Webinar MMM is here. Turn marketing mix modeling into better decisions.
banner icon November 3, 2026 Register now

The online retail growth podcast with
Mike Ryan & Christian Scharmüller

Google Ads Channel Priority: Change This Before February

Released:

In February, Google drops the hidden 50% Display budget split in your Search campaigns. Here’s what to change, and the catch in its new channel controls.

Mike Ryan and Chris Scharmueller unpack Google’s newest layer of channel controls for Search, Shopping, PMax and Demand Gen. Set a channel to low priority and Google spends on your high-priority channels first, sending only what’s left to the low ones, with an optional budget cap you can slide all the way down to zero. Display expansion in Search campaigns is the one to act on: its 50% budget split disappears in February 2027, so set Display to low priority with a 50% cap if you want to keep things as they are.

It sounds like real control. But in PMax and Demand Gen, Search, YouTube, Maps, Gmail and Discover all sit in one “Google channels” bucket, so the only channels you can realistically deprioritize are Display and Search partners. And if Google already goes after the most incremental conversion first, what does the new setting actually add?

Then a true horror story for Halloween: a client’s Google Ads account hacked late on a Thursday night, every company email address removed, and hundreds of unlimited-budget campaigns sending traffic to an affiliate site. Chris walks through how the account was recovered that same night, and Mike explains why ads are one of the main ways hackers get in.

⏱ Timestamps 00:00 - New channel controls and a hacking horror story 02:26 - Where channel controls stand today: opt-outs, checkboxes, sliders 05:44 - The new layer: channel priority and budget caps 08:47 - Google’s third way: low priority as a waterfall 12:23 - What does low priority actually add? 15:17 - The catch: how Google bundles the channels 19:28 - Change this before February: display expansion 21:36 - Horror story: a client’s Google Ads account gets hacked 27:22 - How hackers operate, and what limits the damage

💡 Key Takeaways Action item: display expansion in Search campaigns currently runs on a fixed 50% budget split you can’t see or change. In February 2027 that split goes away and Display moves to the new priority system. To keep today’s behaviour, set Display to low priority with a 50% budget allocation. Campaigns on Target Impression Share lose Display entirely. Google’s channel prioritization and budget allocation controls cover Search, Shopping, PMax and Demand Gen, and have been rolling out since mid-October 2026. Every channel starts at high priority, and you can set any of them to low. Google spends on high-priority channels first and sends the remaining budget to low-priority ones. On tCPA or tROAS campaigns that aren’t limited by budget, priority alone barely changes where the money goes. The budget cap does the work. For a low-priority channel you can set a maximum share of the daily budget. It’s best-effort, not a hard limit, and 0% stops spend on that channel. Budget caps aren’t available in Demand Gen. The catch: in PMax and Demand Gen, Search, YouTube, Maps, Gmail and Discover are bundled together as “Google channels”. Deprioritize that and you kill the campaign, so in practice only Display and Search partners are worth setting to low.

Account hacks are a real risk: three smec clients were hit this year. Spend alerts that pause campaigns limit the damage. And never log in to your ads account, or your bank, through an ad. Type the URL.

Episode Highlight

Google Ads Account Hack Horror Story Chris Chandler shares a real-world case of an ecommerce client whose Google Ads account was compromised late at night, locking out internal teams by removing all company email permissions. The attacker created hundreds of campaigns with unlimited budgets pointing toward an affiliate monetization site. The incident was rapidly contained within half an hour because an overlooked third-party partner email provided emergency admin access alongside automated performance alerts. This highlight underscores the vital necessity of strict access governance, automated spend safety nets, and clear emergency response protocols for ecommerce leadership.

  • Christian Scharmüller“What happened actually was they literally removed every email address of their company from the ads account, so they had no access anymore.”

Episode Transcript

00:00:00 - 00:00:46

Mike: Welcome to another spooky episode of Growing Ecommerce. Woohoo! I’ve been told we’re going to put some post-production on this, so let’s ham it up. We are going to talk today first about new, new channel controls for Google Ads, which should make you want to scream when you hear that there are new ones. Is this the spooky part? It is to me, but we’re going to then end with an extra special horror story told by the one and only Chris Chandler. You don’t see it, but I have goosebumps.

00:00:46 - 00:01:09

Chris: Yes, it’s about a hack. I thought the intro of the last episode was awesome. This one, Mike—no words.

