Why Your Google Business Profile Is a Target for Review and Listing Scams

Your Google Business Profile (GBP) is one of the most valuable tools your business has. It shows up when customers search your name, puts you on Google Maps, and showcases the reviews that convince strangers to trust you. But that visibility comes with a catch: scammers have noticed it too.

Google Business Profiles are increasingly being weaponized against the very businesses they're meant to help. From review extortion to full profile hijacking, the attacks are becoming more sophisticated, and the damage they cause goes far beyond a few bad ratings. Understanding what's out there and why your GBP is such an attractive target is the first step toward keeping it secure.

What makes your Google Business Profile so valuable to scammers?

To understand why these attacks happen, consider what a Google Business Profile actually contains: your contact information, your location, your operating hours, your customer reviews, and your accumulated search authority. It's years of reputation, compressed into a single listing that Google serves to thousands of people searching for exactly what you offer.

That makes it extraordinarily valuable, not just to you, but to anyone looking to exploit it.

A scammer who gains access to your GBP can:

• Redirect your phone calls to their own number and intercept your customers
• Change your address to a location they control
• Strip away your reviews or transfer them to a fraudulent listing
• Destroy your local search rankings by making unauthorized edits
• Impersonate your business to steal customers, payments, or personal data

And because most business owners aren't monitoring their profile in real time, these changes can go unnoticed for days or weeks.

The most common Google Business Profile scams

1. Review extortion: pay up or get buried in one-stars

Review extortion is one of the fastest-growing threats to local businesses on Google. The playbook is disturbingly simple.

First, you start receiving a flood of one-star and two-star reviews in a short period of time. The reviews often come from accounts with no history, no profile photos, or usernames that look auto-generated. The content may be vague, generic, or entirely nonsensical, reviews of a restaurant that mention dishes you don't serve, or reviews of a plumber that read like they were written about a hotel.

Then comes the message.

Via email, text, WhatsApp, Telegram, or social media, someone reaches out with a version of the same threat: "We will continue posting bad reviews unless you pay us." Demands typically range from a few hundred dollars to thousands, often requested in cryptocurrency or gift cards to avoid being traced.

If you ignore the threat, the fake reviews keep coming, sometimes escalating to multiple accounts posting coordinated attacks across different platforms.

Google has taken this seriously enough to create a dedicated Merchant Extortion Report Form, acknowledging that these scams are "a serious policy violation." The FTC's 2024 rule on deceptive reviews also introduced civil penalties of up to $51,744 per fake review for parties engaged in this kind of coordinated manipulation.

Why it works: Even a small drop in your Google star rating (from 4.5 to 4.2, for example) is measurable enough to reduce customer trust and impact how frequently your listing appears in Google's local pack. Scammers know this, and they exploit the pressure businesses feel to protect their ratings.

2. Profile hijacking: when scammers take the keys to your listing

Profile hijacking is arguably the most damaging GBP scam because it gives an attacker full control of your online presence on Google.

Here's how it works: Google allows business owners to request ownership or management access to a profile. When someone clicks "Claim this business," Google sends a verification request to the current owner. If you, or anyone at your company, approves that request without scrutinizing who sent it, you may have just handed a scammer the keys.

Once inside, they typically:

• Change the phone number, routing all inbound calls to themselves
• Alter the business address, redirecting customers to a fraudulent location
• Lock the original owner out by removing their access
• Use the hijacked profile, and its existing reviews, to run scam operations

The Better Business Bureau issued a formal scam alert in December 2024 warning business owners about this exact tactic, noting that locksmith scams in particular commonly exploit hijacked GBP listings to intercept emergency service calls.

Recovering a hijacked profile is possible but slow and frustrating. You'll need to go through Google's support process to reclaim ownership, and in the meantime, your customers may be interacting with the scammer under your name, and leaving reviews on your listing about it.

3. Fake "Google support" calls and phishing emails

Many GBP scams start with a single phone call or email that looks entirely official. A caller claims to be from "Google Business Support." They say your profile has a problem, it's at risk of being removed, it's missing verification, or there's been suspicious activity. They offer to help you fix it right away, and all they need is your login credentials or a payment to "restore" your account.

None of this comes from Google. Google does not cold-call business owners to sell GBP management services or demand payment for profile maintenance. Your Google Business Profile is always free to create and manage.

These phishing attempts prey on business owners who rely heavily on their GBP and feel genuine anxiety at the thought of losing it. The scammer creates urgency, poses as an authority, and capitalizes on that fear to extract either money or account access.

Signs a "Google support" communication is fake:

• It arrives by phone call (Google rarely contacts business owners this way)
• It asks for your Google account password
• It demands payment to keep your listing active
• The email comes from a domain that isn't @google.com
• It pressures you to act immediately without time to verify

4. Fake review management services

This one is a little different, it's a scam that presents itself as a solution.

After business owners experience a wave of fake negative reviews or hear about the problem, they sometimes turn to services that promise to remove bad reviews, generate positive ones, or "manage" their GBP reputation for a monthly fee. Many of these services are fraudulent.

