Google Business Profile SecurityGoogle Maps Scams for Small Businesses: Warning Signs, Examples, and FixesFake calls, review extortion, profile hijacking, and phishing attacks target small businesses every day. Here is what the scams look like, why they work on smart owners, and exactly what to do when one reaches your phone or inbox. |
330K+ Business impersonation scam reports filed with the FTC in a single year | $1.1B Reported losses to impersonation scams in a single year, per FTC data | Free Google Business Profile has no monthly fee, renewal cost, or verification charge | 4B+ Robocalls received by U.S. consumers per month, per FCC data |
The Problem Why Your Google Listing Is a TargetA plumber, electrician, roofer, or handyman who gets most leads through Google Maps cannot afford to have that listing altered, suspended, or stolen. Scammers know this. It hits harder when growing a contsruction business from a ground depends on map calls. They use that fear to push fast decisions, collect payment, and capture account access before the business owner realizes what happened. The scams range from robocalls threatening suspension to organized review attacks paired with extortion demands. Some target the phone. Others target the inbox. A few go directly after the listing itself through ownership request abuse. All of them are designed to make you act before you think. The FTC confirmed that business impersonation scams topped $1.1 billion in reported losses in a recent year, more than three times the reported losses from three years prior. The number of complaints has grown sharply, and fake “Google listing” calls are among the most commonly reported business impersonation categories. The single most protective rule: Never act on any contact that reaches you from the outside. Always verify inside your own Google Business Profile dashboard and official Google account. If the dashboard shows no problem, there is no problem. Google My Business vs. Google Business Profile: Same Thing, Different NameGoogle renamed “Google My Business” to “Google Business Profile” in 2022. Both names refer to the same free local listing product. Scammers frequently use the old name because it remains widely recognized. When you see “Google My Business scam” or “Google Business Profile scam,” they describe the same category of fraud targeting the same listing system. |
The Most Confusing Question Does Google Actually Call Businesses?Many business owners get told simply to “hang up on any Google call.” That rule is incomplete. Google does make outgoing calls to businesses in certain situations. Understanding the difference between those calls and a scam is what protects you. According to Google’s own documentation, legitimate outgoing calls from Google may cover confirming listed phone numbers and business info accuracy, mapping phone trees to ensure calls route correctly, confirming price and availability, scheduling reservations or appointments on behalf of Google users, and verifying business hours or service availability. These calls identify themselves as being from Google at the start. They come from designated numbers.
On 650-253-2000: This number is associated with Google’s Mountain View, California headquarters and has been documented by local SEO professionals as a number used in Google’s outgoing verification calls to businesses. If you call it back, you reach an automated system rather than a live person. However, caller ID spoofing makes any number easy to fake, so the presence of a 650 area code does not confirm the call is legitimate. The content of the call matters more than the caller ID. |
This is a real problem. The FTC sued operators behind robocalls. The calls told small businesses they could be removed from Google search results and then sold paid “verification” or ranking services. Google also has a dedicated help page that warns businesses about fraudulent calls. The company states it makes sales calls only after direct contact and uses no automated system. For review attacks, Google now has a specific Merchant Extortion reporting path.
This path applies when fake low-star reviews appear in large numbers and someone demands money, goods, or services. Those documented examples match the red flags covered in this guide. These include pressure, fake authority, payment demands, and requests that push you to act outside your own account.