Mike: Well, thank you, Chris. I mean, I’m in the Halloween spirit. Also, I think that really the topic of account hacks, which we’ll talk about later, is seriously scary.

Chris: Super scary.

Mike: It’s affecting a lot of businesses.

00:01:09 - 00:01:30

Mike: Yes. First new channel… no, sorry, new, new channel controls. I’m going to, by the way, put this on the record right away. Okay, I don’t want to complain about Google adding more channel controls. That’s great. But if I have to talk about new, new, new channel controls in a month from now…

Chris: Then you complain.

Mike: …I’m not doing it.

00:01:30 - 00:01:51

Chris: We’re not going to talk about it because we just did an episode about new channel controls. Yes. And ladies and gents, just also to put some execution management on this episode: normally we have some alignment on what we talk about, we want it to be as organic and fresh as possible.

00:01:52 - 00:02:26

Chris: This one is, we haven’t been talking about these new, new ones. So I will probably ask even more stupid questions this episode than you’re used to.

Mike: Yeah, okay.

Chris: When it comes to the new, new, I generally would love to understand what is new, man, but generally interested.

Mike: Yes. So, I was invited a couple of weeks ago by Google to talk about some new, new channel controls.

00:02:26 - 00:02:49

Mike: These are actually… so just for context, right now let me talk about the options that are out there for standard Search and Shopping campaigns. And so with this, you have opt-outs for certain types of things, namely Search Partner Network and Google Display Network. These are the kind of things you can either opt in or opt out of.

00:02:49 - 00:03:20

Mike: And for more modern cross-network campaign types like PMax and Demand Gen, there hasn’t been a classic opt-out previously. This changed first with Demand Gen, where they added a new feature called Channel Controls, and it is a multi-select checkbox. So you can create these cool Frankenstein—

Chris: Oh, hello. Oh man.

Mike: —this cool, maybe spooky Frankenstein Demand Gen campaign saying, “I want one that serves only Gmail and Maps.”

00:03:20 - 00:03:47

Mike: I don’t know, whatever you want, you can mix and match.

Chris: Yeah.

Mike: And they showed just how easy it can be to take a cross-network campaign and have real controls on it. And that has never quite come to PMax, which they still imagine is like a one-stop shop. But what we talked about on a previous episode is an alpha feature—I don’t even know if that has a proper name, but that’s where there’s this level of sliding game…

Chris: The slider.

Mike: Yeah.

00:03:47 - 00:04:11

Mike: So on some campaigns you’ve got checkboxes, opt-ins or opt-outs, and then they added this slider for PMax, which by the way applies all the way down to really the single channels like YouTube, Gmail, etc. You can’t uncheck them, but you can reduce them up to 50%.

Chris: Yes.

00:04:11 - 00:04:41

Chris: The scale of the sliders, just for the listeners, is based on the importance you assign to the channel. That’s the guide itself for you. But in the end, it’ll be based on like the CPA or the ROAS. Got it. Okay, okay.

Mike: And by the way, for the sake of transparency, especially with regards to PMax, you could force Google to let you control the channels by reducing any assets whatsoever, and you could force Google to not—

Chris: No, that’s not true. I don’t think so.

00:04:41 - 00:05:03

Chris: Because I told you that I’m asking stupid—

Mike: No, no, but the source of the question people ask all the time is, “Can I please do something to make it stop serving YouTube or whatever?” And it’s quite hard because you’ll run the risk that they’re just going to AI-generate some assets, so you can’t fully exclude that.

00:05:03 - 00:05:24

Chris: Yeah, it’s very hard to do that. You can probably reduce the exposure by removing any assets, but it’s not…

Mike: Okay, yeah. There’s only strategy and stuff like that, but it’s very hard to really do that.

Chris: So to wrap it up, Mike, the sliders we talked about two or three episodes ago, there is now an additional layer.

00:05:24 - 00:05:44

Mike: That’s the new one, and this is the new, new, new, new one. Okay.

Chris: Okay. So now it gets… come on, it gets spooky now. You were right. I told you, you’re like, “Is this actually a spooky thing?” I’m like, man, it’s spooky, guy.

Mike: So the new, new controls…

00:05:44 - 00:06:17

Mike: …have yet another mechanism. Okay, and basically what happens—this works for all campaign types, not just for Demand Gen, but you could really do it for Search, Shopping, PMax, Demand Gen—you can now specify the channel priority.

