A business owner gets an email that looks completely professional. The sender claims to be from a well-known Google Ads agency, the email domain checks out at first glance, and they have a straightforward request: share your Google Ads account access so they can run a quick audit. It sounds reasonable. It is not.
This type of scam is becoming more common in the UK, and it is catching out business owners who are perfectly switched-on in every other area. The fraud is convincing because it mimics exactly how a real agency relationship begins. Knowing what to look for can save you real money and serious headaches.
How the Scam Typically Works
The setup usually follows a recognisable pattern. You receive an unsolicited inquiry, often presented as a potential client or partner reaching out. The message is polite, professional, and uses language that sounds like it belongs in an agency email.
They ask for the email address linked to your Google Ads account so they can grant you read-only access (or so they claim). Then comes a request for your phone number to schedule a follow-up call. From there, the scammer sends what looks like an official Google notification asking you to accept access to your account. Accept it, and you have handed a stranger the keys to your advertising spend.
Some versions of this scam go further. Once inside your account, fraudsters can redirect ad spend, steal billing information, or lock you out entirely. Others use the initial contact purely to harvest your details for follow-up phishing attacks.
The Email Domain Trick
One of the cleverest parts of these scams is the email address. Scammers register domains that look almost identical to real agency names, or they use a domain that actually redirects to a legitimate company's website when you type it into a browser.
That redirect is the trick. You hover over the link or check the domain, it appears to go somewhere real, and you relax. But the email itself is coming from a completely different server controlled by the scammer. A few things to check:
- Copy the exact domain from the email header (not just what is displayed) and search for it independently
- Look for subtle misspellings or extra words, such as googleadsagency-uk.com instead of a genuine company domain
- Check whether the domain was registered very recently using a free WHOIS lookup tool like Nominet or ICANN Lookup
A brand-new domain registered in the last few weeks is a serious red flag, especially if the sender claims to represent an established agency.
Red Flags in the Inquiry Itself
Beyond the email address, the conversation itself usually contains warning signs. Scammers often apply subtle pressure, moving things along faster than a legitimate agency would. Genuine agencies spend time understanding your business before asking for account access.
Watch out for these patterns:
- They ask for Google Ads access very early in the conversation, before any discovery call or proposal
- They avoid giving you specific details about their agency, such as a registered business name, Companies House number, or a verifiable physical address
- They use generic compliments about your business that suggest they have not actually looked at it
- The follow-up call is always urgent, always just this week
Legitimate agencies are happy to take their time. They want to earn your trust, not rush past the part where you might ask questions.
What a Real Google Ads Agency Access Request Looks Like
When a genuine agency needs access to your Google Ads account, the process goes through Google's own platform. You will receive a notification inside your Google Ads account, not just by email, asking you to approve a manager account link request.
The agency should be able to tell you their Google Partner ID or show you their Google Partner badge. You can verify a claimed Google Partner status through the Google Partners directory at partners.google.com. If someone cannot point you there, or gets vague when you ask, treat that as a clear warning sign.
Also worth knowing: read-only access does not allow someone to make changes or spend money from your account. If a caller or email contact asks for anything beyond read-only during an initial audit, refuse and reassess immediately.
Steps to Verify Any Agency Before Sharing Anything
A few minutes of checking can stop a scam in its tracks. Before you respond to any unsolicited agency approach, run through these steps:
- Search for the agency name independently. Find their actual website by searching Google, not by clicking links in the email.
- Call them on a number you find yourself, not one provided in the suspicious message.
- Ask for their Companies House registration number and check it at companies.gov.uk.
- Look them up on the Google Partners directory to confirm they are a verified partner.
- Check reviews on platforms like Google Business Profile, Trustpilot, or Clutch.
If an agency is legitimate, none of these checks will bother them. A real agency will welcome the due diligence.
If You Think You Have Already Been Caught Out
Act quickly. Go straight into your Google Ads account under Tools, then Account Access, and remove any manager accounts or users you do not recognise. Change your Google account password immediately and enable two-factor authentication if it is not already on.
Check your billing history for any unusual spend and contact Google Ads support to report the incident. If payment details were involved, contact your bank as well. The sooner you act, the better your chances of limiting the damage.
The Bigger Picture
These scams work because the digital marketing industry does involve a lot of trust. You genuinely do need to share account access with agencies at some point, and real audits do happen. Fraudsters exploit that familiarity to slip past your defences.
The best protection is a simple habit: never respond to an unsolicited approach by sharing credentials or account access, no matter how professional the message looks. Always initiate contact yourself through verified channels. If a deal or an offer disappears the moment you ask to verify it properly, you have your answer.
Working with a UK-based agency you can meet, call, and hold accountable makes a significant difference. It is harder to scam someone when you have a real business relationship, a local phone number, and a name on Companies House.
