There seems to be unauthorised access attempts or activity in your account – Google Ads

There seems to be unauthorised access attempts or activity in your account.

Advertisers have quoted the full alert as “Your account is suspended” followed by “There seems to be unauthorised access attempts or activity in your account. To protect your security, we have temporarily suspended this Google Ads account.” Some spell it “unauthorized”.

This notice means Google thinks someone other than you has tried to get into your Google Ads account, or has got in, so it has suspended the account to protect you. If Google detects an unauthorised user trying to access the account, it says it will “temporarily suspend your account to protect against unauthorised charges”. Its fix starts with a compromised-account form.

The Google Ads Community threads we found that quote this wording word for word date from 2020 to 2022, in British and American spelling. We haven’t found a word-for-word report since, so the banner on your account may be worded differently. A nastier case turned up in 2026: an advertiser found their account suspended for “Circumventing Systems: Cloaking”, then found a campaign in it they didn’t recognise. If the problem was malware on the website rather than someone in the account, read suspended under the Malicious Software policy instead.

Checked against Google’s help pages on 22 September 2026. Google changes them without notice, so check the linked page before relying on a detail.

At a glance

• A protective suspension

  Google says the suspension protects you against unauthorised charges.

• Report it on Google’s form

  Google’s help pages point to its compromised-account form.

• Gmail may be disabled too

  Google says your Google Account may also be disabled.

• It can become a policy suspension

  Google says an intruder’s ads can lead to a Circumventing Systems suspension.

• Never too late, in our experience

  As long as an appeal can still be filed.

On this page9 sections

What the notice means

Google’s suspensions overview covers it under “Unauthorised account activity”: an unauthorised user can steal credentials and access your Google Ads account without your permission.

It can reach beyond Google Ads. Google says that if it thinks your account has been compromised, it will be temporarily suspended to stop your ads from serving, and your Google Account may also be disabled, so you may not be able to use products such as YouTube or Gmail until it’s resolved.

What triggers it

Google acts when it detects an unauthorised user trying to get in, or when you report unauthorised activity. The Google pages we checked don’t list the signals it looks for.

Not everyone who gets the notice finds a break-in. One advertiser saw it the day after setting up a campaign for a new website. Another said the contact form made them tick a box saying the account was compromised, although they’d found nothing.

In our experience, when there has been a break-in, it typically starts with an email. Someone clicks a link, and the page it opens captures their password or their signed-in session. From there, they typically change the phone number and how the account is verified, and take over Gmail, Google Ads and Merchant Center accounts. They often hold the accounts to ransom, because they know they’re valuable, especially Merchant Center accounts when the whole business runs on advertising.

Google’s pages speak to the same risks. It will never send an unsolicited message asking you to provide your password, its “Confirm it’s you” checks are designed to help protect your account against cookie theft, and it lists unfamiliar changes to critical security settings, such as your recovery phone number, among the signs that someone else may be using your Google Account.

When a hack turns into a Circumventing Systems suspension

The harder case is what the intruder leaves behind: Google says policy suspensions are a known side effect of unauthorised activity, when intruders create policy-violating ads, keywords or website content. These can lead to suspension under policies like circumventing systems or unacceptable business practices. Its cloaking policy adds: “Websites can get hacked and cloaking content can be added without you knowing.”

Google treats Circumventing Systems as egregious, and a compromised-account report doesn’t always end with Google agreeing. The advertiser suspended for cloaking said Google found no signs of abnormal activity; another advertiser got the same answer.

Read our guides to the Circumventing Systems policy and cloaking, or phishing in Google Ads if that’s the suspension you got.

What Google asks you to do

Google’s page on what to do if your account is compromised sets out the order.

1. Report it.

   Use the compromised-account form as soon as possible. Before you fill it in, Google asks you to gather specific timestamps from the change history that show the unauthorised access, manager account IDs you didn’t link, and evidence of budget increases or automated rules that aren’t how you normally run the account.

