Google Business Profile Security: Prevent Scams, Ownership Loss and Unauthorized Edits

A practical security playbook for protecting Google Business Profile ownership, handling suspicious requests, reviewing manager access, and responding to…

A local business’s Google Business Profile can influence calls, directions, bookings, and customer trust. Losing access or allowing an unknown person to edit it can interrupt operations and expose the business to impersonation. This guide covers prevention and response. It does not replace Google’s current account recovery or profile appeal process; use official support pages for the latest steps.

Why this matters

Local SEO is not only about appearing in a result. It is about making the business easy to understand, verify, contact, and choose. Use the recommendations below as an operational system, then review the outcome against real customer behaviour. No tactic guarantees a particular ranking or amount of traffic.

Understand ownership, managers, and agency access

The business should retain control of its profile even when a marketing agency, freelancer, former employee, or website vendor helps manage it. Access should be granted to individual Google Accounts through the supported role system rather than by sharing one password.

Maintain a simple access register: person, role, business reason, date granted, and review date. Give each person only the access needed for their work. When an employee or vendor leaves, remove access promptly and confirm that at least one trusted business representative retains appropriate ownership.

Do not transfer primary ownership to an unknown person who claims it is required for verification, ranking, or support. A legitimate service provider should explain exactly what access is needed and why. The business must still be able to regain control if the relationship ends.

Recognize common warning signs

Treat these as reasons to pause and verify:

Someone claims to be a Google employee and demands payment to prevent suspension or maintain a listing.
A caller asks for a one-time password, account recovery code, PIN, or password.
An unsolicited email says your profile will disappear unless you act through a suspicious link.
A marketer promises a guaranteed ranking position in exchange for ownership access.
A vendor asks you to use a personal account that the business cannot audit.
Someone offers fake reviews, competitor sabotage, or paid review removal.
A message creates urgency but provides no verifiable case or official support path.

Do not rely on a logo, caller ID, display name, or screenshot as proof. Open your Google Account and Business Profile through a route you navigate yourself, not through a link supplied by the person pressuring you.

Harden the Google Account first

Profile security depends heavily on the accounts that can access it. For every owner and manager:

Use a unique, strong password and a password manager where possible.
Turn on two-step verification or a passkey when available and appropriate.
Review recovery email addresses and phone numbers.
Check active sessions and devices; sign out unfamiliar sessions.
Remove third-party app access that is no longer needed.
Keep the operating system, browser, and security software updated.
Never share one-time codes with callers or message senders.

If an employee’s account is compromised, revoke sessions and access quickly. An access list that has not been reviewed for years is a risk even if nobody has reported a problem.

Create a safe vendor onboarding process

Before hiring a local SEO provider, ask for a written scope, named team members, deliverables, reporting method, and exit procedure. Give access through supported roles and keep business-critical recovery information under the business’s control.

Agree in writing that the provider will not:

Create fake locations or use a virtual office to simulate a staffed location.
Buy or manufacture reviews.
Change the business name or address to insert keywords.
Remove or hide negative reviews in exchange for incentives.
Add unapproved users or transfer ownership without permission.
Hold the profile hostage if the contract ends.

Ask for a change log and have the business approve high-risk edits. An agency should be able to explain its work without needing the owner’s password.

Respond to an unauthorized edit or ownership problem

If you suspect an unauthorized change:

Open the profile using your trusted account and note the exact issue.
Secure the associated Google Account immediately: password, recovery methods, sessions, and two-step verification.
Review users and remove access you can confidently identify as unauthorized.
Capture evidence such as screenshots, timestamps, notification emails, and vendor communications.
Use Google’s official Business Profile help or recovery route to report the issue.
Avoid creating a duplicate profile as a workaround unless official guidance specifically directs you to do so.
Check phone, website, address, hours, categories, and booking links after access is restored.
Notify staff about the correct contact details if customers may have been misdirected.

Do not make repeated, conflicting edits while a case is being reviewed. Keep a concise timeline of what happened and what actions you took.

If your profile is suspended or restricted

A suspension is not proof that a competitor hacked the profile, and a ranking drop is not proof of a penalty. Review the profile against current eligibility and representation rules: real-world name, accurate location or service-area setup, appropriate categories, and legitimate business operations. Correct actual violations before submitting an appeal.

Use official appeal routes and provide truthful, relevant evidence requested by the process. Do not create replacement profiles to evade a restriction, submit fabricated documents, or pay a third party that promises guaranteed reinstatement. No outside consultant can guarantee Google’s decision.

Build a lightweight security routine

Monthly, review profile users, business contact details, website links, account recovery methods, and any recent edits. Quarterly, review agency access, staff departures, billing contacts, and the business’s incident-response plan. After a staff change, acquisition, domain change, or suspected phishing event, review access immediately rather than waiting for the next scheduled check.

Keep a current offline record of the official business name, public address or service-area setup, main phone, website, and supporting business documents. Store sensitive documents securely and share them only through official, necessary channels.

Implementation checklist

Confirm the business retains owner-level control.
Audit all users and remove former staff or vendors.
Enable strong account authentication and review recovery options.
Never share passwords, OTPs, or recovery codes.
Verify support messages through a route you open yourself.
Require written scope and exit terms from agencies.
Record evidence and use official support if access is compromised.
Recheck profile details after recovery.

FAQ

Will Google call and ask for my password or OTP?

Do not share passwords or one-time codes with callers. Verify any support claim independently through official Google account and Business Profile help routes.

Should I give my SEO agency primary ownership?

Usually, give a provider only the access needed for its work. Keep the business’s control and recovery path intact, and document access and exit procedures.

Can an agency guarantee profile reinstatement?

No third party can guarantee Google’s decision. A provider can help organize evidence and follow official instructions, but the decision belongs to Google.

Official references

Editorial note

Platform interfaces and policies can change. Verify the current official guidance before making high-impact changes. Add original screenshots, first-hand examples, and expert review where appropriate; do not publish claims, credentials, results, or customer details that cannot be verified.