AdSense Account Hacked to Send Payment to Thief

Four Weeks Later and Still No Help from Google Support

[Eurydice]

Someone hacked my Adsense account.

The payment has been re-routed to a person in India.

I found Google Adsense's support email and sent them an email with all the details. That was four weeks ago.

Zero response. Google can't figure out how this was done or how to stop it.

If you're using Adsense, you must watch it closely. It's hackable. And Google can't stop it.

If there is anyone from Adsense on this list, please contact me. Please, please fix this.

[ken_b]

Did you disabled the ads on your site?

Or are you hoping G will fix it and send you the money they've paid the hackers?

[Edge]

Someone hacked my Adsense account.

The hacker changed the name and banking routing on your account?

I thought Google did not allow the payee to be different than the Adsense account holder.

[StoutFiles]

Zero response. Google can't figure out how this was done or how to stop it.

Haha. Google can fix it, they just don't care. Google sets the standard for worst customer support ever.

I highly doubt they "hacked" it, they probably just got your password for your Google account(I would hope you don't use that password for anything else) and changed your information. Can you still login to AdSense to change your info back?

[incrediBILL]

I'll suspect you use wifi on a laptop, and wifi is easily hackable.

The other option is your PC is hacked with a password sniffer.

They got your passwords over wifi and are now having a good time.

[Eurydice]

1) I don't use a laptop. I have wifi in the house, but how would someone in India get access to that?

2) The account has my Google ID. But the payee (who receives the money) is in India (and of course, his complete information is there: name, address, bank info, etc.)

3) Google does not respond. I sent emails twice. In my experience with Google, no news is very bad news. I suspect they're trying to figure out how this was done and the extent of the scam (how many accounts have been penetrated).

Last year, we discovered a billing error in Adwords. The Adwords team said it wasn't an error. The Google accounting department said it wasn't an error. Google Finance said it wasn't an error. However, we continued to press on this for four months because the error was around $20-30,000 per month for the client. Okay, not much money to Google, but it mattered to the client.

Well, there really was an error and it affected a massive number of accounts. Somehow, Google didn't notice hundreds of millions of dollars had gone missing. Google Finance had to fix this.

So maybe the same thing is going on here. I asked Google to fix my hacked Adsense account. No reply. A few months later, I ask again. No reply. So I'll make it public. Adsense is hackable. Maybe now Google will fix this.

[johnnie]

Haha. Google can fix it, they just don't care. Google sets the standard for worst customer support ever.

In Adsense, Google is YOUR customer.

[incrediBILL]

I have wifi in the house, but how would someone in India get access to that?

Do you see any other wifi networks from your house?

Heck, my phone records wifi networks as I drive down the street.

If I want, I could come back and sniff them later, some people do that stuff and sell those passwords.

I'm thinking you have a trojan somewhere, hard to say.

Why Google won't respond is beyond me, but it's par for the course.'

[levo]

Does sniffing work on https pages too?

[w3bmaster]

Hmm theres no 100% secure thing on the internet you people should know this ....

Evrything can be hacked ... if you got hacked a bit of guild is from you ... for sure

Hope you resolve this but woow earning 20-30k/month you must have a lot of traffic ...

[StoutFiles]

Hope you resolve this but woow earning 20-30k/month you must have a lot of traffic ...

That had something to do with AdWords. I believe if he was making 20-30k with AdSense they'd take his request more seriously.

[alika]

I thought that you can't change the country in an account -- and to do that you have to remove the code in your site and reapply again with your new country.

I assume you're not from India and the new payee in your account is in India, right? So how can someone just changed the country settings in your account profile?

[martinibuster]

It is troubling that an AdSense publisher cannot obtain help from Google support to resolve this matter. Has Google's business outpaced Google's ability to manage it? Or has Google underestimated the resources need to manage it?

[engine]

This should really be a question of what next to do when it appears the account was hacked.

[Rodeo]

2) The account has my Google ID. But the payee (who receives the money) is in India (and of course, his complete information is there: name, address, bank info, etc.)

False.
Indian publishers have only one option to receive their payments and that is through check. So there won't be any 'Bank Info' on the records. But there will only be Name, Address and contact number.
Also changing 'country' is impossible for an account without them 'personally contacting' the Adsense people.

[joelgreen]

Eurydice, try using posting on support forum instead of email. Maybe support email gets monitored differently.

[google.com...]

PS: they used to have a contact form, but i think they replaced it with support forum :( And seems that they not responding is not something new.... [webmasterworld.com...]

[rajivatre]

I 100% agree with Rodeo.
Only two possibilities exists here IMHO.
1) Google server is hacked and the information is changed.
This is very remote possibility as the hacker will not keep his name, address, contact info after the payment is issued. Why keep a trace?
2) Adsense password of OP is hacked and information is changed.
Again this is also a very remote possibility.
I handle 3-4 accounts for clients. I can change the address (within country) but I cant change the payee name. Also google is not asking for Bank information for Indian Publishers.
Also Changing country is impossible by simply logging into anyone's account.
Can you change back the Payee Name to your Name since you can log into your adsense account? If the answer is "No" then same case with the hacker who has (possibly) hacked your adsense password.

