Seems like someone is trying to Steal my clients GMB

[HoosierBuff]

Hi All,

I have a client that has seen a rash of emails from Google where someone is trying to gain management control of their GMB. They don't recognize the name of the person requesting it, and they deny the request. This happened a few times in the last month.

Today my client received a postcard with a PIN on it.

This is starting to look like someone is trying to hijack their profile. Is there anything that can be done to protect this from happening?

 

[Professor M]

Unfortunately, these requests happen when someone clicks "Own this listing?" on your profile, so unfortunately there is no option to block these requests.

What can you do?

Pass this "checklist to your client:

1. Please do not press the “Review request” button as it could be a fake email.

2. Next step, you login into your Google My Business account and "Deny" any request that appears on the dashboard


Important: If you have a notice from Google about an access request, please make sure to “Deny” request it as soon as possible and tell all the other account users about the request.

If you delay for more than 3 days to reject it or some other user gives access, the scammer can take control of your listing and remove you from the account and change all account details.


What else can you do
If it is more than one request, contact support to advise the situation as a spammer attack and provide all the details.

 

[JoyHawkins]

Yep, I agree. I would let GMB support know so that they can blacklist the account that sent the postcard. Unfortunately, hijacks are something I see quite often but as long as you don't approve the manager request you should be okay.

 

[HoosierBuff]

Thanks guys.

What do you think about the postcard being sent? That seems like an escalation, and I'm worried that they can send the postcard, wait two weeks, and then say "postcard not received"

 

[JoyHawkins]

Even if they do that, they won't be able to get control over the listing without verifying it. I still suggest contacting GMB support and telling them about this.

 

[Professor M]

Thanks guys.

What do you think about the postcard being sent? That seems like an escalation, and I'm worried that they can send the postcard, wait two weeks, and then say "postcard not received"

I heard about some cases where those Spammers call the business after few days advising they are from Google and asking for the code, so I would alert your client to not provide any code over the phone.

 

[Professor M]

This morning I did an access request test and Google is not showing the banner on the dashboard to deny or accept the request.

Apparently the only way to do it, it's through the email received, thank you Google for making phishing easier!

So I updated my checklist:

1. Please, before clicking on the “Review request” button, check the email address as it could be a fake email - emails are sent from: "google-my-business-noreply@google.com"

2. When clicking on the "Review request" button, you should be forwarded to an URL similar to the below:

3. Next step, you login into your Google My Business account and "Deny" any request that appears on the dashboard

Important: If you have a notice from Google about an access request, please make sure to “Reject request" as soon as possible and tell all the other account users about the request.

If you delay for more than 3 days to reject it or some other user gives access, the scammer can take control of your listing and remove you from the account and change all account details.