Dear
Friend,
This past month one of our previous clients had their Google AdWords account hijacked. This is the first time in over four years of working with Google AdWords that we have had an experience such as this.
Although you could be a victim at some point in the future, we don't intend to scare you with this article. Rather, we just want to help you to think of your AdWords login information as an important piece of financial information that should be guarded carefully.
Best Regards,
Nancy McCord
|
Don't Let Your AdWords Account Be Hijacked
This past month one of our previous clients had their Google AdWords account hijacked and they got taken for nearly $10,000 in clicks. It could have easily been you!
The client came back to us to have us assist them in unraveling the problem. It all started when the client could not login to their Google AdWords account. In under one day the hijacker had rung up nearly a $10,000 bill for clicks on their credit card.
Working
with the client and Google, we were able to have Google
reverse all charges, review their account carefully for
changes, and work to get them back in business with a new
Google AdWords account.
Not only had the hijacker installed new campaigns on their account, but they had replaced all of their original keyword lists on multiple campaigns and in all ad groups. The actions the hijacker took were clearly malicious in nature and done in an effort to not only hurt the client's business but to charge a big bill to their MasterCard.
With prompt action, the day the client let us know that they could not log in, we had recommended a fraud alert be put on their credit card and had started quickly working with Google to start a fraud investigation and to get control back of their account.
It appears that the client had been a victim of an AdWords phishing attack. In this case, he received an email, that he thought was from Google, asking for account verification but was in fact giving his login information away to bandits. Once they had access to his AdWords account, they changed his master Google accounts password and then finally even his Google account email address.
After an account has been compromised in this manner Google and McCord Web Services recommend several courses of action.
1. Scan your entire computer for software, malware and keystroke logging software as sometimes clicking a link in a phishing email will compromise not only your AdWords account but put your computer at risk as well. Our client actually had such a serious problem that he had to purchase a new hard disk and upgrade his firewall and security software.
2.Change all passwords for online applications such as banking sites, PayPal, eBay, etc. One can just not be sure that other applications may be safe after such a nefarious attack on your security.
3. Never click a link to Google AdWords, PayPal or your bank that is sent to you in an email. Visit the site online, type in the URL yourself and then perform the needed account verification action that the email had requested. In many cases, you will find that no action was really needed on your part and that the email was just a scam to get you to share your personal information that bandits would then use to access your accounts.
4.
Change your password to sensitive sites like AdWords, PayPal
or your bank every 30 days. Use passwords that are a combination
of letters, characters, and numbers.
5. When you correspond with me or another Google AdWords account manager. Don't send your login and password via email together. Call and give the information by telephone, send it by fax or break the information into separate emails.
6. Be cognizant that there are bandits out on the Web that DO want to steal your Google AdWords information for their illegal purposes.
In many cases a Google AdWords account is compromised in order to spread a virus or keystroke logging application using malware. Your account can be used to drive traffic to a website that has been set up to install (unknown to you) applications that allow remote access to your computer to install a virus, steal your personal financial information, or to turn your computer into a spam zombie. Links on the infected site are rigged to infect you and all others who have clicked the Google AdWords ad once they arrive.
As a final note on this specific situation, Google support was great in helping us to get our client running again, but it did take nearly one week and the client did incur additional expenses for setting up a new account. Our recommendation if you don't have a professional AdWords account manager, is at the absolute minimum, login to your Google AdWords account once a week to make sure that you haven't become a victim. Remember, this client got hit for $10,000 in one day!
