Today and yesterday I have received two suspicious, scam / spam emails. I am unsure exactly how the scam works, but my Google My Business listing is being targeted. If you are also being targeted for the scam, let me know in the comments so we can share resources!
I’m a wedding photographer who has had my GMB listing in place for at least three years. It currently has 35 5-ratings, including a bunch that had just been added by my clients. Duh, it’s fully claimed and optimized to a tee, by me.
Strangely, the fraudulent ownership requests had never happened before 9/21/20. On that date, I received an email saying: [fake name] has requested access to Zoe Larkin Photography on Google My Business
It then says:
Someone has requested ownership of Zoe Larkin Photography on Google My Business.
It goes on to give the scammer bot’s name:
mac williams, Business owner
williamsmac97@gmail.com
9829194164
This was closely followed a few hours later by another email with a different name.
I believe these are legitimate emails from Google. It’s not a phishing scam in the traditional sense in which the scammer spoofs an email to trick you into clicking the link and giving away personal information.
Table of Contents
What does the suspicious email look like?
The email comes from google-my-business-noreply@google.com and looks legitimate. It does not appear to be a spoof or fake ‘phishing’ email, in which you click ‘reject’ and it immediately withdraws $1,000,000 from your bank account. (Well, they would be sorely disappointed in my case, but that’s another story). Here is what the email looks like:
What should you do when you receive an email requesting ownership access of your GMB account?
There are two ways of responding to these fraudulent requests. You can either ignore the email or deny/reject the request. Let’s go through them both.
Delete and ignore the email
The first option is the one suggested by Joy Hawkins who is a local SEO expert and owner of Sterling Sky. In this thread on the GMB help forum, she writes “simply delete the email. Do not click on the link.”.
I am sure the thinking behind this is: don’t feed the trolls. Or in this case, the scammers. It is likely they want you to click ‘reject’ (because who in their right mind would click ‘allow access’?) So, don’t engage and just get on with your day.
However, there is another school of thought that you can read more about on this GMB help thread. Apparently, according to the OP, “I have seen that after 3-7 days they can be automatically granted access”. This official Google page is where, I believe, the OP is getting that information from.
Under the section, ‘What to do after you’ve requested ownership’, it states:
If you don’t hear back: If you don’t get a response after 3-7 days, you might have the option to claim the profile yourself. Sign in to Google My Business, and look for a “Claim” or “Verify” button on your dashboard.
This, to me at least, suggests that the scammers may be trying to exploit a loophole that if the legitimate owner is non-responsive, it may be possible to move forward without their assistance.
This puts us into a bit of quandary. Should we engage with the scammer and alert them that seen their request (which could invite more), or do we delete without hitting ‘approve’ or ‘reject’?
Hit ‘Review Request’ and then reject the request
Google’s official help is in direct contrast to the ‘delete-and-move-on’ school of thought. Their email to me said the following: “We advise you to deny the request if you feel somebody who is not related to your business is trying to gain access to the business.
At the moment, I am actively denying the requests just in case if you do nothing, this gives the fake / scam account the ability to appeal or move forward without your verification.
I would suggest you deny the requests so there is no ‘loophole’ that the bot accounts can take advantage of. This way you can always prove that you did your part. Make sure you take screenshots wherever possible and save all emails.
Another thing I did which I also suggest is turning on 2-step verification on the Google account that you log into your GMB with. This sends a code to your phone before you can access anything on that account. Protect yourself and your account in any way you can.
Never give account access to anyone you don’t know.
What is the intent behind attempting to claim ownership of a GMB listing?
It looks like there are bots out there that scrape legitimate Google My Business listings and click on the ‘Request Ownership’ button that appears on every claimed GMB listing.
The scam is not entirely clear to me. I was told by the Google My Business help team that “without your consent no one would be able to access to your business listing.”. That is a direct quote from Google. However, when you hit ‘reject ownership request’, you will see the following information:
“Even if you reject this request, the person above may still be granted access to the listing if they can complete the verification process”.
