---
title: "Google Ads strategist email scam: what to check first"
description: "Google Ads strategist email scam checks: ask for an email, read the From and Return-Path addresses, and open Google Ads yourself before you share access."
url: "https://webleveling.com/blog/fake-google-ads-strategist-email-how-to-check/"
lang: "en"
published: "2026-11-02"
modified: "2026-11-02"
author: "Cal Hewitt"
tags: ["google-ads","website-security","small-business"]
image: "https://webleveling.com/og/blog-fake-google-ads-strategist-email-how-to-check.jpg"
alternates:
  es: "https://webleveling.com/es/blog/estafa-correo-estratega-google-ads.md"
---

# Google Ads strategist email scam: what to check first

Google Ads strategist email scam checks: ask for an email, read the From and Return-Path addresses, and open Google Ads yourself before you share access.

![A hardware store owner in a denim apron stands at her counter in the afternoon, frowning at a phone seen from behind at an angle, paint cans and shelves in muted grey and off-white tones behind her.](https://webleveling.com/blog/fake-google-ads-strategist-email-how-to-check/gads-strategist-email-featured.jpg)

A friendly email arrives from a "Google Ads strategist" who offers to tune up your account. Maybe a phone call came an hour earlier from someone who said they work for Google. Whether this turns out to be a Google Ads strategist email scam or a real contact, the first moves are the same, and you can finish them in about ten minutes without sharing anything.

Pause before you reply. Ask the sender to put the request in writing, then compare the From and Return-Path addresses with the domains Google's help pages name. Do not click a link in the message, and never share a password, a verification code or payment details.

Reports of AI-made names and photos on these contacts have made owners wary, and that caution is fair. An unfamiliar name or photo is a reason to verify. The steps below show you how, and which part you can finish alone.

**Key Takeaways**

**Verify before you reply**

Ask for a written email, read the From and Return-Path addresses, and compare them with @google.com, @ads.google.com and @xwf.google.com.

**Keep credentials to yourself**

A password, a verification code or a payment detail stays with you, and a link in the message is never the way to sign in.

**A photo is a reason to look closer**

The reported AI-made names point to a possible outsourcing firm, so judge a contact by its address, its links and what it asks for.

**Review access on your own**

Sign in at ads.google.com, open Admin, then Access and security, and remove anyone you do not recognize.

## How do I check whether a Google Ads strategist email is real?

Four moves settle most of it, and the first two take a minute each. Google's help page on [suspicious emails and calls claiming to be from Google Ads](https://support.google.com/google-ads/answer/2375460) tells you to ask the caller to send an email so you can check who they are. From there, work through these in order.

1.  **Compare the addresses**: Open the full headers and read the From and Return-Path addresses. Google says a message from Google Ads should show @google.com or @ads.google.com in both.
2.  **Check the link without clicking**: Copy the link address and confirm it leads to a google.com page. Google gives this same advice.
3.  **Sign in on your own**: Type ads.google.com into your browser, open Admin, choose Access and security, and look at who is listed.
4.  **Report anything off**: If the contact looks like an impersonation, send it to Google through its scam reporting pages, covered below.

Google's [page on third-party partners](https://support.google.com/google-ads/answer/7675633) adds a second address to know about. It says Google representatives working through its extended workforce always have an email address that ends with @xwf.google.com. So, a real contact can come from more than one domain.

Sender domains Google's help pages name

| Address ends with | Who Google says uses it | Where Google says it |
| --- | --- | --- |
| @google.com | Google's own messages about Google Ads | Suspicious emails and calls help page |
| @ads.google.com | Google's own messages about Google Ads | Suspicious emails and calls help page |
| @xwf.google.com | Representatives working through Google's extended workforce | About our third-party partners help page |
| Anything else | Not a Google address; treat the contact as unverified | Check before you answer |

Keep the name, the job title and the profile photo out of your decision. Any of the three can be borrowed or invented, while the address in the headers is the part you can compare with what Google published.

![Standing in an aisle of garden hoses, a woman holds a cordless handset to her ear and writes a callback number on a notepad.](https://webleveling.com/blog/fake-google-ads-strategist-email-how-to-check/gads-call-write-it-down.jpg)

On the call, ask for an email and decide nothing until you have read the sender address.

## What was reported about the AI-made Google Ads strategist names and photos?

The reports come from a public discussion that Search Engine Roundtable covered on [November 2, 2026](https://www.seroundtable.com/google-ads-strategist-ai-fake-names-photos-42426.html). They describe one person's experience and a later suspicion, and the dates matter for how much weight to give each part.

What was reported and when

1.  1

    October 29, 2026

    Posts on X start the discussion, according to Search Engine Roundtable.

2.  2

    November 2, 2026

    Search Engine Roundtable reports a call from someone who said they worked for Google Ads' extended workforce, followed about an hour later by an email from a person presented as a Google Ads Strategist. The poster believed that person's profile photo was AI-generated.

