As a business owner or marketing professional, you’ve probably heard about Google Ads security breaches but never thought it could happen to your business.
In fact, Google’s latest Ads Safety Report highlights the scale of the threat facing advertisers. In 2025, Google suspended 4 million accounts and blocked or removed 602 million ads associated with scams. While these figures don’t represent hacked advertiser accounts specifically, they demonstrate the scale and sophistication of malicious activity across Google’s advertising platforms.
A hijacked Google Ads account can very quickly escalate into thousands of pounds worth of unauthorised spending and that’s when the account owner is monitoring it on a daily basis. Those that are less closely monitored are much more vulnerable to account compromises.
If you’ve already been one of the unlucky ones and have direct experience of a security breach, you’ll know that recovering unauthorised spend can take time, and reimbursement isn’t automatic. Google says advertisers may be eligible for reimbursement where it determines that an account was compromised and unauthorised charges resulted.
Your best option is therefore to do everything possible to prevent a compromised account in the first place.
Below you’ll find a short action plan to make sure your account is protected.
Most of these take less than five minutes to action but could save you and your business a lot of time, future headaches and more importantly, prevent future losses.
How to Keep Your Account Secure:
1. Keep passwords secure – The obvious one, but well worth mentioning. Enable 2-Step Verification and use a strong, unique password for your Google Account. A password manager can also help you create and securely store unique passwords.
2. Review permissions regularly – Let’s face it office life is busy. You’ll be forgiven for forgetting to remove a past employee from every single system you have in place but your Google Ads account is one you can’t afford to forget. A regular permission review is all you need to make sure this doesn’t happen.
3. Limit admin roles – Give users the lowest access level they need (read only/standard as opposed to admin).
4. Use Google’s “Confirm it’s you” security checks – Google Ads may ask you to verify your identity before certain sensitive actions, such as unusual budget changes or adding users. These additional checks work alongside 2-Step Verification and provide another layer of protection.
5. Secure the devices you use – A compromised computer or browser session can put more than your Google Ads account at risk. Keep operating systems, browsers and security software up to date, and avoid signing into Google Ads on shared or unsecured devices.
6. Avoid phishing attempts – Email scams have become a lot more sophisticated in recent years and sometimes are very difficult to decipher from genuine email content. Encourage your team to pay close attention to the sender details, the time the email was sent and any language that requires you to act immediately. (These are the telltale signs of a phishing attempt.)
7. Review change history regularly – This will enable you to see immediately if there is any unusual activity on the account.
8. Set up automated alerts – Consider using Google Ads scripts or other monitoring tools to flag unusual spend, unexpected budget changes, new campaigns or other account activity. The exact alerts you need will depend on the account, but automated monitoring can provide an additional layer of protection between routine account checks.
What To Do If You Think Your Google Ads Account Has Been Hacked:
If you suspect that your Google Ads account may have been hijacked, follow the steps below.
1. Pause suspicious campaigns/spend if you can do so safely
2. Secure the underlying Google Account
3. Change or reset compromised credentials
4. Enable 2-Step Verification
5. Report the compromise to Google
6. Review users and permissions
7. Check linked manager accounts
8. Review change history
9. Review budget and payment changes
10. Save timestamps/screenshots/evidence
11. Follow Google’s account recovery/security process
12. Check whether you are eligible for reimbursement
You can also find more information from Google on suspected account compromises here
Account security shouldn’t be something you only think about after a breach.
At Green Ginger Digital, account security forms part of our ongoing PPC management process, from user access and permissions through to monitoring and change detection.
If you want to learn more about our PPC services click here.