That is worrying to me. What if there is a way of getting around the ‘verification process’ that completely bypasses me? I have no idea what this means.
Anyway, there is likely a market for Google My Business listings. I have a couple of theories here if you’ll indulge me. My guess is that once they have ownership of a listing, they can change the name and details of the business and sell it to someone else.
Here is a GMB thread showing that this actually happened to a business owner. Frightening stuff.
Another less nefarious option is that when you click ‘reject request’, you are telling the scammer that you actively care about your GMB profile. This might theoretically qualify you for some kind of upsell or service. It tells them that the email address that is tied to the GMB account is monitored.
I just realized there’s another reason the scam bots could be doing this. It’s entirely possible (judging by the amount of spam emails I get every single day) that they may combine a friendly ‘hey I want to do some optimization work on your GMB listing, I’ll do it for free, just accept my request so I can help you!’
Then boom! You have given away your account and you will no longer be able to access it after they remove your ownership rights.
And more importantly, once they are into that account they can potentially access your Google Ads account (with linked credit card information and the ability to run ads until you notice), and maybe even email.
I have most of that garbage filtered out automatically but even the ones that slip through the cracks are numerous (and annoying) enough. So yeah, beware of this scam running alongside someone claiming to help you, either by calling or emailing you first so it seems less random.
More details about other GMB scams are on this post from BizIQ.
Be proactive about with the ownership of your GMB
Though there are mixed messages and confusion out there, my own common sense as a 3-year+ Google My Business user is to be proactive. Don’t just delete the email and hope that that solves the problem. You must actively guard against scam artists and fraudsters that would love to take your Google My Business away from you and sell it to the highest bidder (or even hold it ransom).
Be on guard by scrutinizing emails to check they are not phishing scams. Report those that are. Tell the Google My Business team if you get these ownership requests – without knowing there is a problem, they have no hope of fixing it.
Avoid engaging with the scammers, such as by calling the phone number or emailing them. Focus more on securing your account by signing out of all sessions and changing your password to a very strong one (a string of random numbers and letters is the best, then use a secure service like LastPass to store them).
Turn on 2-factor verification. Monitor the inbox linked to your GMB and reject all requests within 3 days. At least you know you’ve done your part to protect your account. The rest is up to Google to get their act together to put a stop to the fake accounts targeting our legitimate businesses.
Keep your registered business address up-to-date. This is the address where any verification postcard will be sent. With many service-businesses being home-based, this is particularly important as your address may not be displayed on the listing so you tend to forget about it.
What is Google doing about this problem?
As usual, f* all. It appears that anyone can hit ‘claim this business’, even when it has already been claimed. This is a loophole ripe for scammers. I suggested to Google’s GMB help team that they should patch up this loophole immediately.
There is no reason why anybody should be able to ‘claim’ a business that’s already active and claimed. An unclaimed business, sure. That makes sense. But if I as a business owner wanted to share ownership with a legitimate person, that should be something I do from within my GMB dashboard. Not someone that everyone and his dog can access and bug me with 24/7.
I reported the issue to Google on 9/21/20 and they responded very quickly with the following email (text below the screenshot):
Hello Zoe,
Greetings from Google My Business Support Team.
As per your email, I understand you are concerned that someone is trying to request ownership access to your business listing “Zoe Larkin Photography“.
We apologize for the inconvenience that this has caused you. We advise you to deny the request if you feel somebody who is not related to your business is trying to gain access to the business.
Please be informed that without your consent no one would be able to access to your business listing.
If you have further questions related to this issue, simply reply to this email and we’ll be happy to help! For additional support on a different issue, you can always reach us via our Help Center [g.co/gmbhelp].
You may receive an email survey regarding your interaction with GMB Support. We value your feedback.
Have a great day!
Regards,Anushna
This is all well and good, but then it happened again just a few hours later. I had to tell Google while I had them on the line that this was just not acceptable.
“Another spammer has just ‘requested access to MY google my business’. See screenshot located here: https://prnt.sc/ulvusc Just as I feared, this is a new scam, not someone’s innocent mistake.
