How Do You Secure Your Google Business Profile From Hijacking?
Key takeaways
- A Business Profile hijack is usually credential theft or an over-privileged agency account, not a flaw in Google itself.
- A dedicated owner account with a hardware-backed second factor removes the most common cause of Indian GBP hijacks.
- Changing the profile's phone number and website is the attacker's goal, because calls and search traffic then route to the attacker.
- 41% of India's largest companies have not enforced the strictest DMARC policy, and the same email-forwarding trick is used to hijack a business email domain.
- A monthly check of the profile's phone, website and manager list should be on the same calendar as the patch cycle.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
How are Google Business Profiles actually hijacked in India?
The pattern is consistent enough to describe. Step one is credential capture, most often by phishing a Google sign-in, and increasingly with a fake consent screen that looks like a Google Business Profile manager invitation. Step two is access through a shared agency or employee login, where one compromised account can change the primary owner. Step three is the payload: the attacker changes the primary phone number, replaces the website, and edits the business name or category so that a clone profile can be created and appear more legitimate. Step four is monetisation, either through fraudulent call handling, a fake enquiry flow selling to the business's customers, or a cloned listing that harvests bookings. The I4C's nationwide alert on deepfake-based fraud is a reminder that a hijacked profile with the right display image is a convincing lure.
What access model should a business use for its profile?
One owner account, held by a named person, with a hardware-backed second factor, and everything else issued as a staff or agency account with a named role. No shared logins, no shared phone verification, and no agency account that can claim ownership. Review the manager list monthly and remove anyone whose work has ended. Enable Google's two-step verification with a security key rather than SMS, which is the same lesson as the hardware security key advice that applies across your other accounts, and which matters more here because Google will not let you remove the primary owner while a two-step method is missing.
How do you spot a hijacked profile quickly?
Three checks. The first is the phone number: if it differs from the number on your invoices and your website, treat it as an incident. The second is the website link: an unfamiliar or parked domain, or a change to a lead-capture page, is a red flag. The third is the business name and category: a renamed or recategorised listing is a common precursor to a clone. Run these checks on a fixed day each month and after any staff change, and photograph the result, because the dispute process with Google needs a dated record of when the change happened. If you have already been hijacked, preserve the emails from Google's automated notifications, because they carry the timestamp that supports a reinstatement request.
What should I do if my profile is hijacked today?
Act in this order. First, secure the Google account: reset the password from a clean device, revoke the attacker's sessions, and enrol a hardware security key. Second, reclaim the profile, using Google's business profile support with a pre-filled claim. Third, restore the phone number and website, and document everything with timestamps. Fourth, tell your customers through a channel the attacker does not control, because a hijacked profile is also a fraudulent call to your customers. Fifth, report the impersonation, and if money has been taken, report on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call 1930. If the hijack was used to seed a scam site, the amended IT Rules 2026 give you a route to seek removal of AI-generated impersonation content within 3 hours of a report.
| Role | Who holds it | Second factor | Can change primary owner |
|---|---|---|---|
| Primary owner | Business owner or director | Hardware security key | Yes, with re-verification |
| Manager | Named staff, individually | Authenticator app | No |
| Agency account | Named marketing contact | Authenticator app | No |
| Shared login | Not permitted | Not applicable | Not applicable |
What are the common questions about G?
Get a straight answer on this
Send us your Business Profile manager list and the email domain you use, and we will return a fixed-price account security review with a written scope.
Send us the details See pricing