What should you do if your Google Ads account is hacked or shows charges you did not make?

Ascent Vision · Published October 25, 2026

Move quickly. Secure the Google Account that signs in to Google Ads: change the password, review recent security events and devices, and turn on 2-Step Verification. Then look in Google Ads for users, ads or budget changes you did not make, and check your bank or card statements. Google's account help says that if you notice unauthorized charges or ads in Google Ads, ask the Google Ads team to review your account for unusual activity.

Signs someone else is in the account

Ads, campaigns or budget changes you did not make; Google's best-practices page names changes to your ads or budget as the kind of unexpected activity to look for.
Users with access whom you do not recognize.
Charges on your card or bank statement for Google Ads that do not match what you expected.
Google Account warnings: Google's help lists notices of an unusual sign-in or a new device, and unfamiliar changes to your recovery phone or email, as signs someone else may be using the account.

The first hour

Sign in to the Google Account and follow Google's steps: review recent security events and the devices signed in, and follow the on-screen steps for anything you do not recognize.
Do what Google Ads Help lists for a suspected compromise: run a malware scan on every device you use for Google Ads, change your Google Account password and any other password that matches it, and turn on 2-Step Verification for both Google Ads and your Google Account.
As general advice, remove users you do not recognize and pause any campaign you did not create, so spending stops while you sort it out.
Check your bank or credit card statements, as Google suggests when someone may have reached your billing information. As general advice, also call the bank about any charge you did not make.

Report it to Google

Google Ads Help says that if you think your account is at risk, let Google know as soon as possible through its account security form. Google's page on hacked accounts points Google Ads users who see unauthorized charges or ads to a request for the Google Ads team to review the account for unusual activity.

Be wary of anyone who calls or emails offering to fix it. Google says it will only contact you from an "@google.com" email domain and will never send an unsolicited message asking for your password.

Make it harder next time

Google's best practices: review who has access regularly, remove people who have left, give each person their own login instead of a shared one, and grant only the access level each person needs. As general advice, keep the account in the business's name with at least two administrators from the business; the related answer on who should own your ad accounts covers access levels for an agency. If the same attacker may have reached your email, the related answer on a hacked business email account has the steps.

Sources

Lead generation and lead tracking

A lead that waits a day goes cold, and a lead with no source teaches you nothing. Ascent Vision fixes both.

See the service Work with us