The Google Verification Postcard Scam: How Listings Get Hijacked

Also filed under: Google Business Profile hijacking · verification postcard scam · business listing hijack · GBP takeover scam

If a Google verification postcard showed up that you never requested, someone else requested it, and they are trying to claim your business listing. The postcard is real. Google actually sent it. That's the uncomfortable part: the scam runs on Google's genuine verification machinery, aimed at your mailbox by a stranger.

The prize is everything your listing does for you. Whoever controls a Google Business Profile controls the phone number customers call, the website they click, the hours they see, and where the map pin sends them. A hijacked profile quietly reroutes years of your reputation to someone else's phone, which is a remarkably efficient way to steal a business without touching the building.

How the con runs

The hijacker starts inside Google's normal flow: he requests ownership of your listing, or claims an unclaimed one, and Google responds the way it's designed to, by mailing a postcard with a verification code to the business address. He is betting on one of two things. Either you toss the postcard as junk mail, which most people do because it looks like junk mail, or he gets to it first, through a shared mailbox, a complicit tenant, a mail fishing run, or simple interception.

With the code in hand, he verifies himself as the owner. Nothing dramatic appears to happen. Your storefront stays put, your sign stays lit. But on the map, the phone number now rings a call center that books your customers with a different contractor, or the website link points at a lookalike page, or your hours say closed on your busiest day while a 'nearby' competitor is conveniently open.

A quieter variant skips the theft and goes straight to invoicing you for it: letters and robocalls insisting you must pay to 'verify' or 'maintain' your Google listing. Google has never charged for verification. Anyone billing you for it is selling you a free service at markup, which at least demonstrates initiative.

The unclaimed listing is the softest target of all. If you never claimed your own profile, there is no owner to displace, and the postcard goes wherever the requester steers it. Plumbers, locksmiths, and towing companies get hit hardest, because a hijacked emergency-service listing pays for itself by the second phone call.

Play defense

• Claim your Google Business Profile now, before someone helpful does it for you. An owned, verified profile is far harder to hijack than an unclaimed one.
• Treat any verification postcard you didn't request as an active takeover attempt. Log in at business.google.com and check for pending ownership or access requests.
• Review your profile's Users and access list periodically and remove anyone you don't recognize. Hijackers sometimes enter as 'managers' invited during a moment of past sloppiness.
• Secure the Google account behind the profile with a strong unique password and two-factor authentication. The profile is only as safe as the login that owns it.
• Check your public listing monthly from a customer's view: phone number, website, hours, address. You'll spot a hijack faster than your regulars will mention it.
• Never pay anyone who calls or writes offering to 'verify' or 'protect' your Google listing. Verification is free, and Google doesn't telemarket.

Already got hit?

1. Start Google's ownership conflict process: in Business Profile support, request ownership of your own listing. The current 'owner' has days to respond, and when he doesn't, you can proceed with reclaiming and re-verifying.
2. Document the damage first: screenshots of the altered phone number, website, and hours. You'll want them for Google support and for any fraud reports.
3. Once you're back in, audit everything: users list, phone, website, hours, address, appointment links. Hijackers leave spare doors open on purpose.
4. If your mail was intercepted to pull this off, report it to the US Postal Inspection Service at uspis.gov. Mail theft is a federal crime with actual investigators attached.
5. Report the fraud at reportfraud.ftc.gov, and at ic3.gov if customers or revenue were diverted. If a specific competitor benefited, that documentation is also the start of a very short conversation with a lawyer.

Questions people ask at 2 a.m.

All case files →