So I feel something is missing here or some misunderstanding.
Did you open the account yourself? Sorry for the obvious question but I did open adsense account for one of my overseas client with putting all his information.
If you have outsource this work to anyone there might be a possibility that he put his name while opening the account. Again this is very remote possibility but still there is a chance it might occur.

In India, Police are very strict about cyber crime and they take it very seriously.
If you want any help I am ready to help with Cyber cell of Police in india.

Website of Cyber cell in Mumbai,india.
[cybercellmumbai.com...] (Hope mods will keep this link.)

Thanks
Rajiv

[jecasc]

I found Google Adsense's support email and sent them an email with all the details. That was four weeks ago.

Have you been to the police? Because 4 weeks is a long time and normally this matter should already have been resolved. The least the authorities should have done by now is contact Google to stop the payments.

And it does not matter if the guy is in another country they have police, too and they cooperate internationally.

Someone in Sarajevo (Bosnia) once forged my signature and send a fax to my bank in Germany to do a money transfer to his bank account. I noticed it the same day and reported it to the bank, the money was reversed and the guy arrested in Sarajevo a few days later.

[Rugles]

Could this be related to all the Adwords phishing emails that have been going around? Any chance you are using the same password and user name on both accounts?

[surfer67]

Someone hacked my Adsense account. 

This is why I have been requesting for some time now that Google make available to publishers the IP address login history for all Adsense accounts.

[Lame_Wolf]

This is why I have been requesting for some time now that Google make available to publishers the IP address login history for all Adsense accounts.

IIRC any changes to the info of an account are then emailed to the original email address. Therefore any illegal changes would/should have been spotted by the OP.

Anyway, aren't any changes have to be made by the 15th ?

WiFi problem... possible. The details could have been sent to someone in India.

I would also check your spam tray for any real Adsense emails.

[Alcoholico]

Support from google? Sorry but that animal, as the beast has grown, has ceased to exist, unfortunately their forum is useless too, generic responses and no real service, also they don't seem to understand that for businesses a direct response from the business partner is very different to an anonymous user opinion. Though I find the whole story hard to believe, not saying it's not true, I just find it very unlikely. It'd be very considerate from the OP to post the outcomes of these claims.

[edited by: Alcoholico at 6:54 pm (utc) on May 13, 2010]

[Hugene]

Eurydice, saying publicly that "AdSense can be hacked" is no threat or news to anyone, we all know that.

I am not sure if I understand your situation or not, but I have a few advices for you:

1) Immediately remove all AdSense code from your sites: what's the point of serving these ads if you were hacked, and you don't get paid for it. Google will never believe your story that you were hacked if you keep serving these ads.

2) Make sure your never use the same password for your G account and any other account. Your G account should be protected like a bank account.

3) If you use Windows, re-install your machine fresh. If your with Linux, you're better off. I say re-install because you might have a key-stroke recorder installed on your machine by the thief.

4) After your machine is cleanly installed, or from another clean machine, preferably using a land-line Internet (not wifi), change all your password. Absolutely all, because chances are that if they got your G account password, they have all the other ones too.

5) Now contact Google again. If it really doesn't work, you might need to open a new account.

Basically, you need to sterilize all your online work environment. Once you're hacked, you can safely assume they have access to pretty much everything.

[fearlessrick]

No to throw salt on an open wound, but has anyone at WebmasterWorld checked the author for veracity? This seems like an out-of-the-blue occurrence that happens to JUST ONE PUBLISHER, and all of a sudden it's front page news.

As a journalist, my first duty is to confirm that the condition actually exists as the OP says it does. I'd also try to contact Google's Adsense team before putting this on the front page.

Seems phishy to me.

[Eurydice]

FearlessRick: Check out my history of posting to WebmasterWorld. I'm posting about this because I'm totally frustrated with Adsense.

For months, I've been trying to get the Adsense team to fix this. They won't even reply. I've documented the code, the account ID number, the person in India, everything. Zero response.

I can't remove the person from my account. I want Google to fix this.

If you're a journalist, contact me. I'll give you screenshots.

[StoutFiles]

For months, I've been trying to get the Adsense team to fix this. They won't even reply. I've documented the code, the account ID number, the person in India, everything. Zero response.

The only way you can get this fixed is to get a real person on the phone with you. Google's email support is just about non-existent.

[coachm]

I was hacked via adwords a while back. I know it happens. However, it doesn't sound like we have the whole story. Too many inconsistencies here for a run of the mill hack.

Too many things would have had to go wrong to have this happen. The only way this could have occurred, IMHO, is if the entire google system was hacked into, not just the account. The claim of hundreds of millions of dollars missing at any time, makes this whole thing sound bogus to me.

[surfer67]

Do you see any other wifi networks from your house?

Heck, my phone records wifi networks as I drive down the street.

Not if his wifi network is security enabled(WPA).

[Rodeo]

Put the screen shots here. Why should you hide the information of an idiot?
If all this is 'really' real, I can help. I know few ppl at Google's (India) Hyderabad Office from where the checks are processed each month.

[MrHard]

I would just write it off. The possibility of Google responding in a caring manner or refunding money seems non-existent.