The Pretoria Scenario: Locked Out of the Account That Owns the Campaign
Picture a lean in-house marketing team in Pretoria running about R80,000 a month across Search, Shopping and Performance Max. This is an illustrative scenario, not a real client. Their single company Google account is the sole admin on the Google Ads account and the GA4 property, registered years ago against a personal recovery email and a prepaid SIM that has since been recycled. One Monday nobody can sign in. The ad account keeps spending, nobody can pause it, and conversion data feeding bid strategies starts to drift.
This playbook is a decision tree for which recovery route fits your lockout, what breaks it in a South African context, and how to confirm spend and attribution survived.
Google offers no paid or premium recovery tier and no route with a guaranteed outcome. Every method below helps you prove ownership, not override it.
Recovery Is Not One Flow: The Five Routes Google Actually Offers
- Self-service password recovery via recovery email, recovery phone, or a device already signed in.
- "Try another way" to switch verification methods when the default prompt fails.
- The Account Recovery form when no standard method works, asking about recent passwords, creation date, devices and recovery contacts.
- Recovery options configured in advance, which only help if current.
- 2SV backup methods: backup codes, backup security key, device prompts or an Authenticator app.
Two further routes matter for businesses: Workspace admin-assisted recovery, where a super admin resets a user password; and Google Ads access reinstatement, where an existing ad account admin grants entry even if your Google account is blocked.
Which Recovery Route Fits Your Lockout? A Decision Table
| Lockout scenario | Recommended route | What breaks it | Realistic effort |
|---|---|---|---|
| Forgotten password, recovery phone/email active | Self-service reset or "Try another way" | Recycled prepaid SIM; dead recovery inbox | Minutes |
| 2SV prompt on a phone you no longer have | Backup codes or backup security key | Codes never exported to the team | Minutes to hours |
| Former employee held all recovery details | Account Recovery form | Weak answers on device history and old passwords | Days, limited attempts |
| Workspace user locked out, admin available | Super admin password reset | Admin unknown or also locked out | Same day |
| Ads access lost but Google account works | Existing Ads admin reinvites you; Ads support | You are the only admin | Hours |
Scenario Guide: What Each Method Is Good For and What Breaks It
Self-service reset is fastest and least forensic, working when recovery details still belong to the business and failing when they live on a personal handset or ex-staffer's inbox. The Account Recovery form is deepest and most fragile: Google weighs recent passwords, dates, devices and contacts, and repeated misfires weaken your signal. 2SV backups only exist if stored centrally. Workspace admin recovery bypasses the consumer flow but rests on someone holding the super admin role. Ads-side reinstatement is your lifeline when the ad account is fine and only your sign-in is dead.
Consumer Account vs Google Workspace: Why the Route Changes Entirely
A free Gmail-based account puts the burden on individual recovery details. A Workspace account on a .co.za domain brings governance: a super admin can reset without the user's old device. If the admin account itself is lost, a domain-verification-based Workspace admin recovery applies, which is why domain records must be owned by the business, not a departed web developer. Limiting this risk starts with good setup; our strategy consulting work routinely starts with who actually controls the domain.
When Google Ads Access Is Lost but the Google Account Is Intact
This is the more common, less painful lockout: your sign-in works but you are no longer listed on the Google Ads account. An existing admin can reinstate you; Google Ads support can assist if nobody retains admin rights. The same principle applies to Google Business Profile, where recovery hinges on re-proving verification of the listing. If no admin survives on the ad account, expect a slower process built around billing and business verification.
South African Realities That Sink Standard Recovery Attempts
Three realities repeatedly derail recovery here. First, recycled prepaid SIMs and SIM swap mean the recovery number registered years ago may now reach a stranger. Second, recovery email and phone details are often held on a former employee's personal device, so the business cannot authenticate. Third, many South African SMEs run Google Ads under a free personal account rather than a Workspace domain, collapsing governance into one individual. POPIA is a useful nudge to keep recovery evidence and handover records tidy, but the practical lesson is simpler: recovery details must belong to the business.
If your recovery phone is a prepaid SIM, treat any unexplained loss of signal or SIM swap as a security event. Verify with your network provider before assuming the account itself is the problem.
The Account Recovery Form: What Signals Google Asks For and How to Prepare
The form rewards accurate recall, so gather evidence before you start. Google weighs recent passwords, approximate creation date, devices and browsers previously used, and known recovery contacts. Answer from memory and records; do not spray attempts. Keep a written trail of each submission so you do not repeat wrong answers:
Account / property: ads-account-za@exampleRoute attempted: Account Recovery formDate/time submitted: 2026-03-04 09:15 SASTEvidence attached: prior password list, device history, billing refOutcome: pending / rejected / restoredOwner notified: marketing lead, financeWhat 'Recovered' Should Mean: Reconciling Spend, Attribution and Tracking
Logging in is the halfway point. A genuinely recovered account means access restored, tracking and attribution intact, and spend and data reconciled. During the outage, bid strategies may have chased conversions that no longer fired, and consent mode signals may have changed. Verify each layer before trusting the numbers again.
| Check after access returns | What to confirm | Risk if skipped |
|---|---|---|
| Ads conversion actions | Still firing and tagged primary | Bidding optimises toward nothing |
| GA4 links | Property and Ads still connected | Attribution gap in reporting |
| Consent mode | Signals unchanged after the outage | Over- or under-counted conversions |
| Server-side tagging | Container still receiving hits | Reliance on browser-only data |
| Billing and budget | Spend reconciled for outage window | Budget wasted unmonitored |
This reconciliation is the honest definition of recovery, and where most teams under-invest. Our custom reporting approach treats attribution accuracy as the finish line, not the login screen.
After Access Returns: Hardening Without Repeating the Security Checklist
Once access is back, hand recovery email and phone to business-controlled details, keep at least two Ads admins who are not the same person, store backup codes centrally, and record who owns the domain. Security hardening, 2SV setup and permission audits are covered in depth elsewhere in our series.
Treat recovery as a system: business-owned recovery details, two independent admins, centralised backup codes, and a written post-recovery checklist. That turns a one-off scramble into a repeatable capability.