I and millions of other business owners have better things to do with our time than deny spammers requests. PLEASE, as a suggestion, do not have the option on any listing to ‘claim ownership of this business’ when it has already been claimed. This should only appear as an option for unclaimed businesses.
For your information, I actually WRITE about Google my Business on my website, and will certainly be sharing this problem with my thousands of readers who will be interested to hear what Google is doing to help the millions of legitimate business owners who use the GMB platform, and what you are doing to combat the ever-present plague of spam (or not as the case may be….)”
Of course, and I hope this is clear, but I am not taking it out on some lowly email center employee. Sadly there is nowhere else we can go when we need Google to step up and do something. The answer in my opinion is simple. And I am going to repeat it again here.
Remove the option to ‘claim ownership’ of a business that is already claimed! Permission should be given privately on the legitimate owner’s back-end.
Local business owners are sick of getting jerked around constantly by shady practices allowed by GMB. Spam listings are a massive problem on GMB. I have tried to shut down the fraudulent listings set up by many of my competitors, for businesses that don’t exist.
I have shown entire case-studies with proof of one person using keyword-stuffed entries to gain real estate on the map pack. GMB has been a spammer’s playground from the beginning – it is now a scammer’s playground, too.
Naming and shaming the scammers!
If you have been targeted by these accounts, let’s name and shame. I will put the names here as they appear – add yours in the comments. Hopefully if it happens to other business owners, they will Google the names and land here. Then they will find out it’s a scam and no-one else will fall for it.
mac williams, Business owner
williamsmac97@gmail.com
9829194164
Dhalia Minith, Business owner
dhlaminith@gmail.com
8233412989
Brittney H, Business owner
sweetpnkkiss@gmail.com
6904105364
Sirisha Garikipati, Employee
sirishagarikipati558@gmail.com
7659800888
Jean baptiste Monnier, Business owner
jbzh25@gmail.com
0738889490
Sherzod Mahmudov, Business owner
sherzodmah739@gmail.com
(403) 200-2608
Valda Ransom, Business owner
valda.ransomva@gmail.com
(713) 482-8560
Virgil Yancy, Business Owner
virgilyancy@gmail.com
Ronaldo Kirales, Business owner
ronaldokirales@gmail.com
(480) 443-3505
Frank Reardon, Business owner
menufy5477@gmail.com
9733373151
Paul Ramachandran, Business owner
irvinttoooa@gmail.com
8169238892
Edward Bowers, Business owner
irvinttoooa@gmail.com
7702880278
Beyond Menu
mgmb@beyondmenu.com
+1 630-776-3590
Otto Ramachandran, Business owner
coo075588@gmail.com
6781237810
Ike Sellon, Business Owner
lucyhills@sifumenus.com
8058228920
Collie Javier, Business owner
colliejavier@gmail.com
Tristen Chandler, Business owner
chandlertristen28@gmail.com
Tristen Chandler
Vately Jam
Business Owner
vatelyjam7642@gmail.com
720-869-0878
Victoria Jackson, Business owner
victoriajackson303@gmail.com
Victoria Jackson
Karen Morgan, Business owner
karenmorgan2122@gmail.com
2349137403174
Tips for GMB beginners
This post is seriously off-topic for me as a wedding photography educator. Bit I couldn’t resist posting about this as there is so much misinformation and confusion flying around right now – and there seems to be a spike in these attempts at fraudulent GMB ownership requests.
I only have one post that’s even slightly related as of now, though I hope to bring out more content about optimizing your profile. It’s about setting up your GMB – linked below!
If you’re a wedding photographer that’s landed here, feel free to have a browse around my site. I have tons of resources to help you with the business side of things. Be sure to check out my YouTube channel, too!
Zoe Larkin
I’m Zoe, a wedding photographer based in San Francisco! My style is candid, capturing authentic moments for my couples all over the Bay Area and Northern California. Creating content is my passion! Follow along the blog and Insta!