PSA: Attempts to hijack listings (don't ignore these GMB notification emails)

[Justin Mosebach]

Some of our clients are getting dangerous emails from Google My Business that if ignored (or by clicking on the main button in the email) could result in them losing their business listing to a spammer.

The emails actually come from Google and have a time limit on them, making them a bit tricky to catch.

Scammers are requesting access to GMB listings, which triggers an email to the GMB account owner asking for access to be approved (screenshot below).

• If you approve the request, the scammer will hijack your listing (change the business name, website, etc) and/or you will lose complete access to your GMB listing.

• If you ignore the request for more than 7 days (not clicking on anything in the email), there's a chance the scammer will automatically get ownership of your GMB listing.

If you get any of these emails, here's what you need to do within 7 days of receiving the email...

1. Click the button "Review Request" in the email.
2. Deny the request on the following screen. (You'll have to be logged into Google with the same account that the email notification was sent to.)

The email subject line for these emails from Google is: "[Scammer's Username] has requested access to [Your Company Name] on Google My Business".

If you or your clients get any emails like this, don't ignore them.

 

[Phil Rozek]

@Justin Mosebach, nice find. I have not seen those. What happens once you deny the request, and does Google give you a "Let us know if you do not recognize the person making this request" mechanism?

 

[Justin Mosebach]

@Phil Rozek Good question. There wasn't a way to report it as spam in the email itself. I don't think there was an option to do that after denying the request, but I'm not totally sure. I'll keep a keen eye for it if it happens again.

 

[BenFisher]

This is actually working as intended. And you definitely need to pay attention to these, BUT even if you do not the "scammer" has to still go through a verification process to actually gain control. This help document details out how these requests start: Request ownership of a Business Profile

 

[Justin Mosebach]

This is actually working as intended. And you definitely need to pay attention to these, BUT even if you do not the "scammer" has to still go through a verification process to actually gain control. This help document details out how these requests start: Request ownership of a Business Profile

Ahhh, good to know!