Google Ads Account Security: Access, Mandates and Hijacks

A hijacked Google Ads account gives an attacker your payment method, your advertiser reputation and a trusted channel to put malicious ads in front of a large audience. Criminals take over advertiser accounts by phishing administrators, stealing session cookies from infected devices or abusing agency manager account links, then raise budgets, add their own users and run malvertising until the account is suspended. Google Ads now offers strong controls to stop this: passkeys, 2-Step Verification mandates, allowed email domains, multi-party approval for user changes and a two year change history. This guide covers how access works, how to contain Admin and manager account power, API credentials, what to monitor, a hardening baseline and the recovery process when an account is compromised. It is for security teams, marketing operations and agency leads. How attackers use stolen ad accounts to distribute malware is covered in the Malvertising and SEO Poisoning Guide. Facts were checked against Google's documentation on 8 November 2026.

This is an independent guide from NHI Mgmt Group, based on Google's public documentation as of November 2026. It is not sponsored or reviewed by Google. Product features change, so confirm settings against Google's current documentation.

Key takeaways

Admin is the takeover role. Only Admin can grant access, change access levels, accept or unlink manager accounts and change product links, so an attacker with Admin can lock you out.
Manager accounts are the biggest blast radius. A compromised agency manager account reaches every client account it owns or links to, so manager account security mandates matter more than any single account setting.
Enforce, do not encourage. 2-Step Verification is only encouraged per user; manager account mandates and allowed email domains are how you make it mandatory and keep outsiders from being invited.
Multi-party approval changes the attack. Where an account has more than three administrators, adding or removing users and changing roles needs a second Admin, which stops a single stolen session from adding attacker users.
Recovery is a one shot decision. After a compromise, one administrator chooses whether to clean up or restore the account, the choice cannot be reversed, and choosing to restore as is forfeits reimbursement.

How identity and access work in Google Ads

Google Ads users sign in with Google Accounts. Single sign-on and the strength of authentication therefore come from the Google identity: a managed Google Workspace or Cloud Identity account follows your organisation's SSO and 2-Step Verification policy, while a Gmail account follows its owner's choices. Google Ads adds its own layers on top: a per account 2-Step Verification setting, "Confirm it's you" challenges before sensitive actions (up to once every 24 hours), allowed email domains for invitations, and manager account security mandates. Passkeys are supported for sign-in and for completing sensitive actions.

Each user holds one access level per account.

Access level	Key capabilities (from Google's access level article)	Security view
Email-only	Receive notification emails and reports	Low risk, but reveals performance data
Read-only	View campaigns, billing, users, managers and product links; run reports; grant email-only access	Exposes commercial data and the account's structure
Standard	Read-only plus edit campaigns and billing information; make payments on postpay accounts; create conversions from Google Analytics events	Can spend money and change ads: enough for malvertising
Billing	View and edit billing information and payment methods; make payments; edit payments profile	Financial fraud risk; keep to finance staff
Admin	Everything in Standard and Billing, plus grant and change access, accept or unlink manager accounts, add or remove product links, review each user's authentication method and last login time, complete Advertiser Verification	Privileged: full takeover role

Note that Standard access alone lets an attacker create and edit campaigns. Malvertising does not need Admin; it needs any account that can publish ads with your payment method behind it. Treat Standard as a sensitive role too.

Admin roles and privileged access

Containing Admin

Named administrators: keep Admin to a small group of staff on managed accounts. Note that multi-party approval only applies once an account has more than three administrators, so decide deliberately whether you want four or more Admins with approval, or three or fewer without it, and compensate with monitoring in the second case.
Use the authentication column: Admin can review each user's authentication method and last login time. Use it in every access review to find users without 2-Step Verification and users who have not signed in for 90 days.
Allowed email domains: restrict invitations to your organisation's domains and your contracted agency's domain, so a stolen Admin session cannot invite an attacker's Gmail account.
Passkeys for administrators: passkeys resist phishing, and they are already required to generate Google Ads API refresh tokens. See the Phishing-Resistant MFA Guide.
Billing separation: give finance staff Billing rather than Admin, and keep campaign staff on Standard.

Multi-party approval

Multi-party approval requires a second administrator to approve adding a user, removing a user or changing a user's role. Any Admin on the account, or a linked manager account, can approve. Requests expire and are rejected after 20 days, one reminder is sent after 3 days, only the initiator can revoke a request before it is acted on, and Google support cannot approve or bypass a request. Read-only roles and API users are exempt. Check pending requests under Admin, Access and security, because an unexpected request is itself a signal of compromise.