3.  3

    November 2, 2026, update

    Another SEO reportedly linked a similar name and face to a worker at an outsourcing firm that "might work for Google", with a headshot reportedly made in Gemini.

4.  4

    At the time of the report

    The reporter wrote that he asked Google about this and did not hear back.

The outsourcing link comes from a forum-style update, and Google had not answered the reporter at the time, so treat the outsourcing link as unconfirmed.

What Google does say is that it works with outside partners. Its partner page says those partners work on behalf of Google, and it adds: "Always check carefully the identity of persons or entities claiming to act, on behalf of Google." That line fits this situation well. A contact can be tied to Google's extended workforce and still deserve the same checks as anyone else.

## What should I never share with a Google Ads caller?

Keep four things to yourself until the contact is verified through Google Ads itself: your password, any verification code sent to your phone or email, your payment card or bank details, and a screen session on your computer. Campaign advice can be given without any of them, so a request for one is your cue to stop.

If someone wants access to the account, grant it by invitation to a verified Google Account or agency account, and choose the lowest access level that covers the job. Google's guidance on [keeping your account secure](https://support.google.com/google-ads/answer/12864492) recommends individual Google Accounts, minimum necessary permissions and removing users who are no longer active.

You can also decline the offer without any access at all. A polite "send me the details by email and I will review them" ends the call and gives you the written record the checks need.

![A pale grey sticky note stuck to the edge of a dark monitor on a wooden desk, handwritten in block capitals with the words "Nothing shared until verified", a coffee mug beside it.](https://webleveling.com/blog/fake-google-ads-strategist-email-how-to-check/gads-check-sender-note.jpg)

Write your rule down once, and the next call is easy to end.

## How do I see who has access to my Google Ads account?

This is the part of the check that only you can do, and it shows whether anyone unexpected already has a way in. Sign in by typing ads.google.com yourself rather than using any link from the message. Then open Admin and choose Access and security, where you can review the Users and Managers areas.

Google's page on [account access levels](https://support.google.com/google-ads/answer/9978556) describes Read-only, Standard and Admin among the levels. Read-only lets someone view the account, Standard lets someone work in it, and Admin lets someone manage the users themselves. Give an agency or a freelancer the lowest level that lets them do the job.

**Ten-minute access review**

**Open it yourself**

Type ads.google.com into the browser and sign in as you normally do.

**List every user**

Go to Admin, then Access and security, and note each person and their level.

**Check the managers**

Look at the manager accounts linked to yours and confirm you know each one.

**Remove or lower**

Choose Remove access for anyone unexpected, and lower any level higher than the job needs.

**Look at recent changes**

Scan recent budget, billing and campaign edits for anything you did not make.

Google's page on [managing access](https://support.google.com/google-ads/answer/6372672) covers the removal steps. Keep two trusted administrators if you can, so that losing one login never locks you out of your own account.

![The owner and a bookkeeper in a grey cardigan go over a printed list of account users together at a back-office table.](https://webleveling.com/blog/fake-google-ads-strategist-email-how-to-check/gads-access-review-back-office.jpg)

A second pair of eyes makes the user list easy to read.

## What if I already clicked the link or shared something?

Act in this order. If you typed a password into a page that came from the message, change that password right away, and change it anywhere else you used it. Google's help page on [securing a hacked or compromised account](https://support.google.com/accounts/answer/6294825) walks through recovery and two-step verification.

Then review your Google Ads users and recent changes using the steps above, and call your card issuer if you shared payment details. Save the original message, the sender address and any link before you delete anything, because you will want them for the report.

If a link was clicked or a login was shared, a [website security audit](https://webleveling.com/services/website-security-audit/) can check whether the problem reached beyond the ad account. If you only read the email, the checks above are enough.

## How do I report a suspected Google Ads impersonation?

Google's [Avoid and report scams](https://support.google.com/faqs/answer/2952493) page lists reporting routes, including one for Google Ads impersonation. Google Ads Help also has a [complaint form](https://support.google.com/google-ads/contact/aw_complaint) for a third party that sells Google Ads services. Tell Google whether the contact claimed to be Google, a Google partner or an independent agency, and attach the sender address and any links as text, not as clickable links.

Scams that borrow the Google name are not new, and the same checks carry over. Our posts on [Google Business Profile scam calls](https://webleveling.com/blog/google-business-profile-scam-calls/), [fake domain renewal and SEO invoice scams](https://webleveling.com/blog/fake-domain-renewal-and-seo-invoice-scams/) and [fake sites and ads using your business name](https://webleveling.com/blog/fake-sites-and-ads-using-your-business-name/) cover the other versions you may meet.

## Do I need to pay someone to check a Google Ads contact?

No. Everything above is something you can do yourself with Admin access, and Google publishes each step. Paying for it only makes sense when the check turns up something bigger: a manager account you do not recognize, changes you did not make, billing you cannot explain, or conversion tracking nobody has looked at.

