What To Do If Someone Is Trying To Hijack Your Google My Business Listing – 108

Transcript For What To Do If Someone Is Trying To Hijack Your Google My Business Listing- 108;

Caleb Baumgartner: Welcome to Local SEO Tactics, where we bring you tips and tricks to get found online. I am producer, Caleb Baumgartner, and in today’s episode, Jesse takes on an important matter of Google My Business security. Have you experienced emails regarding someone trying to gain access to your GMB? Ignoring these emails can have consequences for your GMB security. Jesse explains how scammers can try to access your GMB, and what steps to take to protect your listing and keep the scam artists off of your profile.

Thanks for listening and enjoy the show.

Jesse Dolan: Welcome back to Local SEO Tactics, where we bring you tips and tricks to get found online. I’m your host, Jesse Dolan. Today we’re going to be talking about some GMB scammers. Probably most of you out there, if you’ve got a Google My Business listing, and especially if you have multiple, you’ve probably got these emails with somebody that you’ve never heard of before. Kind of in the last six to nine months really picking up, somebody you’ve never heard of before contacting you via email, requesting access to your Google My Business listing, which is kind of scary and very confusing.

We’re going to go through that today. Spoiler alert, it’s scammers. It’s going to be scammers and we’re going to break that down. How are they doing this, why are they doing it? And what are some things that you can do to make sure you’re protected and maybe try to thwart this.

Before we get into that, I want to mention our free instant SEO audit tool, you can go out to localseotactics.com. Go ahead and click on the yellow button up in the corner for the free SEO audit. Pop in your URL, the actual page, individual page on your website that you’re looking to get an SEO score for, and then type in your keyword that you’re trying to grade it against.

It’s going to take a number of seconds, maybe a minute or so. And what it’s going to do is it’s going to spit you out a PDF with a punch list of things that you need to do to improve your site, an overall scorecard. It’s just a real slick report, and gives you a great starting point to start to improve the SEO for that page. You can use this on every page of your website. You can use it as many times as you want, it’s completely free. And you can also run competitor pages too, if you want to try to reverse engineer them a little bit. So yeah, super handy tool. Everybody loves it, we get great feedback on it all the time. If you haven’t used it yet, check it out, localseotactics.com. Look for the yellow button, free SEO audit.

All right. So back to those shady scammers trying to get ahold of your Google My Business listing. So just to set the stage on that, what we’re talking about here is, first, you have to have a Google My Business listing. If you’re in business and you’re looking to get found locally, this is a topic we’ve talked about many times, you definitely should have a Google My Business listing by now. If not, pause this episode because you ain’t got to worry about this thing yet. Go back to some of our first episodes, get yourself set up on a Google My Business listing, get it optimized and get in the game.

Now for those of us that have them, you’ve probably received an email like this, like I said, sometime over the last year, over the last six months, with some person that you do not know who it is requesting access to your Google My Business listing. This email’s going to come from Google, it’s an official email. The email itself is not a scam, the people behind the request are a scam, but this email is a legitimate email from Google. And I want that to be clear because this isn’t something that we’re just going to dismiss and ignore. There are some actions that you’re going to want to take if you get an email like this.

So number one, this is an email from Google. The subject of the email is going to read something like, whatever the person’s name is, whatever their user name. So, “Jesse Dolan has requested access to,” whatever your business name is, your Google My Business name. So, “Jesse Dolan has requested access to Intrix on Google My Business.” That’ll be what the subject line of this email is. You’re going to want to make sure to make sure this is legit, that it has some kind of format like that.

And you’re also, and this is just overall cyber security, email security, check the actual domain name and email address from where this email is coming from. If this is coming from Google, it should be something google.com or @google.com or something like that for the email address. Likewise, if you hover over the email for any links and things like that, it should tell you the websites that these links are going to go to.

Again, if this is from Google and it’s an official communication, those are going to take you back to Google. So check those things out, that email address, the Reply-To address, and then the address fillings are going to take you to. If it’s going to something like google.jessedolan.com, that’s not the Google domain. You want google.com, You want that to be ending in it.

So assuming that you’re dealing with a legitimate email from Google here, here’s what you’re going to see. You’re going to see kind of the style that Google usually presents. You’re going to have some kind of avatar or letter profile name for that username for who is requesting the access. That’ll just be an image right in the email saying who this is. Right underneath that you’re going to see a blue button that says Review Request, and you click that.

Now that’s going to take it to the Google My Business area. You’re going to have to be signed in to your Google account that you use to manage the Google My Business listing. Now, if you’re worried, because this can look like some kind of a phishing email. And to be clear, what a phishing email is, is, “Hey, your recent order from Amazon is delayed. Click here to log in to Amazon.” You click, you log into Amazon. And you didn’t actually log in to Amazon, but what you did is it provided your username and password to Amazon to somebody else, that wasn’t an Amazon page you visited.

