Skip to content
In Google Ads, phishing means trying to get people’s personal information, such as passwords and card numbers, by “pretending to be a trusted or well-known entity”. It is a section of Google’s Unacceptable Business Practices policy, and like the rest of that policy it is treated as egregious: the account is suspended on detection, with no warning. A genuine business accused of it has to show Google that it isn’t posing as anyone, and that any brand it mentions really is connected to it.
If the suspension notice on your account names phishing, this is the section Google applied. People search for it as “your account violated the unacceptable business practices phishing policy”, sometimes with “your account is suspended” run straight into the front. The general version of the banner is covered in our article on Your account violated the Unacceptable Business Practices policy.
Policy positions in this article were checked against Google’s published documentation in September 2026. Google’s advertising policies change without notice, so check any detail against the linked pages before relying on it.
I’m Gianluca Catinella, Director of Ad Restore Ltd, and I want to be clear about where this article comes from. I have not handled a client phishing case. What follows is Google’s published policy, a phishing suspension on a business of my own, and my understanding of how these scams work. Where it is my view rather than Google’s, I say so. For the wider policy, see our guide to the Google Ads Unacceptable business practices policy.
Google’s Unacceptable business practices: Phishing section gives three examples:
What they share is a trusted name paired with a request for personal details. Google gives two reasons for banning it: people are tricked into handing over personal information that is then used to take their money or identity, and the practice is deceptive by its nature.
In my experience, it is typically scammers impersonating a platform or a cryptocurrency service. They replicate a business, operate from different countries and try to advertise on Google just to collect people’s emails and payment details. That can mean impersonating an online community or platform, offering a discount, or putting up a login page and asking for payment when they are not the official business. They take people’s information and sell something they can’t deliver. Google finds that egregious, and a direct violation.
The core policy is broader. It covers scamming people by hiding or misrepresenting information about your business, products or services, including impersonating other brands or businesses to get money or personal details. Phishing narrows that to one aim: collecting personal information by posing as someone people trust.
The consequences are the same. Accounts are suspended “upon detection and without prior warning”, and reinstated only “in compelling circumstances, such as in the case of a mistake”. The differences are in the detail. The phishing section has its own, shorter list of best practices, and its appeal tips ask for things the core section doesn’t, such as how your business works and your Google Ads history.
Genuine phishing is people actually scamming others, not providing a service. But a legitimate page can look like it from the outside, and I have been on the receiving end of that myself.
One of my other businesses, which ran affiliate marketing, had its Google Ads account suspended for phishing. It was a full account suspension, not a disapproved ad. I showed Google that the pages pointed to the official platform, and I supplied agreement documents proving the business had the authority to advertise it. The suspension was removed.
That is the kind of situation worth checking for. The patterns below are ones where, in my view or in the view of volunteers on Google’s community forum, a legitimate page can read as phishing. They are not a list Google publishes:
The first check I would make is simple. Type in a well-known brand, a school or course brand for example, and you can find replicated sites asking for emails or payment up front. Those are typically phishing for people’s information. If any page of yours could be mistaken for one of those, that is what to fix first.
A hijacked account follows a different route from a phishing suspension. Where Google detects unauthorised access, its suspensions overview describes a temporary suspension to protect against unauthorised charges. Its purpose is to protect you from charges you didn’t authorise, which is different from a policy finding. If you suspect any unauthorised activity, Google provides a form to report it.
In my view, that route is a real avenue: if the account genuinely was taken over, the suspension can sometimes be overturned on that basis. It is another avenue, not a certainty. One volunteer on Google’s community forum has said that if Google had identified unauthorised access, it would have issued a different notice, which suggests a phishing notice after a compromise isn’t automatically treated as a hack. If this is you, report the unauthorised activity, and in any appeal explain what happened and when.
Google’s tips for this section, in order:
Google’s suspensions overview also uses phishing as its worked example of explaining your situation in an appeal.
On the history question, I will be honest: I haven’t seen new accounts or agency changes linked to these suspensions myself. Google asks, though, so answer it fully.
On proof, my rule is the same as for any partnership claim: contracts, agreements, real documents, with real signatures from real people. In my own affiliate case, the evidence was agreement documents proving the business’s authority to advertise the platform.
Don’t rush it. Find the cause and gather the proof before you use the Contact Us link in the notification, and send one appeal at a time: Google says too many appeals for the same suspension may not be processed. For what the form asks, see our guide to the Google Ads suspension appeal form.
If the account really was posing as someone else to collect people’s details, there is nothing honest to appeal. Google reinstates only in compelling circumstances, such as a mistake, so a phishing suspension can only go well when the account genuinely wasn’t impersonating anyone.
Google is acting at scale, too: its 2025 Ads Safety Report says it suspended 24.9 million accounts that year. Genuine businesses get caught up in that, which is why the evidence matters. Scams are what the policy is there to stop.
Google’s phishing section doesn’t mention privacy policies. Volunteer Product Experts on Google’s community forum do list a form without a privacy policy among the common reasons they see for suspensions like this. The safe step is Google’s own best practice: make it obvious who is collecting the data, by describing your business on your site and keeping your contact details current.
Yes, if the relationship is real and clear. Google’s advice is to be clear about partnerships: if you are an official partner, ask the brand to mention you on its own website, and make the relationship clear on your site and in your ads. If you reference a brand without being an official partner, Google suggests you consider a disclaimer on your website and in your ads.
Google names a link to the brand’s official website where your business is listed as a partner, or a public statement from the brand confirming the partnership. In my experience, contracts and agreements with real signatures from real people belong alongside that.
There is no set number for account suspensions. The limit of three appeals people quote applies to each individual ad. For accounts, Google asks for one appeal at a time and says too many appeals for the same suspension may not be processed, so make each one count.
If the notice on your account names phishing and you are a genuine business, book a consultation before you appeal, and have your partnership documents to hand. You can read how we work on our Google Ads suspension services page.
No one can promise an outcome on a phishing suspension, and I will tell you straight if the evidence isn’t there.
Choose what we may use in this browser. You can come back and change this at any time. Privacy and cookie details
Your browser sent a Global Privacy Control signal, so analytics and advertising are off unless you turn them on here.
Keeps the site working, remembers your cookie choices and protects against automated traffic. Always on.
Helps us understand how visitors use the site and which pages and campaigns work: Clicky (no cookies, anonymised IP address) and Google Analytics.
Lets Google measure whether visits from our adverts lead to enquiries or bookings. No advertising audiences or personalised ads are built from this site.
Your choice is kept for 6 months in this browser. Change it any time via "Cookie settings" at the bottom of every page.