Chris: Channel priority.

Mike: Yes. So by default, they’re all high priority—in other words, normal priority. But you can then choose to make one low priority.

00:06:17 - 00:06:42

Mike: And once you’ve done that, this then gives you the capability to also specify like a max percentage of budget that you want spent on that, which is also a slider, but it’s not a CPA or ROAS budget slider. And you can slide that all the way down to zero, which functions like a checkbox opt-out.

00:06:43 - 00:07:06

Mike: Are you spooked out yet?

Chris: I am, I am. It’s not goosebumps level, but… well, after we talk… holy shit. I mean, I have a couple of questions. But anyway.

Mike: Okay, good. Let me keep going. Yeah, I just have a concern. I’m glad that Google is offering controls, but stuff is getting so complicated. Yeah.

00:07:06 - 00:07:30

Mike: Especially with the sliding game. The sliding game is fun, but it’s like, options here, and then there’s like a slider up, and then there’s like a ROAS slider, then there’s like a priority checkbox, which if you do that, then there can be a budget slider. I feel like now I’m attracted by how primitive…

Chris: Because it’s simple. It’s simple.

Mike: Wow.

00:07:30 - 00:07:57

Chris: So my question actually would be: the new, new channel controls, do they also apply to PMax? Maybe let’s start with a detail level and then we move up the level. It gets spookier. But yeah.

Mike: Yeah, because we talked about when we talked about the sliders for PMax, there were a couple of fundamental questions.

00:07:57 - 00:08:20

Chris: Question number one is: okay, how do the sliders make sense? You’re doing surgery. It’s like heart surgery, and you come with a massive sword. It feels like it’s way too loose. Yes, it’s way too loose with regards to what you’re actually changing there. Anyhow, that’s one fundamental question.

00:08:20 - 00:08:46

Chris: The other fundamental question was: what does it tell us about the future of PMax? From this one-stop shop, like fully automated end-to-end campaign, which it was, I think, designed to be… to like… yes, this is another step, because now I’m not just sliding, I can do the slider game with my ROAS, but literally the overall importance of the channel.

00:08:47 - 00:09:20

Mike: Yes. So let’s get into a little bit more detail there. I mean, about the future of PMax, well, it does raise—we talked about Jill’s hypothesis—even more questions, right?

Chris: Yeah, PMax is a failed campaign type, basically. But is it supporting that thesis?

Mike: Yes and no. I mean, they’re playing this… well, let me explain I think what Google’s goal here is. Google wants to offer a third way between opting in and opting out. That’s what they want to achieve here.

00:09:20 - 00:09:45

Mike: So I think it’s a compromise. Whether that means that these other things are failing or not, I think they know that people want control. They’re trying to take this situation and find a way that works for them and their objectives and revenue goals, and that works somehow for advertisers.

00:09:45 - 00:10:06

Mike: And you know, they could just offer an opt-out. They still do offer opt-outs in some cases. But they want a third option, which is instead of saying, “No, I don’t want to appear on Search Partners at all,” you say, “I want it to be less prominent.” And the way a low priority channel functions is as follows:

00:10:06 - 00:10:33

Mike: Google is going to find as much revenue and conversions as they can at your efficiency level, and when they hit that point, then they will look at this next channel. So it’s really a sequencing thing. It really makes it kind of a second-class citizen. They’ll only expand there after your core channels.

00:10:33 - 00:11:00

Chris: So you say, “These are my core channels.” So you’re literally prioritizing your channels based on kind of a waterfall principle.

Mike: Yeah, it’s a simple waterfall. There’s a high priority, which is effectively normal, and then there’s a low priority.

Chris: Got it.

Mike: So yes, you can say, rather than opting out of these entirely, you help ensure that it’s… you know, it’s like, okay, what if there is something good in Search Partners?

00:11:00 - 00:11:20

Chris: Got it. I don’t want it to be my primary order of business, but if my campaign is running out of room otherwise…

Mike: Okay, you can look there. Good, if I have this budget gap. So in that regard, again, I don’t want to be the whining guy here. I think that it makes sense what Google has done here, but it’s just complicated, and I think a lot of people aren’t going to get it.

00:11:20 - 00:11:51

Chris: Yes, it’s complicated. Translation: look, it lands with me based on… by the way, you already created the probably quite complex communication stream Google has here. The way you explain it now to me is that by prioritizing my channels, I can basically force Google to really be focused on incremental revenue with all the channels.

