Google listing scams hitting SA small businesses (and how to spot them)

Here's the short version. Google won't phone you to "save" your listing, it won't ask for your OTP, and it won't charge you to stay on Maps. If someone does any of those things, it's a scam, and the fix is to hang up, press nothing and report it.

That covers the most common of the Google listing scams. But there are a few others doing the rounds, from 1-star floods followed by a WhatsApp demand to strangers quietly swapping your phone number. Below are the five signs to watch for and what to do about each one.

First, what we know about South Africa (and what we don't)

Let's be straight about the evidence. We couldn't find a published South African report on Google listing extortion or hijacks. That doesn't mean it isn't happening here. It may simply not have been written up.

What South African sources do show is a big appetite for social engineering. SABRIC's 2024 crime statistics say digital banking fraud incidents "were the result of social engineering techniques that exploited human error, rather than technical compromises of banking platforms." The SAFPS 2024 report, as reported by Daily Maverick, puts impersonation incidents up 38%, and names Gauteng, KwaZulu-Natal and the Western Cape as the "Fraud Triangle".

And Google reviews have already featured. In 2024 MyBroadband reported a WhatsApp scam that offered people daily pay to write fake Google reviews for two Johannesburg boutique hotels. The hotel said it doesn't pay for reviews, and then got a 1-star review accusing it of buying them. So the business being "helped" got hurt too.

The tactics below are well documented overseas, by Google itself and in US courts. South Africa is not immune.

Sign 1: a call or WhatsApp says your listing will be removed

The pitch goes something like this: they say they're Google, your listing isn't verified, and it will be deleted unless you pay. Sometimes they ask for the code that's just landed on your phone.

Google's Business Profile safety page is blunt about it: "Google will never ask for One Time Password (OTP) or Personal Identification Number (PIN)." It adds that Google "will never try to convince you to pay to maintain your Business Profile. This includes having your Business Profile verified or reinstated." And on its Maps scams page: "there is no cost to create a Business Profile and list your business on Google."

This is an old trick. Back in 2018 the US Federal Trade Commission went after robocallers who told businesses they'd be removed from Google, pointing out that Google's own verification takes minutes and has never cost a cent.

Not sure about a message you've had? Paste it into our scam checker to see the warning signs before you reply.

What to do: Google's advice on callers pretending to be Google is "hang up. Do not press any buttons". Report the caller using the form on that page. On WhatsApp, block and report the number. If you've shared banking details or lost money, phone your bank straight away and open a case at SAPS. If your ID was used, the SAFPS can help.

While we're here: anyone selling a better spot on Maps is selling smoke. Google's own small business post says "There's no way to request or pay for a better local ranking on Google."

Sign 2: a flood of 1-star reviews, then a demand for money

This one is nasty. Google's page on review extortion describes it as "a sudden increase in 1-star and 2-star reviews on your Google Business Profile, followed by someone demanding money, goods, or services in exchange for removing the negative reviews."

What to do: Google's line is "Do not engage with or pay the malicious individuals." Screenshot everything, including the WhatsApp or Telegram messages, and use the extortion report form linked from that page. You can also report each review, though Google says "Review evaluation typically takes several days". Then take the screenshots to SAPS and open a case.

Google says it has started adding protections for review spikes, including pausing new reviews and showing a banner, but its April 2026 post said these were rolling out over the following weeks. We don't know if they're live in South Africa yet, so don't count on them.

If you want a second pair of eyes on a review attack, our review reply and clean-up service helps you report what breaks Google's rules and reply calmly to the rest. Nobody can promise Google will take a review down, and we won't either.

Sign 3: an email says someone wants to own your profile

Out of the blue, Google emails to say someone has asked for ownership or manager access to your Business Profile. If you don't know them, that's a red flag.

Google's ownership request page says "The current profile owner is then notified by email and has 3 days to respond." If you ignore it, the requester "may have the option to claim the profile". Three days goes quickly when the email lands in a spam folder.

What to do: reject it unless you know the person. While you're in there, check who already has access, remove ex-staff and old agencies, and switch on 2-Step Verification for the Google Account that owns the profile.

Sign 4: your number, website or category changes without you

The first you hear of it is a customer saying they phoned your number and someone else answered. Someone has edited your listing.

It happens at scale. In a 2025 lawsuit, Google alleges one group edited listings "at least 1,034 times" across 149 different businesses. Google says it blocked 79 million "inaccurate or unverified edits" in 2025 alone. And on its Maps protection post from 2025, Google says "we removed over 10,000 listings managed by a group of bad actors who impersonated real locksmiths" after they took over unclaimed profiles.

Note the word unclaimed. Google says "unclaimed locations will make your business more vulnerable and prone to hijacks." It has also started emailing verified, active owners about important edits before they go live. If nobody is looking after your profile, those emails go nowhere.

What to do: fix the details in your profile. For fraud involving your name, phone number or website, use the business redressal complaint form linked from Google's page on reporting listings. If customers lost money through a swapped number, keep the evidence and open a SAPS case. Our earlier post on suggested edits to your Google listing shows how edits work and how to keep an eye on them.

Sign 5: a copycat listing, or reviews you think are defamatory

A second listing pops up using your name, or reviews appear that go past "bad experience" into claims you say are false.

What to do: report a copycat listing through Suggest an edit on the fake listing (Google's reporting page explains the options). For content you believe is unlawful, Google has a separate legal removal request. Before you call anything defamatory, speak to a lawyer. We help with the Google side, not the legal side.

And please don't buy reviews to fight back

When a 1-star flood hits, buying a batch of glowing reviews can look tempting. Don't. Google says "If fake engagement is detected, your Business Profile may be subject to posting restrictions." Regulators abroad have cracked down too: the US FTC banned fake reviews in 2024 (US law, not ours). The honest route is the one in our guide to Google reviews in South Africa: ask every customer the same way and reply to reviews calmly.

The boring fix that works

Most of these scams prey on profiles nobody is watching. A claimed, verified profile with tight access and someone checking it regularly is a much harder target. That's the everyday work in our Google Business Profile management, and the plans are on our pricing page.

Had a dodgy call, or not sure who has access to your listing? WhatsApp Shaun on 075 330 9812 and we'll take a look.