Google Ads Account Hacked and Suspended: Recovery and Change-Log Checks

If you suspect unauthorised access, report the compromised account to Google Ads immediately. Use Google's official recovery instructions and secure the associated Google account. Do not delay the report while preparing a commercial audit.

Keep three investigations distinct: access to the advertising account, security of the website, and any separate policy notice. Evidence of one does not establish the state of the others.

Start a reliable incident record

Our proposed incident worksheet helps the owner and agency coordinate. Use the account's displayed time zone. If someone supplies a local timestamp, label that time zone too.

Record	Question it answers
Customer IDs and manager hierarchy	Which accounts and manager levels may be affected?
Last confirmed authorised activity	What known event provides a useful starting point?
Unrecognised users or links	Which access changes need investigation?
Budget, campaign, and rule changes	What operational changes does the team dispute?
Security reports and replies	What has already reached Google's investigation team?

Preserve available change history and relevant emails. Do not describe every unfamiliar edit as malicious before checking agency activity. An employee, authorised automation, and an intruder can produce different changes within the same period.

Coordinate security actions through a known, trusted contact method. Check Google's account security guidance for access protection. Never send passwords, recovery codes, or payment credentials to someone claiming they need them to investigate.

Identify who can approve the cleanup

Google's recovery process limits cleanup approval to eligible administrators who held access before the compromise. The relevant manager or sub-account level depends on where the compromise occurred. A submitted cleanup decision cannot be reversed.

Before anyone responds, identify the administrator who received the request. Have the campaign owner and technical owner review disputed rows with that person. This coordination is our recommendation; it does not change Google's approval rules.

Use the investigation option when the listed changes mix legitimate and uncertain activity. Follow the specific workflow Google supplies. Structural account changes can require consent before release. Do not assume every compromised account follows the same sequence.

Read the change log row by row

Google's change-log definitions distinguish an immediate security action from the later cleanup result. A paused campaign therefore does not, by itself, prove that every related issue is resolved.

Add your own review columns to a working copy: business owner, authorised or disputed, supporting record, and next action. Keep Google's original file intact. Compare each disputed budget or destination with an approved brief or earlier account export.

The official log can identify advertiser review or a failed cleanup action. Inspect the action named on that row and follow its instructions. If the required edit remains unavailable, document the obstacle for the existing recovery case.

Fictional worked example: an agency manager link

This invented example concerns an agency managing a furniture retailer. At 08:40, the campaign owner notices a daily budget that differs from the approved brief. The account also shows an unfamiliar manager link.

Chronology	Check	Evidence and next action
Previous afternoon	The team confirms the last approved budget.	Retain the signed brief and account export.
Morning discovery	The owner compares manager IDs with the agency's access register.	Save the unfamiliar link and report the suspected compromise.
Change-log review	An eligible administrator checks the disputed budget and a legitimate scheduled edit.	Mark the evidence for each row and request further investigation where needed.
Follow-up check	The team compares current access with the approved hierarchy.	Record unresolved differences in the recovery case.

The example does not assume the agency's whole manager account was compromised. That scope needs investigation. The evidence folder contains account IDs, timestamps, approved changes, and the report reference. The next action follows Google's case instructions.

Check the account before normal management resumes

Our handover checklist compares the recovered account with the last approved business setup. Check access, manager links, billing relationships, campaign destinations, automated rules, and budgets. Record verification requests and any remaining policy notice separately.

A clean website scan does not settle an account-access incident. Equally, restored login access does not prove that website content is safe. Assign each investigation to someone who can inspect the relevant system.

For wider agency checks, read linked-account risk in an MCC. If a separate policy appeal remains necessary, use our appeal evidence guide. After the urgent Google report, our agency compliance support can help organise policy evidence and account records.