Google Business Profile hijacking in India: owner account takeover, clone listings, fake enquiry scams, and the two-factor access setup that stops the hijack.
A Google Business Profile hijack is usually an account-takeover, not a hack of Google. The attacker steals the owner account credentials, or uses an agency or employee account with too much privilege, then changes the phone number, the website and the address of a listed business. For an Indian local business the damage is immediate: calls go to the attacker, who redirects them to a fraudulent enquiry service, and the profile seeds a scam site. The baseline defence is a dedicated owner account with a hardware-backed second factor, named-role staff access, and a monthly check of the profile's phone.
The pattern is consistent enough to describe. Step one is credential capture, most often by phishing a Google sign-in, and increasingly with a fake consent screen that looks like a Google Business Profile manager invitation. Step two is access through a shared agency or employee login, where one compromised account can change the primary owner. Step three is the payload: the attacker changes the primary phone number, replaces the website, and edits the business name or category so that a clone profile can be created and appear more legitimate. Step four is monetisation, either through fraudulent call handling, a fake enquiry flow selling to the business's customers, or a cloned listing that harvests bookings. The I4C's nationwide alert on deepfake-based fraud is a reminder that a hijacked profile with the right display image is a convincing lure.
One owner account, held by a named person, with a hardware-backed second factor, and everything else issued as a staff or agency account with a named role. No shared logins, no shared phone verification, and no agency account that can claim ownership. Review the manager list monthly and remove anyone whose work has ended. Enable Google's two-step verification with a security key rather than SMS, which is the same lesson as the hardware security key advice that applies across your other accounts, and which matters more here because Google will not let you remove the primary owner while a two-step method is missing.
Three checks. The first is the phone number: if it differs from the number on your invoices and your website, treat it as an incident. The second is the website link: an unfamiliar or parked domain, or a change to a lead-capture page, is a red flag. The third is the business name and category: a renamed or recategorised listing is a common precursor to a clone. Run these checks on a fixed day each month and after any staff change, and photograph the result, because the dispute process with Google needs a dated record of when the change happened. If you have already been hijacked, preserve the emails from Google's automated notifications, because they carry the timestamp that supports a reinstatement request.
Act in this order. First, secure the Google account: reset the password from a clean device, revoke the attacker's sessions, and enrol a hardware security key. Second, reclaim the profile, using Google's business profile support with a pre-filled claim. Third, restore the phone number and website, and document everything with timestamps. Fourth, tell your customers through a channel the attacker does not control, because a hijacked profile is also a fraudulent call to your customers. Fifth, report the impersonation, and if money has been taken, report on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call 1930. If the hijack was used to seed a scam site, the amended IT Rules 2026 give you a route to seek removal of AI-generated impersonation content within 3 hours of a report.
| Role | Who holds it | Second factor | Can change primary owner |
|---|---|---|---|
| Primary owner | Business owner or director | Hardware security key | Yes, with re-verification |
| Manager | Named staff, individually | Authenticator app | No |
| Agency account | Named marketing contact | Authenticator app | No |
| Shared login | Not permitted | Not applicable | Not applicable |
A Google Business Profile hijack is usually an account-takeover, not a hack of Google. The attacker steals the owner account credentials, or uses an agency or employee account with too much privilege, then changes the phone number, the website and the address of a listed business. For an Indian local business the damage is immediate: calls go to the attacker, who redirects them to a fraudulent enquiry service, and the profile seeds a scam site. The baseline defence is a dedicated owner account with a hardware-backed second factor, named-role staff access, and a monthly check of the profile's phone.
It usually can, but the claim is stronger with evidence. Reinstatement requests are far more successful when you can show the dated record of the original profile, the invoice trail for the business address, and Google's own notification emails showing when the change happened. Recovering the owner account first, rather than appealing from a locked account, is the step that most people skip.
Manager access is fine and owner access is not. A manager can edit posts and hours but cannot remove the primary owner or transfer the profile. Give each agency contact a named manager login with an authenticator app as the second factor, and review the manager list monthly.
Stop giving them a password. Use Google's role-based access with individual logins, enable two-step verification on every account, and remove access the day someone leaves. Shared credentials defeat every log and every access review you might run later.
Your domain registrar, the domain DNS account, the business email domain, and the bank portal. 41% of India's largest companies have not enforced the strictest DMARC policy, and a business email domain that can be spoofed is the same class of weakness as a hijacked listing.
The first hours matter, because the damage is call traffic and search impressions. At AAVETech retainer clients are engaged within 4 hours for emergencies and 12 hours otherwise, and we can start with credential recovery and evidence capture before the account is re-secured.
Read the full guide on AAVETech: How Do You Secure Your Google Business Profile From Hijacking?.
Send us your Business Profile manager list and the email domain you use, and we will return a fixed-price account security review with a written scope.
Talk to an analyst about this.