2. Recover and secure the account.

   If someone has changed your password or recovery phone number, use Google’s account recovery page. Google says to clear malware before you change the password. Then review the account’s recent activity and turn on 2-Step Verification.

3. Review the change log.

   If Google confirms the unauthorised activity, it secures the account and then emails a change log. Only users who were admins before the compromise can approve it, and the decision can’t be undone, so carefully review all modifications.

4. Check users and access levels.

   Review the full list of users, adjust access levels, re-invite anyone removed and unlink manager accounts you don’t recognise. Admins can see each user’s authentication method and last login time.

5. Check billing.

   Review the linked payments profiles and your bank or credit card statements. Google’s billing page says that if it detects suspicious or unauthorised payment activity, it may restrict how much the account can spend or suspend the account.

6. Clear out the intruder’s work.

   Pause or remove campaigns you didn’t create and check your advertiser verification details. Appeal any policy suspension only after the account is secure and the intruder’s content is removed.

7. Request reimbursement.

   If Google’s investigation finds the account was compromised and you were billed for unauthorised charges, you may be eligible for reimbursement. You can ask once the account is reactivated and 2-Step Verification is on.

Can it be fixed?

Google’s page describes two routes. If the intruder only changed campaigns or users, Google says it will unsuspend the account once it’s secured. If they changed the account’s structure, it stays suspended until an admin approves the change log. In our experience, when the account stays suspended, it needs a full appeal, plus direct communication with Google explaining what happened in the account and that the access came from someone else, not you.

It’s never too late, in our experience, as long as an appeal can still be filed. Google says all advertisers have at least six months from the date of account suspension to submit an appeal, but warns you may not be able to access suspended accounts after an extended period.

Only Google decides. For appeals, it says accounts are only reinstated in compelling circumstances, such as a mistake. Our Circumventing Systems service page is honest about the cases we can’t win: if an account really was arranged to get round Google’s review, no appeal can change that. We tell you on the free call.

The appeal route

• Only the unauthorised-access notice? Start with the compromised-account form: Google says it will secure your Google Ads account immediately and reach out with preventive steps. If the account stays suspended, in our experience it needs the full appeal described above.
• Suspended for a policy too? Secure the account and remove the violating content, then appeal from the “Contact us” link in the notification, explaining that the violations were caused by unauthorised access and how you secured the account. Send one appeal at a time.

Before you write it, read what the appeal form asks and what to do in the first 24 hours, and why appeals get rejected.

Keep it from happening again

Turn on 2-Step Verification for everyone with access: Google says it can help keep bad actors out, even if your password has been compromised. Consider passkeys and multi-party approval, where a second admin approves changes such as adding users. And check where an email link goes before clicking: Google’s page on suspicious emails or calls shows how. If the email says it comes from a Google representative, our guide to emails from xwf.google.com covers how to tell whether it’s genuine.

Frequently asked questions

Nobody hacked my account. Why did I get this?

Google says it suspends the account when it detects an unauthorised user trying to get in, and the notice itself says “access attempts or activity”, so an attempt can be enough. Tell Google what you checked and what you found: it says it’s important to be “thorough, accurate and honest” when you appeal.

Can I still use Gmail and YouTube?

Maybe not. Google says your Google Account may also be disabled, and you won’t be able to use products such as YouTube or Gmail until the issue is resolved.

Will Google refund what the hacker spent?

You may be eligible, if Google’s investigation finds the account was compromised and you were billed for unauthorised charges. Google says you must complete account recovery first, then request reimbursement once the account is reactivated and 2-Step Verification is on. It says billing investigations can take 10 to 15 working days.

I was hacked, and now I’m suspended for cloaking. What now?

Secure the account and remove what the intruder added, then appeal the policy suspension, explaining that unauthorised access caused the violations. Our cloaking guide covers what else Google checks.

It happened months ago. Is it too late?

In our experience, it’s never too late as long as an appeal can still be filed. Google says all advertisers have at least six months from the date of suspension to appeal, but you may not be able to access a suspended account after an extended period.