Someone Can Take Over Your Google Business Profile

Your Google listing is just another login

Most owners around here treat their Google Business Profile like a billboard. Set it up once, check the reviews when you remember, move on. But that listing isn’t a billboard. It’s an account. Whoever controls the account controls your phone number, your hours, your website link, and the pin that tells people where to drive.

Somebody else getting in doesn’t have to break a single thing. They just change the phone number to one they answer.

Why anyone would bother with a five person shop in Delray

Two reasons, and neither one requires you to be a big target.

The first is money. A scammer swaps your listed number for a call center. Your customer searches your business name, sees your name, your reviews, your photos, and calls the number right there on the map. They get a person who sounds professional and asks for a deposit or a card number to "hold the appointment." You never hear about it. You just notice a slow week and wonder if the season is off.

The second is rankings. Local search is a fight over a handful of map spots, and some people fight dirty. A competitor marks you as permanently closed, moves your pin two miles west, or suggests an edit that changes your business category from plumber to something useless. Google accepts a shocking number of these crowd edits without asking you first.

How they actually get in

The fake suspension email. Looks like it came from Google, says your profile violates a policy, and gives you a button to verify. The button goes to a page that looks like a Google login. You type your password there and it’s over.
Suggest an edit. Anyone with a Google account can propose changes to your listing. No hacking involved at all.
The ownership request. If your listing was never properly claimed, someone can request ownership. Google emails the current owner. If that email goes to a Yahoo account nobody has opened since 2019, the request goes through by default after a few days.
The agency you fired. That marketing company you used for six months in 2023 is probably still a manager on your profile. So is the nephew who set it up.
Your own Gmail with no 2-step verification. This is the big one. Your listing is only as protected as the personal Google account sitting behind it.

What it costs to get it back

Here’s the part nobody warns you about. Recovering a hijacked profile isn’t a phone call. You’re filling out forms with a support team that has no idea who you are, proving you own a business you’ve run for eleven years, and possibly waiting on a verification postcard or a video call with Google. Two weeks is normal. During those two weeks your listing might be suspended, which means you vanish from the map entirely.

Your reviews can go with it. Years of five star reviews from customers who won’t write them again.

Lock it down before you finish your coffee

Find out which account actually owns it. Sign in and check. A lot of owners discover the profile lives under an ex employee’s personal Gmail, or an address nobody can get into anymore. Fix that first, because everything else depends on it.

Turn on 2-step verification for that Google account. Use an authenticator app or a passkey, not text messages. If a hacker can talk your carrier into moving your number, text codes won’t save you.

Audit the people list. Open the profile settings and look at every owner and manager. Remove the old agency. Remove the intern. Anyone you wouldn’t hand a key to your front door shouldn’t be there.

Make sure there are two owners. One primary owner plus one backup, both accounts you control. If a single account gets locked, you still have a way in.

Turn profile notifications on. Google will email you when someone edits your listing. That email is worth reading the day it arrives, not next month.

Check your own listing once a week. Search your business name on your phone, not logged in. Look at the number. Tap it. Make sure it rings your phone.

If it already happened

Move fast and don’t panic click. Recover the underlying Google account first, since fighting over the listing is pointless if the attacker still controls the login. Remove every manager you don’t recognize. Screenshot everything, including the wrong phone number, because Google support will ask what changed. Then file the profile recovery form and keep the case number.

Call your bank and your card processor too. If a scammer was collecting deposits under your name for a week, you want that documented before the chargebacks land.

The thing that makes this fixable

Almost every listing takeover I’ve seen traces back to one weak Google account with no second factor and four stale managers attached. That’s a 20 minute cleanup, not a project. The businesses that get burned aren’t the ones with bad security budgets. They’re the ones who never looked.

Go look right now. If you find something weird in that manager list and aren’t sure what to do about it, reach out. We work with small businesses from Delray Beach up to West Palm, and we’re always happy to troubleshoot.