Google Ads agencies under attack

A paid search agency can now get hacked by doing the most ordinary part of its job: answering a new business inquiry. On April 10, 2026, PPC Land reported that scammers were posing as big-brand marketing contacts and using fake sales leads to try to get access to agency manager accounts. (ppc.land) The trick starts with a believable prospect. PPC Land said the attacker used a look-alike domain that redirected to the real company website, which made the inquiry look like it came from a legitimate corporate buyer. (ppc.land) The target is not one ad account. The target is a manager account, which is Google’s control panel for agencies that oversee multiple client accounts from one login. (support.google.com) If a scammer gets into that manager account, the damage can spread across an entire client roster in one move. Search Engine Land reported in November 2025 that similar manager-account hijacks had already left agencies and advertisers losing control of client budgets and account access. (searchengineland.com) This is not the only search-related scam in the same lane. A separate April 2026 report described travelers who searched Google for customer-service numbers, called fake listings, and ended up losing money to impostors pretending to be travel companies. (aol.com) Google has warned about that exact pattern in its own help pages. The company says scammers create fake customer-service websites and phone numbers, then use deceptive tactics to get those numbers surfaced in search results. (support.google.com) Put those two scams together and the weak point is the same: trust borrowed from Google’s interface. In one case, the criminal borrows trust from a polished lead that looks like a Fortune 500 prospect; in the other, the criminal borrows trust from a phone number that appears after a Google search. (ppc.land) (support.google.com) Google says users should not share information or click links until they verify that a call or email is really from Google, and it points advertisers to reporting and account-protection steps for suspicious outreach. That advice matters more for agencies because one mistaken approval can expose many client accounts at once. (support.google.com) Google also says Search now uses artificial intelligence systems to block hundreds of millions of scammy results every day and that recent improvements helped it catch 20 times more scam pages. The problem is that agencies and customers are still running into the scams that get through, which turns routine search and sales workflows into security checks. (safety.google)