00:11:51 - 00:12:23

Chris: I say, no, they are not priority for me, so they focus on my high-priority channels hitting my targets there, and after that they will try to detect: is there some growth pocket, let’s say the Search Partner Network? I like that.

Mike: All right, me too.

Chris: But we had an episode a few months ago where we talked about this new incremental idea of Google, that they are doing this by default.

00:12:23 - 00:12:49

Chris: So they are always going for the best conversion in the best channel, and only after that are they looking at the next incremental conversion, maybe in another channel. Is this now… so what’s the value add? Shouldn’t Google be doing this by default? That’s what I’m asking. What additional control…

00:12:49 - 00:13:08

Chris: Isn’t it dangerous again that I say, “Hey, the Search Partner Network is not relevant for me”? Hold on, maybe there are super, super profitable conversions going on there.

Mike: Yeah, I mean, you have to have a look first, because in general, Search Partner Network is not a great network, though I’m not sure about that.

00:13:08 - 00:13:24

Chris: Yeah, but it does work for some people. Also, for some parts of Search Partner Network, I wish there wasn’t so much low-level crap in there.

Mike: Yeah, because the idea of Search Partner Network is not bad.

Chris: Yeah, it’s just gotten too big to control it.

Mike: Yeah, you hear about “too big to fail”—it’s too big to succeed.

00:13:24 - 00:13:43

Mike: So that’s my problem with it. But that is a very interesting question, and I would need to ask Google to get the answer to that, because you’re right: Google said… you know, they like to make these comparisons about fishing in ponds and stuff like that.

Chris: By the way, I love their go-to-market communication.

00:13:43 - 00:14:22

Mike: Sure, yeah. I understand what they’re trying to say. But that’s true: they claim to sort of already be doing that in some way. And again, I basically like the idea that Google gives you back controls, but if the controls are so loose and are potentially literally dangerous to the core of what Google has proven to be very good at—finding the best possible click with the maximum value for you—then I would argue: why are they doing this? Because, I mean, let me face it: talking about PMax again, Chris…

00:14:22 - 00:14:49

Mike: …the controls we have now are way more than I think Google was thinking about giving us at the beginning of the campaign launch, right? But I think all the leverage they presented to us felt right, felt concrete. Now I don’t know why they are going so much beyond that with a very loose…

00:14:50 - 00:15:17

Mike: Yeah, I just think that these are compromises because the market is demanding that.

Chris: Well, the market is demanding more control. They want channel opt-outs.

Mike: Google is not willing to fully yield that. You know, we’re not going to get Demand Gen where you can just have a multi-select checkbox. So they’re finding something that offers some measure of control, but is not going to completely turn off the channels.

00:15:17 - 00:15:43

Mike: And by the way, now this is… I told you there are a couple more spooky details since we’re in Halloween. Spooky detail number one is how the channel buckets here are defined. And I’ll tell you, there’s… well, let’s look at the case of PMax and Demand Gen. These are the most complicated ones. There’s Search Partner Network…

00:15:43 - 00:16:14

Mike: …all right; Google Display Network, okay; and then there’s “Google Channels”, which is Search Network (that’s text and shopping), then YouTube, Gmail, Discover, whatever, all that stuff.

Chris: So you can’t… it makes it functionally useless, because no one has a problem with Shopping.

Mike: Yes, yes. There’s a problem with the other stuff.

Chris: Yeah, so you can’t… then it just breaks it.

00:16:14 - 00:16:39

Chris: Yeah, it makes it completely unusable, to be honest. Because if you cannot have Search Network and the other Google-owned properties bundled together, or Google channels… if it would be Google Search Network and then Google owned-and-operated, okay, makes sense. But how do you want to deprioritize Google channels? You’ll kill your campaign.

Mike: You’ll kill your campaign, at least for… you know.

00:16:39 - 00:17:07

Chris: So where, by the way… is this only US, or is it globally available? Is it beta or…?

Mike: No, they are rolling this out. It’s rolling out over a slightly undefined period. I think it could be rolled out as soon as November, but it might take a bit longer. But no, they’re rolling it out fast. So this is coming, this is real.

