An email arrives: “You have been invited to an ad account.” There is an “Accept” button, a familiar logo and sometimes even a genuine sender address. It looks like a contractor or a colleague. In reality it can be a trap: accept the access or type your password on a fake page, and strangers start running your ads and spending money from your account.
Below: how the scheme works, why “checking the sender” is not enough, what you can verify yourself in five minutes and what to do if you have already clicked. We checked the facts against Google’s help and against publications by cybersecurity companies and advertising specialists in October 2026. Menu names come from Google’s help in English; depending on the interface version they may differ slightly.
How the trap works
Inviting someone to an account is an ordinary feature: the owner gives another person access, and that person receives an email. Scammers use it in two ways.
First: the button in the email leads to a fake page that looks like the Google sign-in. You type your password and it goes to the scammers. This is phishing: you are tricked into handing over a password or access yourself.
Second: you really do accept the invitation, and a stranger becomes a user of your account. An advertising specialist described in November 2025 that the takeover of a “manager” account (the kind an agency uses to run several client accounts) often starts with exactly such a phishing invitation: the “accept” button leads to a page copying the Google sign-in but with a different address. The attackers then remove the legitimate owner and change other users’ permissions.
In April 2026 industry news also reported a new wave of such invitations in Google Ads: the emails came from Gmail addresses and the links in them were suspicious.
Why the sender proves nothing
There is a contradiction here, and we will show both sides.
Google’s help “Secure your Google Ads account” (the part on suspicious emails and calls) says that in a genuine email from Google the From and Return-Path fields should contain @google.com or @ads.google.com, and that if a link leads somewhere other than google.com, the page may not belong to Google. Against crude fakes this works, and the April 2026 wave was precisely from Gmail addresses.
But there is another side. Security researchers write that scammers create their own account and send invitations using the platform’s own feature, so the email arrives from the service’s genuine address and passes mail filters. For Meta this is confirmed recently. According to Check Point (November 2025), more than 40,000 phishing emails reached more than 5,000 customers: they came from the genuine domain facebookmail.com through the business invitation feature, with a subject like “Meta Agency Partner Invitation”, and the links led to password-harvesting pages. According to another company, in July 2026 Meta took action and these attacks subsided.
For Google the picture is less certain. One 2023 study described invitations arriving from a genuine Google address, but we found no recent confirmation for Google specifically. So we say it honestly: fake invitations come both from foreign addresses and, according to some data, from a genuine one, and words like “always” or “never” do not belong here. Google’s own help page on accepting an invitation only says that the email arrives when someone gives you access, and does not explain how to tell a genuine invitation from a fake.
The conclusion is simple: the sender address can filter out a crude fake, but it cannot prove an email is genuine. Look not at who wrote, but at where the button leads.
What to check yourself: five steps
1. Do not sign in from the email. Do not click the button and do not type a password on the page it opens. According to Google’s help, the company never sends unsolicited messages asking for a password or other confidential information.
2. Open the account yourself. Type ads.google.com into the browser (for Facebook and Instagram ads, business.facebook.com) or open it from a bookmark. Note that Google’s help does not say whether the account will show a pending invitation. So this is a way to avoid going through the email, not a guarantee that a genuine invitation will appear there.
3. See where the link goes without clicking it. Google’s help advises right-clicking the link, choosing “Copy link address” and pasting it into a notepad. If the address does not lead to google.com, it is not Google. For an email “from Meta” the check is the same: the address should lead to Meta’s services, not to an outside site.
4. Do not accept a stranger. Is the invitation from someone you do not know and did not expect? Do not accept. Security specialists add a stricter rule: invitations to someone else’s account are usually not accepted at all, you send them yourself.
5. Phone the acquaintance. If the invitation supposedly comes from a contractor or a colleague, do not reply to the email itself, but get in touch through a channel you already know: call or message in a messenger. A minute of conversation costs less than a hijacked account.
What to do if you already accepted or typed your password
Do not delay, act at once.
- Change the password of the Google account you signed in with. According to Google’s help, secure the account first and then report the problem.
- See who has access: in Google Ads open the “Admin” menu → “Access and security” and look at the list of users and their “Access level”. An unfamiliar user is removed with “Remove access” in the “Actions” column, and an invitation that has not been accepted yet is cancelled with “Revoke”.
- Report it to Google through the account security form that the same help page links to.
- Look at spending over the last few days. Practitioners treat an email about an unknown administrator, a foreign manager account in the list of linked accounts and new sign-ins from unfamiliar devices as signs of a takeover. If spending has grown without your involvement, consider unlinking the payment card: practitioners warn that even this does not always stop charges, so contact Google at once.
For Meta the order is the same: change the password, review the list of people and partners in the business settings and remove unfamiliar ones. We could not confirm the exact Meta menu names in the official help, so we do not give them.
How to protect yourself in advance
A passkey. This is sign-in without a password: Google confirms you with a fingerprint, face or PIN of your device. A fake page cannot steal such a key. According to Google’s email to advertisers, quoted by industry publications, from 15 July 2026 some sensitive actions in Google Ads (changing user access, linking accounts) require a passkey. Secondary sources write that a new key may not work right away: it takes one or two days, and sensitive actions also have a seven-day delay. We found no official deadlines, so create the key in advance, not on the day you need to grant access.
Two-step verification for everyone. It should be on every profile that has access to the account, including you and your social media specialist. The same rule applies to Meta Business Manager.
Two administrators, not one. Then losing one login does not mean losing the account.
A clean user list. Once a month open “Access and security” and remove people who no longer work with you. A former contractor with administrator rights is an unnecessary risk. What else should be registered to your email, we covered in the checklist on what should be connected to your website.
An agreement in advance. When a contractor is about to ask for access, agree who will send the invitation, from which email and when. Then an unexpected email becomes a signal at once. Our onboarding of a new client includes this step: before asking for access, we ask to see the list of users in “Access and security” and check there are no outside administrators.
Summary: five questions to ask yourself
- Was I expecting this invitation from this person?
- Did I open the account myself, not from the email?
- Where does the link really lead: to google.com or to Meta’s services?
- Did I phone the acquaintance who supposedly invited me?
- Do I have a passkey, two-step verification and a clean user list?
An answer of “I don’t know” to the first question is already a reason not to click the button. How we run advertising is in the sections on search advertising and Performance Max.
Want a free audit of your Google Ads account? Send us a request: we will look at your account, check who has access to it and tell you what is worth closing.