campaigns across LinkedIn, Google and Meta for your approval.

Try it free Get a demo