Know Each Attack Type The Main Google Business Profile Scam TypesThese are not all the same scam with a different script. Each one targets a different fear and extracts a different thing from the business. Scam Type 1 Fake Verification Calls and Suspension ThreatsA robocall or live caller claims your listing is “not verified,” “about to be suspended,” or “not showing up on Google Maps.” The caller pushes you to press a button, call back a number, or pay a fee to resolve it. The FTC took direct legal action against robocallers making these exact claims, documenting operations that falsely threatened businesses with removal from Google while collecting fees. A verified listing cannot be removed by a phone caller. Typical Script Pattern “Hi, this is Justin from the Business Help Center. We’re having an urgent issue with your Google Business listing and would like to get this fixed before the end of the day so it doesn’t disrupt services. Please call us at 877-XXX-XXXX before 5 PM Eastern today.” What makes this work: Service businesses depend on Maps for calls. The fear of losing visibility is real. Fake urgency prevents calm verification. Scam Type 2 The “Keyword Issue” RobocallThe caller claims your listing has a problem with its “keywords.” Google Business Profile has no keyword field. It contains your business name, category, description, services, photos, reviews, and posts. No keyword configuration exists that a third-party caller can access or fix. This scam targets business owners familiar with SEO concepts. “Keywords” sounds real, which creates enough doubt to keep someone on the line. The goal is to collect payment for a service that does not exist. Red flag: Any caller who claims to have identified a “keyword problem” in your Google Business Profile is fabricating the issue. Hang up without pressing any buttons. Scam Type 3 Ownership Requests and Profile HijackingThis scam targets the profile itself rather than the owner’s wallet. Google’s system includes a legitimate ownership request feature. Scammers exploit this workflow by sending ownership requests to businesses, often framed as maintenance or account security updates. When a staff member approves such a request without verifying the source, the scammer gains owner access. Once inside, they can change the listed phone number to redirect calls, edit the website URL to send traffic elsewhere, or lock the original owner out entirely. One local marketing agency reported rejecting ten or more suspicious ownership requests per week across a portfolio of roughly 50 profiles. The core danger of phone number changes: A scammer who changes your listed phone number can sell those leads to competitors, charge callback fees, or redirect Google-generated call traffic to another business in your category. Scam Type 4 Review ExtortionThis scam starts with a sudden coordinated wave of one-star or two-star reviews. The reviewers often have no profile photos, similar writing patterns, and no prior history of reviewing local businesses. Within hours or days, you receive a message through WhatsApp, email, or social media from someone who claims they can remove those reviews for a price. Google has formally acknowledged this as a scam pattern and released a dedicated Merchant Extortion Report Form specifically for these cases. According to local SEO professionals who have worked through this process, reviews submitted through the Merchant Extortion form are typically investigated and removed within a few business days when confirmed as coordinated attacks. Do not pay. Do not respond to the demand. Payment encourages repeat attacks and does not guarantee removal. Document everything, submit the Merchant Extortion form, and let Google investigate. Scam Type 5 Phishing Emails and Fake Google Login PagesPhishing emails targeting Google accounts replicate Google’s visual design and claim your profile has a policy violation or an action requiring your login. The link points to a fake login page designed to capture your credentials. Once the attacker has those credentials, they can access your Business Profile, Gmail, and any other Google service connected to that account. The key check: look past the visual design to the actual sender domain. Real Google communications come from addresses ending in @google.com. Before clicking any link in an email about your profile, open a fresh browser tab and go directly to business.google.com to check your listing status. While scammers can spoof display names, they rarely pass a “Sender Address” check. Legitimate, system-generated notifications about your profile, such as ownership requests, suspension notices, or verification updates, will almost always come from these two addresses: 1. google-my-business-noreply@google.com If you receive an email from a generic service like @gmail.com, @outlook.com, or a domain that looks close but is slightly off (e.g., @google-support.net), it is a phishing attempt. Delete it immediately without clicking “View Profile.” Scam Type 6 Verification Code RequestsA caller explains they need to “re-verify” your listing and asks you to read back a confirmation code they say Google just sent. That code is a one-time password generated because someone is attempting to access your Google account. Reading it to the caller transfers control of your profile to the scammer. Google’s own guidance is explicit: no legitimate Google representative will ever ask for a one-time password, PIN, or verification code. Scam Type 7 Remote Access RequestsA caller claims they can fix your listing issue but needs to “access your computer” to do so. They direct you to download software like AnyDesk or TeamViewer. Once connected, the scammer can access credentials stored in your browser, capture your Google account password, or install monitoring software. No Google representative will ever ask you to install software or grant screen access to resolve a Business Profile issue. Scam Type 8 Fake Invoices and Listing “Renewal” ChargesSome scams arrive as mailed invoices or emailed billing notices claiming the business owes a fee for listing maintenance, annual verification, ranking placement, or compliance with new Google policies. These are fabricated. Creating and maintaining a Google Business Profile is free. Google does not charge to keep a listing active, to appear in Maps results, or to pass any verification requirement. |
Quick Reference 15 Red Flags That Tell You It’s a ScamAny single item below warrants ending the contact. Multiple items confirm it.
