I’ve found myself unwittingly transformed into something of a watchdog – as my number of active clients has grown I’ve become more acutely aware of the staggering number of scams that target small businesses and nonprofits on a daily basis.
This case is a trickier example because rather than a really obvious phishing E-mail riddled with typos, these scams have the trappings of legitimacy – because they technically are. In this case, I’ve progressively gotten more E-mails that look like this:
I’ll start off with the short version for the uninitiated: These are obviously not valid requests, but you should actively respond and decline their requests.
This is a “legitimate” request in the sense that it comes from Google Business Profiles – the listings tailored to local businesses separate from organic results in Google where you see business hours, reviews, screenshots, and general information.
If you receive an E-mail like this, that means that you have ownership of your Google business listing. This is the system working as intended – the ability to control and display the information on your Google business profile should specifically administered by the business owner or a trusted associate. In my case, many clients delegate running Google Business profiles to me.
That being said, sometimes there’s an issue where the owner or designated person in charge doesn’t have administrative access to the Google Business listing. This can happen for a myriad of reasons: The owner of the Google Business profile left and didn’t transfer administrative access over, an agency set up the Google Business profile but is no longer working with the business itself, or in extreme cases the administrator is somehow incapacitated.
As a remedy to this Google allows individuals to file requests for ownership. This is a simple form that allows somebody to claim they should be granted ownership of a Google listing by filling out a name, contact information, and relationship to the business. If the E-mail on record for ownership doesn’t respond within three days, the person filling out the form can validate their association with the business through a phone verification.
On its own this is an extremely effective way to regain access to a Google business listing with minimal hassle, especially compared to Facebook pages. Facebook, bizarrely, has no account retrieval process of any kind, meaning if you somehow get locked out of your Facebook page, you’re out of luck.
Unfortunately as we’re seeing now, there’s potential for abuse, which is what this is. To put it bluntly, these E-mails are from completely random and anonymous Gmail account scammers trying to hijack your Google Business profile. As if the generic names weren’t enough – “Henry Peter” is one step removed from just identifying as “John McRealPerson” in terms of authenticity.
As for the purpose of these scams? I thankfully haven’t had a situation where a Google listing has been compromised, but I suspect the intent is to try and hold the business listing for ransom, forcing business owners to pay (usually in cryptocurrency) hundreds or even thousands of dollars to get it back. Or worse, actively disrupt the business by posting inaccurate or misleading information about it to make business owners pay up just to stop the damage.
In short, a scammer is using an authentic channel (Google’s ownership request form). Respond to the request immediately by denying the request – remember that you have three days to do this – and if you’d like to go the extra mile you can report the E-mail to the Google My Business team. Do not engage with, E-mail or call the scammer for any reason – in all likelihood it’s just a burner E-mail or phone number anyway, and there’s no benefit to be gained by doing so.
How bad is it? The scammers have resorted to “ethnic” sounding names when approaching places such as Asian restaurants. If this sounds despicable and unapologetically racist, well – I’m not suggesting that scammers are good people.
Google as a platform tends to move slowly, so I wouldn’t hold out to expect immediate institutional help – but on the other hand it does make me wonder how Google could crack down on these scams without penalizing legitimate users genuinely trying to regain access to their Google Business profile. It’s possible that Google could place temporary restrictions on new Google accounts to request access, or potentially flag Google accounts that are making dozens or hundreds of requests.
So if it’s a name you don’t recognize, either respond and decline immediately, or contact trusted point of contact – and that’s that. Otherwise these scammers have no way to access your profiles and will move on to other targets.