Manager accounts and agencies

Manager accounts let agencies and large advertisers administer many accounts from one sign-in, which makes them the highest value target. Manager account security mandates let the manager's administrators enforce minimum settings on every current and future sub-account it owns:

Authentication mandate: require 2-Step Verification or Advanced Protection for users of owned sub-accounts, with an effective date that defaults to 7 days ahead (today's date applies it at once).
Allowed domains mandate: limit which email domains can be invited to the manager account and its owned sub-accounts.
Scope: apply to "This manager account" only or to "This manager account and all accounts it owns". Sub-accounts can be stricter but not weaker.

If you are an advertiser working with an agency, ask in the contract for both mandates to be on at the agency's manager account, for named agency users on managed domain accounts, and for notice within 24 hours of any agency staff departure. Review linked manager accounts in every access review and unlink any you cannot attribute.

Decision	Smaller advertiser	Large advertiser or agency
Number of Admins	Two or three named staff, monitored closely	Four or more with multi-party approval
2-Step Verification	Turned on per user, checked in the authentication column	Manager mandate requiring 2-Step Verification or Advanced Protection
Invitations	Allowed email domains on the account	Allowed domains mandate from the manager account
Agency access	Agency links via its manager account at Standard	Contractual mandates, quarterly link review
API access	Avoid unless needed	Service account workflow with keys in a secrets manager

Integrations, API tokens and service accounts

Bid management tools, reporting pipelines and agency platforms use the Google Ads API. Each call needs a developer token as well as OAuth 2.0 credentials, so there are two secrets to protect. Google's documentation describes a service account workflow for applications that manage accounts you already have access to and a multi-user workflow for applications that act for other users. Whichever identity is used must itself have access to the target Google Ads accounts.

Refresh tokens need passkeys: generating an OAuth refresh token for the user workflow now requires a passkey; passwords alone, TOTP and SMS codes are not accepted for that step. Existing refresh tokens keep working, which means old tokens issued before the change remain a risk until you revoke them.
Mandates reach the API: under a manager 2-Step Verification mandate, API calls for an unenrolled user fail with TWO_STEP_VERIFICATION_NOT_ENROLLED. Test mandates against automation before the effective date.
Developer tokens and keys: store developer tokens, OAuth client secrets, refresh tokens and service account keys in a secrets manager, never in scripts or shared drives. See the Google Cloud Service Account Keys Security Guide and the Secrets Management Guide.
Least access: give API identities only the accounts and access level they need, and record an owner for every one.
Product links: links to Google Analytics, Merchant Center and other products move conversion and audience data. Admin controls them, and they appear in Read-only views, so include them in reviews. The receiving side is covered in the Google Analytics 4 Security guide.

Logging and detection

Change history records changes from the past two years. The User column shows the email address for interface changes and "Google Ads API" or a tool name for API changes, with Google system entries listed separately. Google notes that some account level settings and some changes made by Google representatives may not appear, and that full detail is shown only for changes affecting fewer than 2,000 entities, so do not treat it as a complete security log.

Signal	Where to see it	Why it matters
Unrecognised users or access level changes	Access and security; change history	Attacker persistence (ATT&CK T1098 Account Manipulation)
Unknown manager account links	Access and security, managers	Remote control of the account
Sudden budget increases or new automated rules	Change history; budget reports	Spend fraud and malvertising (T1657 Financial Theft)
New campaigns, ads or final URLs you did not create	Change history; policy manager	Malvertising (T1583.008 Malvertising)
Policy suspension notices for unknown content	Email and account notifications	Often the first visible sign of takeover
Unfamiliar Advertiser Verification requests	Account notifications	Attackers trying to legitimise the account
Pending multi-party approval requests nobody expected	Access and security, pending invitations	Attempted user addition
Suspicious sign-ins for administrators	Workspace login audit events	Account compromise (T1078.004 Cloud Accounts) or stolen session cookies (T1550.004 Web Session Cookie)

For the identity side, feed Workspace login events to your SIEM: see the Google Workspace Audit Log Detection Guide. Infostealer malware that steals browser cookies bypasses passwords and 2-Step Verification, which is why Google tells advertisers to scan every device used to access the account. See the Session Hijacking and Cookie Theft Guide.

Metrics:

Percentage of users with 2-Step Verification or passkeys, from the authentication column (target 100 percent).
Accounts covered by manager authentication and allowed domains mandates.
Users with no sign-in for 90 days (target 0).
Linked manager accounts without a named owner (target 0).
Time from an unexpected user or budget change to detection.