So for here, you are going to be required to log into Google to be able to officially comment or reply to this thing. What I would suggest is log in to your Google account that you use to manage your GMB before you click on this email. That way you’re already logged in, and it shouldn’t prompt you to log in. So what you’re going to want to do is click on that button to review the request, and then we’re going to deny it or reject it.

Now early on when these first started coming out, when these scams first started popping up, the common reaction was just to delete it. Don’t take any action on that email. And that actually was not the correct information right away. We were guilty of giving some of that information to our clients as well. And basically what can happen is if these scammers are unchallenged, they can then try to verify that business and take ownership of it.

And to be clear what’s happening, there’s not just individual people sitting down, firing off these requests. These scammers are looking for the low-hanging fruit. Just like any other criminal activity or anything else, are looking for the low-hanging fruit, looking for the easy path, the easy mark. And you can see if you’re a potential target for this by just take a second, go Google your business name, whatever your GMB name is. Google that and trigger your Map Pack to show up or the knowledge panel for your business. And if you’ll see down in there it’ll say, “Claim this business,” and you can click that link.

That’s what the scammers are doing. They’re just scouring the internet for Google My business listings and knowledge panels that have this link. Not all of them will. And when they have that, then they’re just trying to claim the business. I’m sorry, they’re trying to request access to then claim the business. So now why would they want to have this? They can sell it to somebody else, they can rename it for some kind of rank and rent website or some kind of spammy website. There’s definitely a lot of reasons. They can hold it hostage and charge you a ransom to get it back maybe, things like that.

But the process on their end, if you do nothing, I think it’s a three to seven day window. If nothing happens, they can then try to verify that location. The owner never responded, this must be unmanaged. Even though it is managed by you, if you don’t do anything, that’s the signal you’re sending to Google is that you’re not there. And they can then try to verify that listing.

Now they’re going to have to get a postcard sent to the address. They’re going to have to go through the same process as you did when you verified the listing originally. But these scammers are smart, they know what they’re doing. It’s possible they have ways to subvert that process, whether they change the address. I’m not going to get super deep into some of these black hat tactics, but there are ways to get a business verified without sending that postcard to the actual address. There is tricky ways to go around it, if you have the right know-how, the right clout maybe on a Google account and some other tactics. These scammers are definitely going to be aware of these tactics.

So if you do not reject that request to grant ownership to your Google My Business listing, there is definitely a chance that they could try to subvert you and claim that listing. It doesn’t mean it’s automatically going to be the case, but for something that is critical as your GMB listing, let’s not leave that to chance. So instead of just deleting it and ignoring it, what we’re going to do is we’re going to click that button to reject their request.

So once you click that blue button, you’re going to come to a page where Google is basically going to give you two options. One is to approve that request, and one is to reject that request. Now to be clear, if you’re working maybe with an agency like Intrix, if you have some person that’s helping you with your Google My Business listing, this could be a legitimate request. Not every request that comes in like this is going to be spammy or a scam.

If you are unaware of anybody else needing access, this is when you want to reject it. Again, if you engage with us and hired us to do your SEO on your Google My Business listing, we will request access, and you’re going to want to approve that. So you don’t want to block somebody who needs legitimate access, just to be clear. But if you’re sure that this person is not affiliated with your organization or any third party that you’re engaged with, then you’re going to want to reject that. Again, those are the two options you’re going to have at Google, you’re going to prove this or reject it.

Now, Google makes it very clear, they say, “Even if you …” This is kind of scary, “Even if you reject this request,” this is a quote on the form from Google. “Even if you reject this request, the person above may still be granted access to the listing if they can complete the verification process,” which sounds horrible.Again, they have to actually complete the verification process, which is going to be tricky. So far, any of our GMBs we manage and the clients we work with, when we’ve rejected it, we’ve never had one to be verified. And I’m not talking about a few things that are going to help you in that way, I think, to stay protected here.

But that’s what you want to do, you want to reject it. And then when you reject it, you’re going to have space to add comments for Google. Take advantage of the spot too. This is where you’re going to start to create that paper trail and actually communicate through Google, not just that you’re rejecting it, but tell them why. Use words like “spam” and “scam” and “junk” and “hijacking my GMB.” And, “It’s already verified, it’s mine. Somebody’s trying to steal it.”

