How to Protect Your Google Ads Account - And What To Do If You Get Hacked

By: Jyll Saskin Gales, Google Ads Coach

Imagine waking up at 3:00 a.m. to one of the worst phone calls a digital marketer can receive: Your Google Ads Manager Account (MCC) has been hacked.

For Adina Z at Napkin Marketing, this wasn't a "what-if" scenario. Despite having two-factor authentication (2FA) and allowed domains enabled, hackers managed to infiltrate her agency’s account—an account that had been a Google Partner for over a decade. Similarly, Alex Melen of SmartSites shared that it took only three minutes for hackers to remove all his employees and clients from thousands of accounts.

If you think your account is hack-proof because of a password or 2FA, it’s time to think again.

How Sophisticated Hackers Are Seizing Google Ads Accounts Today

Hacking isn't just about weak passwords or fake domains anymore. We are seeing a new wave of sophisticated "shell" attacks.

The Audit Phishing Scam

Marc Walker, Founder at Low Digital, highlighted a common entry point: a genuine-looking email requesting an account audit. The hacker sends an access invitation with perfect Google branding. When you click "Accept," you are redirected to a page that looks exactly like a Google login.

As you type your password, the hackers mirror it on the real Google site. When Google sends a 2FA prompt to your phone, the fake site asks you for it. You tap the number on your real phone, thinking it’s for your login, but you’ve actually just handed the keys to the hacker.

NEW: The Multi-Party Approval Security Feature

Since recording my latest Inside Google Ads podcast episode about this topic, Google released a very welcome major security update that every agency needs to know about: Multi-party approval (MPA).

This feature acts as a "two-key" system for high-risk changes. When MPA is enabled, sensitive actions—like adding new users, removing existing users, or changing user roles—require a second administrator to verify the change before it goes live.

How it works:

• When a high-risk change is initiated, all eligible admins receive an in-product notification.

• The second admin has 20 days to approve or deny the request.

• If no action is taken within 20 days, the request expires and the change is blocked.

This is a massive step forward in preventing a single compromised admin account from taking down an entire MCC. Still, there are some small but important steps you can take to ensure it never needs to go this far.

How to Keep Your Account Safe from Hackers - Do This Now!

While new features help, your manual habits are your first line of defense.

1. ALWAYS log in to Google Ads using this method, and nothing else: Never search for "Google Ads login" or click links in emails. Instead, log into your Gmail, Google Workspace email or Google Calendar first. Click the "nine dots" (Google Apps icon) in the top right, and select Google Ads from there.

2. ALWAYS grant access from within the Google Ads interface: If someone requests access to your account, don't click the email link. Log in via the Safe Method mentioned in step 1, then go to Admin > Access and Security, and manage requests directly within the platform.

3. Audit Your Admin Access: Reva Minkoff, Founder at Digital4Startups Inc., suggests that clients should always have admin access to their own accounts. This provides a "back door" to kick out a compromised manager account if needed. You should check in on your Access and Security on a quarterly basis if you're a business owner, and on a monthly basis if you manage Google Ads on behalf of clients.

    

What to do if your Google Ads Account gets Hacked

If you find yourself compromised, persistence is your only tool.

• Be Loud: Josh Day, Head of PPC, notes that persistence is 100% necessary. Contact support daily through multiple threads.

• Billing Protection: If you pay by credit card, cancel it immediately. However, as Craig Skalko of Lost & Found Marketing notes, if you use monthly invoicing, you cannot simply "stop" the charges. You will have to document everything and fight for a refund later.

• Communicate Immediately: Tell your clients the second you suspect a breach. It is terrifying, but it allows them to remove your access and protect their own accounts before the damage spreads.

• ...but please do not contact me! I already receive a lot of messages from business owners and agencies who want my help recovering a hacked account. While I sympathize with the struggle you're in right now, there is nothing I can do to help you personally! Everything I know is included in this article, and I will keep this article updated as I learn new information that can help you.

If you do get hacked, do not blame yourself. These hackers are professionals, too.

Stay vigilant, use the new Multi-party approval features, and always use the "Safe Login" method. I'll keep this post updated as new information and security features become available.

Stay safe out there.