|
Understanding the Attack Why These Scams Work on Business Owners Who Are Not Naive
Why Home Service Businesses Get Targeted FirstContractors, plumbers, electricians, roofers, painters, and handymen share a set of characteristics that make them a higher-priority target than a restaurant or retail store. Service-area businesses often lack a storefront to anchor trust. Their profile is their primary digital presence. For many teams, digital marketing for contractors starts with keeping the GBP accurate and secure. They take calls on the road, at job sites, or through staff who have limited time to verify incoming claims. Reviews carry exceptional weight because customers cannot walk in before booking. A roofer who loses a week of inbound calls during peak season does not just lose revenue. The lost calls may represent storm-season work that was never recoverable. That operating context is exactly what scammers count on when they say “your listing will be removed by the end of the day.” |
What to Do Response Plans for Every ScenarioWhen You Receive a Suspicious Call, Text, or Email1 Stop all engagement immediatelyDo not press buttons, click links, or engage with a live caller beyond ending the contact. Pressing buttons on robocalls signals your number is active and leads to more calls. 2 Take screenshots and save voicemailsCapture the caller ID, call time, and message content. For emails, screenshot the full message including the sender address. 3 Check your actual Google Business ProfileOpen a browser, go to business.google.com, and log in directly. If your dashboard shows no suspension, no policy violation, and no issues, the caller’s claim was fabricated. 4 Alert your teamTell whoever answers your phones about the contact. This prevents a follow-up call from reaching staff and getting a different outcome. If You Already PaidContact your bank or card issuer immediately and report the transaction as fraud. Collect all documentation: the invoice, payment method, emails, and transaction record. File a complaint at ReportFraud.ftc.gov. Change your Google account password and review active sessions. Check your Business Profile for any unauthorized changes. If You Shared a Verification CodeGo to myaccount.google.com and change your password immediately. Check “Security” then “Your devices” for any unrecognized device with active access. Open “People and access” in your Business Profile and remove any accounts you did not add. Turn on 2-Step Verification if not already active. If Your Profile Was Hijacked1 Secure your Google account firstReset your password and review active sessions before anything else. If the attacker still has your credentials, any profile recovery can be reversed. 2 Document all visible changesScreenshot the current profile: name, phone, website, address, category, hours, and the People and access list. This record supports Google’s investigation. 3 Submit an ownership request through official Google channelsGo to the Business Profile listing on Google Maps, select “Own this business?”, and follow the official ownership request process. Do not pay any third party who offers to “rush” this. 4 Alert customers if contact info was alteredIf your listed phone number or website was changed, post a notice on your other channels with the correct contact information while the profile is being recovered. How long recovery takes: Google states that verification reviews can take up to five business days. Anyone selling “instant reinstatement” or “guaranteed 24-hour recovery” for a fee is running a second scam on top of the first. |
Review Extortion Protocol How to Handle a Fake Review Attack Without Making It WorseWhen a wave of one-star reviews appears overnight from accounts you do not recognize, the instinct to respond immediately is understandable. Most of those instincts lead to the wrong actions.
|
Prevention How to Secure Your Listing Before a Problem StartsMost profile security measures take less than 30 minutes to set up and close the most common entry points for profile hijacking. The Main Weak Points Scammers ExploitMost Google Business Profile scams enter listings through account control mistakes rather than technical flaws. These scams enter through account control mistakes. The main entry points include a shared or compromised Google account, an ownership or manager request approved without verification, a one-time code read aloud to a caller, former staff or vendors who still have access, and phishing pages that capture login details for the Google account tied to the profile. Google’s help materials show that Business Profiles depend on owner and manager permissions, ownership requests, and the security of the connected Google account. Protect your listing by locking down access first, then verify every request inside the account you already control.
