TL;DR:

  • Google Business Profile (GBP) hijacking lets attackers change your phone number, address, hours, or website — redirecting your customers to themselves while your listing looks legitimate
  • The most common attack vector is submitting an “ownership request” claiming your business is unmanaged — Google’s verification process can be spoofed or exploited via postcard, phone, or email methods
  • Defence is straightforward: claim your own profile if you haven’t already, enable two-factor authentication on your Google account, and set up email alerts for any profile changes

Your Google Business Profile is, for many customers, the first thing they see when they search your business name. It shows your phone number, address, hours, website, and reviews. For many small businesses, it drives more customer calls than the website itself.

It’s also more vulnerable than most owners realise.

Google Business Profile hijacking — where an attacker takes over control of a legitimate business’s listing — has become a meaningful fraud vector. The goal is usually one of three things: stealing customer calls by redirecting the phone number, sending customers to a competitor or fraudulent website, or holding the profile hostage and demanding payment to restore access.

How hijacking happens

Google’s system for managing business profiles has a structural challenge: Google needs a way for businesses to claim listings they don’t currently manage, because a lot of legitimate businesses have unclaimed or incorrectly listed profiles. The mechanism for this — the “request access” or “claim this business” flow — is also the mechanism attackers use.

Ownership requests on unmanaged listings: If your business appears in Google Maps but you’ve never claimed it, it’s an unmanaged listing. Anyone can submit an ownership request. Google sends a verification challenge — typically a postcard to the business address, a phone call to the listed number, or an email to a domain-matched address. A postcard request can be intercepted by someone with physical access to your premises; a phone call can be routed to an attacker if they’ve already changed your number in Google’s system; email verification is only as secure as the email account.

Editing a claimed but poorly secured profile: If your Google account managing the profile has a weak password, no two-factor authentication, or uses an email address you don’t actively monitor, an attacker who compromises the account can make changes immediately. Phone number swaps and website URL changes take effect quickly and don’t require Google to re-verify anything.

Fraudulent “support” contacts: A variant targeting small business owners directly — someone calls claiming to be Google support and offers to “fix” a problem with the listing, requesting login credentials or verification codes during the call. Google does not call businesses proactively about profile issues.

Profile edit suggestions: Google allows anyone to suggest edits to a business listing. Most suggestions go through a review process, but some categories of edit have historically been approved quickly and with limited scrutiny. Attackers have exploited this to change categories, add fake attributes, or modify business descriptions in ways that damage reputation.

What attackers do once they have access

A redirected phone number is the most immediately harmful change. Your customers call what they think is your plumbing company, speak to someone claiming to be you, and get directed elsewhere — potentially to a competitor, a fraudulent service provider who takes payment and doesn’t show up, or a scam operation collecting deposits. The attacker captures your leads while you have no idea it’s happening.

Website URL changes redirect searchers who click your listing to a site the attacker controls. If your business does any e-commerce or appointment booking, this is a direct revenue theft mechanism. It can also be used to serve malware to visitors who think they’re visiting your legitimate site.

Changing your hours or address causes customer frustration and operational disruption. This is sometimes used as a pressure tactic — “your listing will continue to show incorrect information unless you pay.”

In all cases, the listing still shows your business name and reviews. From a customer’s perspective, everything looks legitimate.

Immediate steps to protect your profile

Claim your profile if you haven’t already: Go to business.google.com and claim your listing through the official Google process. An owned and managed profile is harder to hijack than an unmanaged one — the attacker has to go through the “request access” flow and displace an existing owner, which triggers notifications.

Enable two-factor authentication on your managing Google account: This is the single most effective defence. Go to myaccount.google.com > Security > 2-Step Verification and use an authenticator app (not just SMS) as the second factor. An attacker who gets your password still can’t log in without the second factor.

Set up Google Business Profile notifications: In your GBP dashboard, go to Settings > Notifications and enable email alerts for profile changes, ownership transfer requests, and customer actions. You’ll get an email if anyone changes your phone number, website, or address — giving you an alert you can act on.

Review who has manager access: In GBP, go to Settings > Managers and review the list. Remove any accounts you don’t recognise or that belong to former employees. Keep the minimum number of managers needed to operate the profile.

Use a Google account with a domain email you control: Manage your GBP from a Google Workspace account tied to your business domain rather than a personal Gmail address. This reduces the risk of account recovery exploits and makes it clearer to Google that you’re the legitimate business owner.

If your profile has been compromised

If you discover your profile has been changed without your authorisation, or you’ve lost access:

Document everything immediately: Take screenshots of the current (incorrect) state, note the timestamps, and record what was changed.

Report through Google’s official channels: Use the “Report a problem” link on your Google Maps listing, or contact Google support through business.google.com/support. Select “I’ve lost access to my business profile” or “My business profile has been hijacked.” Be specific about what changed and when.

Contact your Google Workspace admin if applicable: If your account is through Google Workspace, your admin can assist with account recovery.

Alert customers proactively: If your phone number was changed and you know customers may have been misdirected, use your website, social media, and any customer contact lists to notify them of the correct contact information. Be explicit: “Our phone number was temporarily changed without our authorisation. The correct number is…”

Recovery can take days to weeks, depending on how Google responds to the report. Having documentation of ownership — business registration, utility bills showing your address, bank statements in the business name — accelerates the process.

The broader online presence picture

GBP is the most valuable and most targeted business listing, but it’s not the only one. Yelp, Apple Maps, Bing Places, and industry directories all have profile management systems that can be exploited similarly. A business that locks down its GBP but leaves Yelp unclaimed and Apple Maps unverified still has exposure.

The same principles apply across all platforms: claim the listing, use a secure managed account, enable notifications for changes, and review manager access periodically.

Your online business presence is infrastructure. Treat it like the asset it is.