00:17:07 - 00:17:24

Mike: The other new ones—these are the new, new ones—the new ones that we talked about with the sliders, that is the alpha. I’m not even sure if it has a name, but it’s alpha, it’s very limited. That’s something else. They haven’t officially communicated it; they’ve been silent about that. But this one, they’re putting this out there.

00:17:24 - 00:17:47

Mike: I think that they wanted it out in time for Black Friday, to be honest.

Chris: Wow. So we have the ROAS sliders, US only, alpha.

Mike: Yeah, the important… well, do you have a catchy name for it? Is it the slider, or…? Hold on, there’s a super catchy name for it. Let me tell you… I just can’t remember.

00:17:47 - 00:18:12

Mike: I was looking at it because that’s how it is called. Wait for it: “Channel Prioritization and Budget Allocation”. So section two features Channel Prioritization, where you set the priorities. Very descriptive names.

Chris: I mean, now with this last piece of information, I’m not kidding, it’s absolutely useless. You questioned if this topic was scary enough for Halloween, and I told you actually my story, which should be the horror story of this episode, sounds like a non-story.

00:18:12 - 00:18:31

Chris: Super scary, it is. But man, just one last thing when we talk about this—am I right? And I told you that I ask stupid questions now because we haven’t aligned on this by any means. I think it’s fair to say that the idea of forcing less important channels to really be incremental to a business, that’s what Google should do anyway, right?

Mike: Right.

00:18:31 - 00:19:03

Chris: And then the second thing is how they cluster the channels. Is it fair to say that it makes this feature useless functionally? The only thing you can do—because no one is going to choose to set a lower priority for…

Mike: Yeah, you’d be crazy to do that.

Chris: So all you can do is set Display Network and Search Partners to low priority, which acts as this third way between opt-in and opt-out. But no one’s going to set the other…

Mike: Yeah, crazy, because it doesn’t make sense.

00:19:03 - 00:19:27

Mike: But I told you, one last thing—there is more.

Chris: Yeah?

Mike: There’s one last thing. As it turns out, this system has already been applied in the backend for a period of time. Now, I don’t know how long, but that’s already how Display expansion in Search campaigns works. And something to be mindful of is that rolling out manual control of this was already a backend feature there.

00:19:49 - 00:19:58

Mike: It’s going to break the backend feature. Okay. So beginning in February of next year…

00:19:58 - 00:20:24

Mike: …Display expansion in Search campaigns, as it stands right now, is automatically low priority and 50% budget. And it will now become a normal priority channel as of February.

Chris: So you need to watch out if you have that activated.

Mike: Yes, it’s going to become by default more active. So you want to go in and set it because, you know, if even Google set it as a low priority channel, you probably want to set it to low priority.

00:20:25 - 00:20:48

Chris: So that’s an action item for that. That’s very interesting. Yeah, everyone should have that on a task list. I mean, maybe to wrap it up, how I see it: again, man, we shouldn’t be too harsh on Google because actually I love that they are listening to the market and the idea of giving back control.

Mike: I don’t know, no… but you can’t… you’re better than that!

00:20:48 - 00:21:10

Chris: I’m just not a fan of the sliding game by any means with regards to such important issues, criteria, KPIs you’re changing with your sliding game, and the way they do it now with how they cluster channels. Honestly, it’s half-baked.

00:21:10 - 00:21:36

Chris: It reminds me of when they added negative keywords to PMax, and the initial limit was I think 100 on campaign level.

Mike: Exactly.

Chris: So it was just enough for brand safety purposes, but not for proper management. But spooky story, take us…

Mike: Yeah, let’s do the Treehouse of Horror.

00:21:36 - 00:21:54

Chris: Mike and I talked about it: what can we… there should be a horror story which really moves the needle with the listeners. So maybe you’re not falling asleep tonight because you have to think about that horror story. I don’t know if it’s that bad, but it was certainly a story which…

Mike: It is.

Chris: Yeah, actually it is. It could have been catastrophic.

00:21:54 - 00:22:23

Chris: So, ladies and gents, a true story. And by the way, I think it addresses a bigger issue in general—not just relevant for online shops or companies active in Google Ads, I think it’s also super relevant for agencies. It’s a story where a client of ours got hacked, and so I’ll guide you through the story.

00:22:23 - 00:22:41

Chris: Mike, I won’t try to be… I’m a sales guy, but I’m not selling a story. I’m sticking very much to the truth.

