Google Business Profile Hijacking & Verification Scam

Overview

Scammers target small business owners by hijacking their Google Business Profile listings through fake ownership claims, phony "verification" calls, and suspension threats designed to steal control of the listing or extract payment.

How It Works

Scammers exploit the fact that Google allows anyone to request ownership or manager access to a business listing by clicking "Claim this business." If a scammer sends that request and an employee approves it without checking who sent it, the attacker gains full control and can change the listed phone number to reroute customer calls to themselves, alter the business address to send customers to a fake location, and lock the real owner out entirely. A second version of the scam arrives as a phone call or email claiming to be from Google business support, saying the listing has a problem, is at risk of being removed, is missing verification, or has seen suspicious activity — the caller or sender then asks for login credentials or a payment to "restore" or "fix" the account, even though Google Business Profiles are free to create and maintain and Google never cold-calls business owners or demands payment for profile maintenance.

Red Flags

• An unsolicited ownership or manager-access request appears in your Google Business Profile dashboard from an account you don't recognize
• A caller or emailer claiming to be from Google says your listing has a problem, is at risk of removal, or is missing verification, and asks for your login credentials or payment to fix it
• Any request for payment to "verify," "restore," or maintain your free Google Business listing
• Pressure to act immediately without time to verify the request
• A communication claiming to be from Google that arrives by phone call or from an email domain that isn't @google.com

Real Examples

• Scammers submit a fraudulent ownership claim to a Google Business Profile; once an employee approves the request without checking who sent it, the attacker changes the listed phone number to route calls to themselves, alters the business address to redirect customers, and locks the original owner out entirely
• A caller claims to be from Google business support, saying the profile is at risk of being removed or is missing verification, and asks for login credentials or a payment to restore the account

Where It Spreads

How to Protect Yourself

• Regularly audit who has owner or manager-level access to your Google Business Profile and remove anyone who no longer needs it
• Reject any ownership or manager request you don't recognize immediately and investigate how it was sent, rather than approving it without scrutiny
• Remember Google Business Profiles are always free to create and manage; never pay a fee to verify, restore, or maintain a listing
• Google does not cold-call business owners about their listing, so treat any such call as suspicious and manage your listing by logging in directly at business.google.com
• Enable two-factor authentication on the Google account tied to your business listing

Related Scams