I was on holiday in Greece when I received a request from someone looking to take over ownership of my Google My Business account.

I’m an established freelance copywriter and have had my account for more years than I care to remember. Was it a genuine chancer via Google? Or was it some kind of scam?

I felt a little stuck, being away, and spent several hours looking for advice online (as Google can take dayyyyys to respond to queries).

I found lots of blogs all saying pretty much the same thing, and lots from web agencies that then tagged on their sales pitch. However, all the posts were from people in the US – not that it’s a problem, but I didn’t recognise any of the web companies and didn’t know how much weight to give the advice. Another issue was that many posts and threads were easily a year old or simply repurposed what others had advised. But none gave a definitive answer …

There is a happy ending: I was successful in getting advice from Google (after some time!) about exactly what to do and I was also successful in the action I took. I hope my post has the answers and reassurance you need if you’re unfortunate in being similarly targeted.

Should you delete the spam email requesting ownership? Or reject it?
First of all, I came across this post by Joy Hawkins, an SEO expert in Canada and ‘Top Contributor ‘on the Google My Business Forum’. She talked about the increase in  Google My Business listings getting hijacked. She’d also been very active on a GMB forum with more than 80 responses about the issue.

Joy’s advice?

‘If you don’t recognize the user, simply delete the email.  Do not click on the link.  A user shouldn’t be able to get access to your listing without you granting it to them or them being able to complete verification.’

Hmmmm, I didn’t feel comfortable about doing this. I knew from a Google page about owner verification that the enquiry was definitely from an official email: googlemybusiness-noreply@google.com. This email is also authentic: google-my-business-noreply@google.com

Many of the replies in the thread gave details of the scam notification yet no-one reported whether they’d ignored the email or pressed the Reject button, or even what happened in the end.

The problem is that Google states you have three days to respond. If you ignore the email request, the scammer could end up having your listing transferred to them because Google will simply consider your listing to be an unmanaged one. The scammer can then start the process to verify the listing.

Scammers usually send the business ownership request email on a Friday or Saturday so that you may miss seeing it over the weekend and forget to respond. You’ll get a follow up email 24 hours later and another one 24 hours after that.

The official Google page about how to Request ownership of a Business Profile says this:

If you don’t hear back: If you don’t get a response after 3 days, you might have the option to claim the profile yourself. To claim a Business Profile:

1. 1. 1. 1. Open the original confirmation email you received about your ownership request.
         2. Find your request and follow the instructions on-screen to verify. Alternatively, sign in to Business Profile, and look for a “Claim” or “Verify” button on your dashboard.

Er, right – so this was contrary to Joy’s advice??? Help! I’d also read some scary posts from people who’d ignored the ownership request email only to have had their account hacked and lost it. Nightmare.

My head said:

“Never click on a suspicious-looking link. If I click on it, I’m letting the bot know that I exist and could be giving access to other private info.”

“Google can surely see that I’m an established and verified business, and keep my profile up-to-date.”

“Nothing’s showing on my actual GMB account, so how can this notification be real? (Though, tbh, I wasn’t sure if this kind of thing was meant to show up on there at all.)”

My heart said:

“But what if I follow Joy’s advice to ignore the email and the scammer manages to claim it? After all, the email is from a legit address.”

Why might someone want to claim your Google My Business profile?
There are two potential reasons:

• Your business page is worth having because it ranks well on Google for a number of keywords. The new owner could then change your contact information so that they receive all the enquiries – and your business.
• The scammer could take your listing hostage and hold you to ransom after claiming the listing, demanding money or bitcoin from you in order to then reclaim it.

What did I decide to do in the end?
I was still waiting to hear back from Google by the time the 3-day window was up.

Heart won over head. I felt I’d rather put up with receiving more scam emails and dealing with them than run the risk of ignoring them in case the scammer could end up taking action or this was a genuine request.

Firstly, I reported the scammer to Google using their official form – Business Profile third-party policy: Report a violation

Then I also contacted Google’s business support team (though never heard back).

And I pressed the ‘Reject request’ button.

And received this confirmation:

And what was Google’s official advice to me?
As I hadn’t heard back from Google’s support team, I tweeted @GoogleMyBiz and received these two replies (though I had, by then, already taken action).

Phew!

The anti-scam steps I next took
I turned on 2-step verification for my GMB account.

I changed my Google My Business password.

I set up my Google Inactive Account Manager

I re-verified my listing and received a postcard with a verification code.

I updated my listing by adding some new work.

And I’ve not received any more GMB-ownership spam since.

Touch wood.

 

Written by Caroline Gibson, a freelance copywriter who is absolutely, definitely and genuinely the verified owner of Caroline Gibson, Freelance Copywriter & Content Writer. 

E: caroline@carolinegibson.co.uk  T: +44 (0) 7957 567766

P.S. Follow on Twitter