Mike: You can make it spooky, though. We’re here…

Chris: I’ll try, I’ll try. But I think the story in itself is so spooky, no selling needed. Maybe we need more sound effects.

Mike: Maybe, yeah. We have to talk to Kevin.

00:22:41 - 00:23:02

Chris: All right. Now, look, it was 10:30 at night. I was on my couch with my wife, and we were watching an ass-boring movie. My phone rang, and I saw it was the CEO of a very important client of ours. 10:30, 10:45 at night. What day of the week was it? I think it was Thursday.

00:23:02 - 00:23:29

Chris: I said, okay, maybe a pocket call. So I waited about 10 seconds, and when he kept ringing, I picked up the phone. He was super apologetic, but he’s one of the smartest CEOs I know. He does a fantastic job. But literally, he said just a one-liner: “Sorry to call you late.” And then he immediately jumped in, and I felt like, okay, this is serious now.

00:23:29 - 00:23:48

Chris: So what had happened: he had already called an emergency meeting. All the people of the company relevant to this problem were already in his office at 10:45. It really was a war room urgency meeting. They got hacked. Their Google Ads account got hacked.

00:23:48 - 00:24:10

Chris: What happened actually was they literally removed every email address of their company from the ads account, so they had no access anymore. The hacker did this. Now, the hacker was not as smart as you might think he should be, because he forgot a couple of email addresses. One of them was ours.

00:24:11 - 00:24:34

Chris: So I told him, “Look, I’ll call our CTO right away and let’s think about what we can do.” I called our CTO, he picked up the phone—shoutout to the legend. He said, “Chris, the first thing we have to do is let’s give it a try if we can log in.” Of course, I was quite nervous, I could have thought about that as well.

00:24:34 - 00:24:56

Chris: And in the meantime, he did some background checks on what we can and should do in general. I had no access to the ads account because I’m not an operational guy anymore. I called Chris—shoutout to him as well, he is the account owner of that. He literally picked up the phone on one ring. I was like, “Were you expecting a call?”

00:24:57 - 00:25:16

Chris: He was on his way back from dinner and he was on his phone. So he immediately called his team, and they were literally able to log in to the account again. And then the analysis started. In the meantime, I called back the CEO. I said, “Look, we have access, this is great. Now let’s have an immediate look at what is going on in the account.”

00:25:16 - 00:25:40

Chris: What went on in the account: the hacker created hundreds of campaigns—hundreds of campaigns! This client is active in a lot of countries, hundreds of campaigns. And they created these campaigns with unlimited budgets, and the traffic was directed towards an affiliate site. Super generic keywords, literally worst case, right?

00:25:40 - 00:26:05

Chris: And the affiliate site was their monetization strategy. Luckily, the client—shoutout to them—realized it very quickly, so the campaigns were live for maybe half an hour, but already a couple of thousand euros were gone. Worst case, you’re just not detecting this issue, which might happen, right? That would be massive, massive damage.

00:26:05 - 00:26:28

Mike: Yeah, well, let me jump in…

Chris: Because that was the case, right? And to finish the story: then it was quite easy. What we did was we paused the campaigns, all good. But the issue was we had no admin rights. The admin rights were actually with the client’s email addresses, but they couldn’t log in anymore.

00:26:28 - 00:26:58

Chris: But then we found out something: there was another email address the hacker forgot, which was actually a third-party vendor. I don’t know if they were still working with our client, but I told the CEO, “Look, give it a try. Call them.” He said, “Yeah,” and I don’t know why, but they picked up the phone as well. They had admin rights, gave us admin rights, and we could remove the hacked email address from the system. Very good. That’s the story.

00:26:58 - 00:27:22

Mike: Well, that’s so funny. I mean, usually it’s a terrible security practice to leave partners you’re not working with anymore with access to your account, also with admin rights. But in this case, it was the saving grace!

Chris: It was the saving grace.

Mike: But yeah, this is a concerning, common, and frequent topic now. It’s not the first time we’ve seen this.

00:27:22 - 00:27:48

Mike: And it’s also… this is classic. Some of these people are very skilled operators, and I have seen this go one of two ways. Either they lock you out of your own account and start spending money super fast, or they try not to arouse your suspicion and create smaller campaigns, siphoning money that way, playing the game that they can remain undetected for a longer period of time and just bleed money away without raising alarms.