If that happens, ask whoever helps to keep the account in your name, use individual logins and the lowest access level that works, and write down each change they make. That is how you stay in control after the unexpected contact has been dealt with.

![A shop owner in a canvas apron rings up a customer buying a can of paint at the register in the afternoon.](https://webleveling.com/blog/fake-google-ads-strategist-email-how-to-check/gads-quiet-counter-afternoon.jpg)

Once the account is checked, the phone can stay face down and the day goes on.

**Quiz: Can you spot a real Google Ads contact?**

1. Which sender addresses does Google's help page name for its own Google Ads messages?
   - Any address with Google in the display name
   - @google.com or @ads.google.com **(correct answer)**
   - Any address ending in .com
   - Only addresses on a free email service
2. A message includes a link to "review your account". What should you do?
   - Click it and sign in quickly
   - Reply with your password so they can look
   - Copy the link address, check where it leads, and sign in at ads.google.com yourself **(correct answer)**
   - Forward it to your whole team
3. Someone you have verified wants to help with your ads. What access level should you grant?
   - Admin, so they can do everything
   - The lowest level that covers the job **(correct answer)**
   - Whatever they ask for
   - None, but share your password instead

## Frequently Asked Questions About Google Ads Strategist Email Scam

**Is a Google Ads strategist email legitimate?**

It depends on the sender, not the name or photo. Ask for a written email, read the From and Return-Path addresses, and compare them with @google.com, @ads.google.com and @xwf.google.com. Then check Access and security in Google Ads for anyone you do not recognize.

**How can I tell if an email from Google is real?**

Google's help page says a message from Google Ads should show @google.com or @ads.google.com in both the From and Return-Path fields. Copy any link address and confirm it leads to google.com before you click.

**Is there a Google scam email going around?**

Google Ads Help has a page on suspicious emails and calls claiming to be from Google Ads, and Search Engine Roundtable reported on November 2, 2026 about a contact that used an AI-made name and photo. Use the same sender and link checks on any message.

**Is an @xwf.google.com address real?**

Google's partner page says its extended workforce representatives always have an email address that ends with @xwf.google.com. Verify the rest of the request the same way, and share no password or payment details.

**Can an AI-made profile photo prove a contact is fake?**

A photo alone is not the test. Reports say a similar name and face might link to a worker at an outsourcing firm that might work for Google. Judge the contact by its address, its links and what it asks you to share.

**What access level should I give someone who helps with my ads?**

Give the lowest level that covers the work, and invite a verified Google Account or agency account. Read-only lets someone view, Standard lets someone work in the account, and Admin lets someone manage users.

## Moving Forward

A strange email from a "Google Ads strategist" has a short list of checks behind it. Ask for a written email, compare the From and Return-Path addresses with the domains Google names, copy any link before clicking, and review who has access in Admin, then Access and security. Keep your password, verification codes and payment details to yourself the whole way.

Those checks keep control of your ad account in your hands, and they work the same for the next unexpected call. You can do all of them alone, and doing them once also leaves you with a clean list of who can reach your account.

If the review turns up something you cannot explain, [Web Leveling](https://webleveling.com/) can look at it with you. Our [Google Ads management](https://webleveling.com/services/google-ads-management/) work keeps the account in your name, uses the lowest access level that works, and documents every change. We work with small and medium businesses across the country and overseas. [Send us what the account review showed](https://webleveling.com/contact/), and we will tell you what needs fixing and what you can leave alone.

## Terms

Words used in this post

Tap a term to see what it means.

**Return-Path.** A hidden address in an email's headers that shows where replies and bounces are routed, which Google says should match its own domains.

**Extended workforce.** The outside contractors who work on Google's behalf, whom Google says use email addresses ending in @xwf.google.com.

**Manager account.** A Google Ads account that is linked to yours and can be given access to manage it.

**Access level.** The permission a user has in a Google Ads account, such as Read-only, Standard or Admin.

**Impersonation.** Pretending to be Google or a Google partner to gain trust, access or payment.

**Two-step verification.** A second proof of identity, such as a code sent to your phone, required when you sign in.

- [Performance Max brand searches: what to check in your account](https://webleveling.com/blog/performance-max-brand-searches-filtered/): Performance Max brand searches: Google's help says PMax may filter out brand-specific queries toward dedicated Search. Check the search terms report first.
- [Why your Google Shopping listing shows only a price](https://webleveling.com/blog/google-shopping-and-bing-product-listings-what-you-control/): Sale price, shipping and returns on Google Shopping and Bing come from your product data and account settings. Check them before you buy ads or change bids.
- [Meta ads vs Google ads: testing a shift without wasting money](https://webleveling.com/blog/ai-shifting-ad-spend-meta-vs-google-search/): Meta ads vs Google ads for a small budget: keep Google running, test Meta on its own budget, and move money only when qualified leads back it up.