Monthly Listing Audit: Ten Minutes, Eight Checks
|
Staff Protection Training the Person Who Actually Answers the PhoneOwners are often in the field when these calls arrive. The person at the desk needs a clear protocol they can follow without asking the owner for guidance on each call. Staff Scam Call Protocol
A Response Your Staff Can Use Every TimeStaff Script for Suspected Scam Calls “We do not make account changes or verify anything by phone. Please send any notice through our Google account or contact us by email. Thank you.” End the call after this. If the issue is real, it will appear in the Business Profile dashboard. |
Taking Action Where and How to Report Google Business Profile Scams
|
Common Questions Frequently Asked QuestionsDoes Google charge to keep a Business Profile active?No. Creating, claiming, verifying, and maintaining a Google Business Profile is free. There is no annual fee, renewal charge, or maintenance cost. Any caller or invoice claiming otherwise is running a scam. Google Ads are a separate, optional paid product that has no bearing on whether your listing stays active. Does Google call businesses about their profile?Google does make outgoing calls to businesses in limited situations, including confirming hours, mapping phone trees, and verifying listing accuracy. These calls identify themselves as coming from Google at the start and come from designated number ranges including the 650-203-0000 series. The key distinction: no legitimate Google call requests payment, a one-time code, or urgent account action. Any call making those requests is a scam regardless of what the caller ID shows. What should I do if I pressed 1 on a robocall?Pressing 1 signals your number is active and typically results in more calls, not fewer. If you were transferred to a live agent but provided no payment or information, your main risk is more follow-up contacts. Block the number, save the details, and report the call to the FTC at ReportFraud.ftc.gov. What is review extortion and how do I report it?Review extortion is when someone floods your profile with fake negative reviews and then contacts you demanding payment to remove them. Google has a dedicated Merchant Extortion Report Form for this situation. Search “merchant extortion” in Google Business Profile Help while logged in. Do not pay or respond to the demand. Confirmed extortion cases submitted through this form have resulted in review removal within a few business days. Can someone steal my Google Business Profile?Yes, through phishing that captures your Google account credentials, or through ownership request approval where someone on your team approves a manager request from an account they assume is legitimate. Both are preventable through 2-Step Verification, controlled access to the profile, and a team policy requiring owner confirmation before approving any access requests. What is the first security step to take today?Log into your Google account and open your Business Profile settings. Check “People and access” and confirm the primary owner is an account you control. Remove any accounts you do not recognize. Then go to myaccount.google.com, navigate to Security, and turn on 2-Step Verification if not already active. These two actions take less than 15 minutes and close the most common entry points for profile hijacking. Can I report a scam call even if I lost no money?Yes. The FTC uses complaint patterns to identify the operations behind scam campaigns. File at ReportFraud.ftc.gov with the number, call time, and the content of what was said. For calls involving robocall technology, also report to the FCC at consumercomplaints.fcc.gov . Is my home-based or service-area business more at risk?Service-area businesses face specific vulnerabilities. Their address may be hidden on Maps, calls go to a cell phone rather than a staffed front desk, and verification processes for service-area listings can involve more back-and-forth with Google. The highest-impact change is confirming who has primary owner access to the Google account the profile is connected to. |
The Bottom Line The Pattern Behind Almost Every Google Listing ScamEvery scam described in this article follows the same structure. It uses Google’s name to establish credibility. It creates urgency to prevent verification. It targets a fear the business owner legitimately has. Then it asks for payment, credentials, a code, or access before the owner has time to think. The counter to all of it is a single habit: never take action from the incoming contact itself. A call, text, or email about your listing is not the place to verify whether a problem is real. Unlike most small business websites, a Google Business Profile can be hijacked through a single phone call. The dashboard at business.google.com is. If you log in and the profile shows no issue, there is no issue. If there is a real issue, you will see it there and address it through official Google support without paying anyone or sharing any credential. Train whoever answers your phones on this same rule. The scam works only when someone acts inside the scammer’s channel. Move every response into your own official account first, and the attack collapses before it does any damage. One rule that covers every scenario: Never act from the incoming contact. Always verify inside your own Google account first. If the dashboard shows no problem, hang up, delete the email, and report the contact to the FTC. |
Still haven’t found what you need? We’ve got you covered. Head over to our Contractor Resources for more tips and tools.
Protect Your ListingWant Help Securing and Managing Your Google Business Profile?Digital Media Group handles local SEO and Google Business Profile management for contractors and home service businesses. You stay primary owner. We handle the details. Talk to Our Team |