00:27:48 - 00:28:14

Mike: You know, it’s not like Office Space where you’re just splitting small amounts out. And I’m willing to bet… I don’t know if you know this, Chris, but most commonly the vector for these hackers is Google Ads itself.

Chris: Yes, I don’t know if it’s the case here. No, it was not the case here, but I know what you mean.

00:28:35 - 00:29:01

Chris: Just maybe before we jump on that, because I think it should be a big learning to all the listeners and viewers: that case I’m talking about was in the fashion industry in the UK, and I’m not kidding, we had three similar cases this year alone where clients got hacked within their ecosystem. There was another one in the sports industry, very similar case; another one in ticketing, very similar case.

00:29:01 - 00:29:25

Chris: And always the strategy is to create hundreds of campaigns within the account, unlimited budgets, a couple of keywords directed towards an affiliate site. Two things I want to end with, because that makes the horror story maybe a bit more bearable: two things. First, our alerting system popped up.

00:29:25 - 00:29:47

Chris: There were thresholds set which would have led to a pausing of the campaign, so you can do things about it. And the other thing: shoutout to Google. Google detected it very early as well and automatically already paused some campaigns. So this was very, very interesting. Shoutout to Google because the damage was a couple of grand, but very much manageable, because it could have been way worse.

00:29:47 - 00:30:17

Mike: Well, I don’t want to give too much credit to Google because unfortunately their ad ecosystem is a huge factor. I think they took down Google Sites, but that was a problem as well, because if websites were built on Google Sites, the URL was [link removed], and because it had google.com in there, it was allowing people to really advertise as Google.

00:30:17 - 00:30:47

Mike: And there’s been all kinds of crazy situations. It’s a bit of a cat-and-mouse game. I understand Google doesn’t want this situation either, but advertising itself is a huge vector producing this, even on the consumer side. You know, my mom had a problem with her Samsung TV, and she typed in “Samsung support” in Google, clicked on a link, and ended up getting involved with this fishy thing. She said to me, “I don’t understand, I typed Samsung support and clicked the first result.”

00:30:47 - 00:31:10

Mike: And it was super fishy. It was like… well, the first result was probably an ad. So never log in to any crucial system via a paid ad—ever!

00:31:10 - 00:31:32

Chris: Yeah, here we are in the ads business, but it is a vector. It’s a vector. You should never… like banks, ads accounts, things like this: do not search for them, do not click on ads. Visit the URL directly if you can.

Mike: Yes, 100%.

Chris: So bottom line is: shoutout to a lot of people who got this thing right.

00:31:32 - 00:32:00

Chris: And yeah, it’s a real thing. The cases are popping up—we had three cases this year on the client side. And yeah, you can now count on the safety nets your partners have and you have. And I really mean… you just said don’t make too big of a shoutout to Google because their ads elsewhere are potentially a vector for these hackers, but Google was very fast as well in detecting the fraud.

00:32:00 - 00:32:24

Chris: That’s great, that’s it. Yes, but you do want to end with a shoutout to Google. That would be scary.

Mike: Yeah, but it’s healthy to… now you’re doing this shoutout to Google.

Chris: I really did it. A shoutout to Google! No better way to end a Halloween episode. Those poor Googlers.

00:32:24 - 00:32:56

Chris: It was a pleasure. It’s a pleasure, Chris. Happy Halloween!

Mike: Happy Halloween! So thanks, everyone, for listening to this scary episode of Growing Ecommerce. If you want even more thrills and chills, visit smarter-ecommerce.com. And the scariest thing you could possibly do would be to follow or subscribe to this podcast on YouTube, Spotify, Apple, wherever you find podcasts—we’re there.

00:32:56 - 00:33:03

Mike: Thank you. See you next time.

Chris: Thank you. Great intro and outro. Yeah.

Google Search logo
Add us as a preferred
source on Google →

Latest Episodes

Episode 58
Google’s August 17 Bidding Update: Good or Bad? The Data

Google’s August 17 Bidding Update: Good or Bad? The Data

Episode 57
Prompt-Driven Campaigns: Will You Still Control Your Ads?

Prompt-Driven Campaigns: Will You Still Control Your Ads?

Episode 56
Why Amazon Blocked Meta Muse (and Google Should Be Worried)

Why Amazon Blocked Meta Muse (and Google Should Be Worried)

Get the know-how directly to your inbox

Join our newsletter and be the first one to receive strategies and insights on the latest ecommerce & digital advertising trends.