TL;DR:
- Scammers can claim or edit your Google Business Profile, redirect your phone number to theirs, and intercept customer enquiries — often without you noticing for weeks.
- Two-factor authentication on your Google Account and regular checks on your Business Profile are the core defences.
- Google has an appeals process to recover a hijacked listing, but it can take days or weeks — prevention is far easier than recovery.
Your Google Business Profile is often the first thing customers see when they search for your business. It shows your phone number, opening hours, address, reviews, and a direct link to your website. It’s also a surprisingly common target for scammers, who exploit Google’s verification processes to redirect that customer traffic to themselves.
How Google Business Profile Hijacking Works
There are two main attack methods:
Fraudulent ownership claims. Anyone can search for an unclaimed or inadequately secured Google Business listing and click “Claim this business.” If the original owner hasn’t verified the listing or hasn’t set up Google’s security properly, the scammer can gain ownership through Google’s standard verification process — which for some businesses can be completed with a postcard, a phone call, or an email.
Suggested edits. This is more subtle and affects businesses that do have verified listings. Google allows members of the public to suggest edits to any Business Profile — changes to opening hours, phone numbers, websites, or even the business address. Google often auto-publishes these changes without notifying the business owner, or sends a notification to an email address the owner doesn’t monitor. Scammers use this to swap your phone number for a premium-rate number they control, or to edit your website URL to a phishing site.
The consequences range from mildly annoying (wrong opening hours causing customer complaints) to seriously damaging (customers calling a scammer who impersonates your business, collects payment, and never delivers).
Signs Your Profile Has Been Compromised
- Customers report calling your number and reaching someone else or getting an automated message
- Your phone number, address, or website has changed without your knowledge
- New reviews that you don’t recognise and can’t connect to real customers
- New photos that you didn’t upload
- You receive a Google notification about a suggested edit you didn’t make
- Your listing appears suspended or shows “Permanently closed”
Checking Your Profile Right Now
Search for your business name on Google. Look at the Knowledge Panel that appears on the right side of the search results. Check:
- Phone number — does it match what you know to be correct?
- Website URL — does it go to your actual website?
- Opening hours — are they accurate?
- Address — is it correct, especially if you’ve moved recently?
- Ownership — go to business.google.com and check which Google Account is listed as the primary owner.
If any of these look wrong and you didn’t change them, your profile has been edited — either by a scammer or by a well-meaning member of the public who put incorrect information.
Locking Down Your Google Business Profile
Step 1: Claim and verify your listing if you haven’t already. Go to business.google.com, search for your business, and click “Manage now.” Google will ask you to verify ownership via postcard, phone, email, or video recording. Complete this — a verified listing is harder to hijack than an unverified one.
Step 2: Enable two-factor authentication on your Google Account. The Google Account that manages your Business Profile is the key to your listing. If a scammer compromises that account, they have full control. Go to myaccount.google.com → Security → 2-Step Verification and turn it on. Use an authenticator app (Google Authenticator, Authy) rather than SMS if possible — SIM swapping can bypass SMS-based 2FA.
Step 3: Regularly check for suggested edits. Google notifies you via email when edits are suggested or approved. Check that the email address on your Google Account is one you monitor. In the Business Profile manager, check the “Edits” section to see any recent changes and whether they’re accurate.
Step 4: Turn off auto-apply for edits. In your Business Profile settings, you can control whether Google automatically applies suggested edits from the public or holds them for your approval. This setting has changed location in Google’s UI over the years — look for “Manage info” or “Business settings” in the profile dashboard.
Step 5: Add a secondary owner or manager. If you have a trusted employee or agency managing your Google Business Profile, add them as a Manager (not Owner) through the Business Profile dashboard. This means control isn’t lost if your primary account has a problem. Only add people you fully trust — Managers can edit listing information.
If Your Profile Has Already Been Hijacked
If someone has edited your information: Log into business.google.com, go to your profile, and manually correct any wrong information. If the edits keep returning, it suggests ongoing access — check your Google Account security immediately.
If someone has claimed ownership: Go to business.google.com and search for your listing. If you’re not shown as the owner, click “Request access.” You’ll be asked to verify that you are the legitimate business owner, typically by confirming your address. The fraudulent owner gets notified of your request and has three days to respond. If they don’t, Google typically transfers ownership to you.
If ownership transfer doesn’t work: Use the Google Business Profile Help Community (support.google.com/business) to escalate. Select “An issue with a competitor or another listing” → “Someone else is managing my listing.” Google has a review process for contested listings, but it can take several days to two weeks and may require you to provide evidence of your business’s legitimacy (Companies House registration, utility bills, photos of your premises).
If your listing is suspended: Suspensions are common when Google detects unusual activity on a listing (including legitimate businesses caught in automated filters). The reinstatement request process is in your Business Profile dashboard under “Get reinstated.” Include clear photos of your business premises, signage, and proof of address.
Ongoing Monitoring
Set up a Google Alert for your business name so you’re notified when it appears in new web content — this can catch fake review sites or scam pages using your name. Review your Google Business Profile at least monthly: open hours, phone number, website, and recent reviews. Three minutes of checking every month is far less painful than discovering a three-week scam campaign after the fact.
For businesses that rely heavily on local search traffic — tradespeople, restaurants, solicitors, accountants, clinics — your Google Business Profile is worth treating with the same security attention as your website or email account.