An ad-account takeover: the budget leaves while the site is still yours
The ads change overnight. The site opens as usual. Money is spent on someone else's page, and you notice it on the bill, not on storefront monitoring.
An ad account is tied to the site more tightly than it looks. It holds the domain, the pixel, audiences and the card. The sign-in is often the same as mail, or it is saved in the browser of whoever "just tops up the balance". A stranger changes the ad and the link. The company site stays up, the forms work, and a person watching the page sees nothing.
What limits the damage
- A separate password and a second factor. Access through an employee mailbox without a second factor is already a weak spot.
- A card with a limit, not the company's main card with no ceiling.
- Two people who can see the account. One person on leave should not mean silence for a week.
- The pixel and tags on the site should not receive extra lead fields.
If the account is already taken, spend is stopped and access is recovered first, then you look at whether mail and the site went with it. Checking "all the ads" yourself without changing the sign-in leaves the attacker a session.
Lexora includes ad accounts in the access review together with the site. That is part of an audit, not a separate kind of magic. If charges are already running, we work it as an incident. Site monitoring does not replace this: it watches your domains from the contract, not someone else's creative in the ad account. The basic audit is free for new clients.
Related Lexora services
Did the ads change without you?
Stop the budget and write to us. We will look at the account, mail and whether the site left with them.