Some will simply take your money and disappear. Others will actually generate fake positive reviews for your business, which, ironically, violates Google's policies and can result in your legitimate listing being suspended or penalized.

If a service promises to delete reviews that don't violate Google's policies or offers to "buy" reviews, it's a scam. Legitimate reputation management relies on encouraging real customers to leave honest feedback, not manufacturing it.

5. Listing spam and competitor sabotage

Not all GBP manipulation is about extortion. Some of it is straight-up competitive sabotage.

Unscrupulous competitors can file false "suggest an edit" reports on your listing, claiming your business is closed, that the phone number is wrong, or that the category is incorrect. Google relies partly on crowdsourced edits, and if multiple reports say the same thing, even falsely, it can trigger changes to your profile without your approval.

This kind of attack is harder to prove and harder to report, but it's a real risk in highly competitive local markets.

How to protect your Google Business Profile

Lock down access

Only give Google Business Profile access to people who absolutely need it. Regularly audit who has owner or manager-level access to your listing and remove anyone who no longer needs it. Treat your GBP credentials like you'd treat the keys to your store.

Whenever you receive an ownership request or manager invitation you don't recognize, reject it immediately and investigate how it was sent.

Enable two-factor authentication on your Google account

Your GBP is tied to your Google account, which means securing that account is the most important single step you can take. Enable two-factor authentication (2FA) so that even if a scammer gets hold of your password, they can't get in without access to your phone or authenticator app.

Monitor your listing regularly

Check your GBP at least once a week. Look for:

• Unauthorized edits to your name, address, phone number, or hours
• A spike in low-star reviews you don't recognize
• Changes to your category or business description
• New owners or managers you didn't add

Google will sometimes send email alerts about suggested edits, but these can be easy to miss in a busy inbox. Set a recurring reminder to log in and review your profile directly.

Respond to review attacks the right way

If you're hit with a wave of fake negative reviews:

1. Don't pay the scammer. Paying signals you're an easy target and guarantees nothing.
2. Document everything. Screenshot the fake reviews, all communications from the scammer, and reviewer profile details.
3. Report the extortion to Google using the Merchant Extortion Report Form.
4. Flag each fake review individually through your GBP dashboard as a policy violation.
5. Post calm, professional responses to the fake reviews so real customers can see you're aware of the situation.
6. Contact law enforcement. Review extortion is a crime. File a report with your local police and the FBI's Internet Crime Complaint Center (IC3).

Never pay for fake reviews or unverified "removal" services

If a service promises to remove reviews that don't violate Google's guidelines, it's lying. If it offers to post fake positive reviews to offset real or fake negatives, it puts your entire listing at risk of being suspended. Stick to encouraging genuine reviews from real customers through ethical outreach.

The broader threat: your business profile is part of your digital attack surface

What's easy to miss in all of this is that your Google Business Profile isn't an isolated asset. It's connected to your business email, your website, your payment channels, and your customer relationships. When scammers compromise a GBP, it's often a stepping stone to something bigger.

A hijacked listing that redirects phone calls can funnel customers to a fraudulent booking system. A phishing email that captures your Google credentials can open the door to your business Gmail, Drive files, and every other account tied to that Google login. Review extortion that targets one location can escalate to targeting every location a multi-site business operates.

This is why businesses of every size need layered digital protection that goes beyond password hygiene. Browser-based threats, phishing links shared in GBP messages, and credential theft are all part of the same ecosystem that puts your business at risk.

What Guardio can do

Guardio monitors for phishing sites, malicious links, and dangerous downloads in real time, whether you're browsing on your computer or your phone. These are the kind of threats that often arrive through exactly the channels scammers use to target GBP owners: email, direct messages, fake "Google support" pages, and fraudulent review management websites.

For small businesses, Guardio's Identity protection tracks whether your business email or credentials have appeared in known data breaches, giving you early warning before a compromised account turns into a hijacked listing.

The best defense against Google Business Profile scams isn't reactive. It's building security habits and tools that catch threats before they reach your front door.

Get a free security scan with Guardio today and stay protected from phishing and account takeover.

Quick reference: GBP scam red flags

What you seeWhat it likely isSudden flood of 1-star reviewsReview extortion setupMessage demanding money to remove reviewsReview extortionPhone call from "Google Support" offering to helpPhishing / impersonation scamEmail asking for your Google loginCredential phishingOwnership request you don't recognizeProfile hijacking attemptService promising to delete non-violating reviewsFake reputation management scamUnauthorized edits to your GBP listingListing spam / competitor sabotage

Conclusion

Your Google Business Profile is a business-critical asset that's publicly accessible, widely trusted, and, if left unmonitored, surprisingly easy to exploit. The scams targeting it aren't going away; if anything, they're becoming more organized and more aggressive.

The good news is that most of them follow predictable patterns, which means they're also predictable to defend against. Secure your Google account, audit your access, monitor your listing regularly, and know what to do the moment something looks off.

Your reputation took years to build. Don't let a scammer dismantle it in a week.

Get a free security scan with Guardio today and stay protected from phishing and account takeover.