Be very explicit and tell them how fake this is and how nefarious that it is, because you don’t want them to have any ambiguity about who owns this. Make it very clear that this was unauthorized, it’s spam, reject it, block it, it’s fake, et cetera. Type those kinds of comments into that when you send off the rejection request.
Okay. So that’s the actual process, you get that email, you click the blue button, you approve it or you reject it in the way that we just said. Now, as the notification from Google states, even if you reject it, maybe they’re going to get it verified and still take it away from you. There is a school of thought that by doing this you’re sending a message to that scammer and spammer that there is somebody home. It’s almost like if somebody is coming up to your front door, jiggle on the handle to see if it’s open or not. If they see you inside or if they know you’re inside, they’re going to move on to the next target.

Again, what they’re doing here is just phishing, for a target that’ll work. They’re sending off hundreds, if not thousands, of these emails every single day through some kind of bot or automated program. And they’re looking for ones that are going to be able to be taken. So if you’re rejecting it, you’re already sending a signal to them that somebody’s home, somebody’s watching the store. And odds are, they’re just going to move on. So that’s one reason to do it.

Another thing here that you can do is be active in your GMB. What we’ve noticed is, it’s not a guarantee and this is the gray area as the why does Google even show that option to claim this business when it’s already claimed and managed by somebody, is a mystery beyond me. I have no idea. And it really quite frankly sucks that it even shows up to allow this whole process, but it is what it is. Again, this is a free tool put out by Google, this whole Google My Business thing, and take advantage of it but this is one of the downsides of it. They still haven’t fixed this, this is still out there as a loophole.

So what we want to do though to protect against that and to hopefully not have that showing our GMB and our knowledge panel, is to be active in your Google My Business listing. Now I’m making the assumption at this point that you’ve optimized your listing. You’ve added your business description, your services, your products, your attributes, all these areas that Google gives you within your GMB, that you’re taking advantage of these.

We also want to see you posting once a week. Using offer posts, doing event posts, adding photos. You should have a cover image, a logo, interior, exterior, team photos. The more you can use within there, the more signals you’re sending to Google that you are a legitimate and active business. The more signals you send in that way, the less Google should recognize you as needing to be claimed for your GMB.

So again, I have no concrete black and white thing to show you that doing these things makes that link go away to completely avoid this. It’s the case. But what we’re seeing is on the GMBs that are more active in all these areas, we’re just not seeing that show up as often. So there should be some kind of correlation there. And if not, if none of that is true and that’s just happenstance and circumstance that we’re seeing that, still what you’re doing is showing a clear paper trail to Google.

If this ever gets taken away from you somehow, and you’re going through the process to get it back, you should be able to clearly point and show Google like, “Look, I had this listing. It’s been verified since whatever date. I’ve been active, I’ve been posting. We have photos. That’s my building, that’s my logo. This is my team, that’s me in that photo.” Very hard to dispute, right? The more active you’re in there, the more you’re showing proof of ownership essentially.

In addition to that, all those things that I just mentioned are great for your GMB SEO. You want to be doing them anyways. So do all that. One more area here to leave you with is turn on your two-factor authentication for your GMB account, which can be a bit of a pain, if you have to go through a test … Excuse me, a text message and getting a pin. But again, for how critical it is for your GMB, that is something that I would definitely recommend turning on for your business.
So there you go, hopefully that helps you out. If you’ve received these emails, hopefully that gives you some context and some explanation as to what’s been going on. And if you haven’t got one yet, just be on the lookout in the future and now you’ll know what to do if you do encounter that, hopefully this helps you out. And if it does, or even if any of our previous episodes have helped you out, we’d love to get a review from you.

I’m going to read, here are five star review for this episode. This one here comes in from Evelyn Hernandez, very short and sweet, Evelyn, on this one, but it’s great. Just like all of our reviews are, it gets right to the point here. “Great podcast, and so easy to understand and implement for someone who is not so ‘techie.'” And she’s got that in quotes. That’s perfect, that’s what we’re looking to do.

We do have some episodes that are a little more dry. We started talking about Schema with Terry Samuels, that’s techie. Don’t get me wrong, but we’re definitely trying to be approachable for everybody. If you’re just starting out, again, if you don’t have a GMB yet, how do you set one up? How do you optimize it? We’ve got information like that. So we definitely have something for people that are not techie, that are just beginning. Or if you’ve been at this for a while, you’re just trying to understand what your marketing team and your SEO people are doing. Even if you’re not techie, hopefully we helped to demystify that.

So thanks for the awesome review, Evelyn. Everybody else, we’d love to get a review from you too. If you throw one at us, we’re going to read it on the show, give you a bit of a shot out. You can go to localse tactics.com, go down to the bottom, click the button for reviews. And we have all the portals to accept your reviews right there for you. Just a click or two, and you’ll be leaving feedback for us in no time and we really do appreciate it. All right, that wraps it up for this episode, everybody. Take care and we’ll catch up next time.