Hijack response

Google's compromised account process is specific, and some choices are irreversible, so follow it in order and record each step. A general template for your own team is the Social Media Account Takeover Playbook; the Google Ads specific steps are:

Report: submit the compromised account report in Google Ads with timestamps of suspicious changes, unauthorised manager account IDs and your current IP address.
Recover: answer the guided recovery questions. Google may suspend the account, pause only the campaigns changed without authorisation, remove unauthorised users, unlink unauthorised managers and disable the linked Google Account.
Clean devices first: scan every device used to access the account for malware before changing passwords, otherwise an infostealer captures the new password or session.
Re-authenticate: administrators must complete 2-Step Verification and change their Google password before finishing the review.
Decide on the change log: administrators who held their role before the compromise receive the change log by email. Only one administrator can submit a decision (clean up the account, restore it as is, or request further investigation), and it cannot be reversed. Agree internally who decides before anyone clicks.
Review access and payments: re-check users, unlink unknown manager accounts and payment profiles, relink only approved ones, and review allowed domains.
Audit campaigns and policy: pause or delete campaigns you did not create, remove violating content, then appeal any suspension explaining the unauthorised access.
Reimbursement: only after recovery is complete and 2-Step Verification is on. Choosing "Restore this account as is" makes the event ineligible, and billing reviews take 10 to 15 business days.
Prevent recurrence: move administrators to passkeys, enable multi-party approval and mandates, and run a lessons learned review.

If the account served malicious ads, tell your security operations team, because visitors may have been sent to malware or phishing sites under your brand. Card or bank fraud on the linked payment method also needs to go to your bank.

Hardening baseline

Inventory: list every Google Ads account, manager account, user, access level, product link, payment profile and API integration with an owner.
Identity: move users to managed Google Accounts; require 2-Step Verification, and passkeys for administrators.
Mandates and domains: at manager level, apply the authentication and allowed domains mandates to all owned accounts, announcing the effective date so users enrol first.
Roles: reduce Admin, move finance to Billing, campaign staff to Standard, viewers to Read-only.
Approval: decide on multi-party approval and document it.
API: review developer tokens, refresh tokens and service accounts; revoke unused ones; store the rest in a secrets manager.
Monitoring: weekly review of change history for users, managers, budgets and new campaigns; alert on policy suspension emails.
Test and roll back: trial mandates on one owned account or a short effective date window, confirm API automation still runs, then extend. Access level changes can be reversed at once by an Admin; the recovery decision cannot, so it is never part of a test.

Common misconfigurations

Agency Gmail accounts with Admin: personal accounts outside any company policy hold the takeover role and survive staff departures.
No allowed domains: a single stolen session can invite attacker accounts at Admin level.
Unreviewed manager links: old agency manager accounts stay linked for years and become the attack path.
2-Step Verification left optional: it is only encouraged unless a mandate enforces it, so coverage drifts.
Treating Standard as harmless: Standard can create campaigns and edit billing information, which is enough for malvertising and spend fraud.
Restoring as is under pressure: choosing to restore the account unchanged during recovery forfeits reimbursement and may keep attacker changes.

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev 5	CIS Controls v8.1
Access levels and least privilege	PR.AA-05	AC-6	6.8 Define and maintain role-based access control
2-Step Verification and passkeys	PR.AA-01	IA-2	6.5 Require MFA for administrative access
Change history review	DE.CM-09, PR.PS-04	AU-6	8.11 Conduct audit log reviews
Agency and manager account oversight	GV.SC-07	SA-9	15.1 Establish and maintain an inventory of service providers
Hijack containment	RS.MI-01	AC-2	17.4 Establish and maintain an incident response process

Practitioner checklist

Admin is limited to named staff on managed accounts, with passkeys.
Allowed email domains are set on every account or by manager mandate.
A manager authentication mandate requires 2-Step Verification or Advanced Protection on all owned accounts.
Multi-party approval is enabled where there are more than three administrators, or compensating monitoring is in place.
Access reviews every 90 days use the authentication method and last login columns and cover linked manager accounts.
API developer tokens, refresh tokens and service account keys are inventoried, owned and stored in a secrets manager.
Change history is reviewed weekly for new users, managers, budgets and campaigns.
A written hijack runbook names who reports, who cleans devices and the single person who makes the recovery decision.

Google Ads Account Security: Lock down access, manager links and hijack response