Listing Hijacking

For any business that depends on local search — a restaurant, a plumber, a dental practice, a law firm — a hijacked listing can mean days or weeks of lost calls, misdirected customers, and revenue damage while you work through Google's recovery process. Prevention takes 10 minutes. Recovery can take weeks.

What is listing hijacking?

Listing hijacking is an attack on your Google Business Profile that exploits gaps in Google's identity verification process. Google allows anyone to suggest edits to a business listing and allows anyone to claim ownership of an unverified or abandoned listing.

Attackers exploit this in three main ways:

1. Ownership claim. An attacker submits a claim saying they own the business. If your listing is unverified, Google may approve the claim automatically. The attacker now has full editing access.
2. Bulk edit spam. Attackers submit "suggest an edit" corrections (a public feature) repeatedly. Google's automated system sometimes approves these edits without manual review — changing your phone number or hours without your knowledge.
3. Third-party management access. If you previously granted an agency or contractor management access to your GBP and never revoked it, a disgruntled former partner can make changes or remove your owner access.

Why listing hijacking matters for local businesses

A hijacked listing doesn't just create an embarrassing inaccuracy — it actively damages revenue in real time:

1. Phone calls go to competitors. The most common hijack changes the phone number. Customers who find your listing in Google Maps and call the number reach a competitor's line or a disconnected number. They rarely call back — they just call the next result.
2. Customers arrive at wrong locations. Changing the address sends customers to a competitor's location or an empty lot. For restaurants and retail, this means walk-in customers who don't return.
3. Permanent closure flags suppress ranking. Marking a business as "permanently closed" removes it from local pack results immediately. Even after reversal, listings may take days to reappear in Local Pack rankings.
4. Review manipulation becomes possible. An attacker with owner-level access can respond to reviews as your business, flag legitimate reviews for removal, or post fake responses that damage brand perception.
5. Recovery is slow. Google's GBP support process for reclaiming a hijacked listing typically takes 3-14 business days. During that window, your local SEO traffic is impaired or gone.

How listing hijacking actually works

Understanding the mechanics helps you defend against them.

The ownership claim attack

The bulk edit attack

Types of listing hijacking attacks

Real listing hijacking examples

Locksmith targeted by spam operators

A locksmith in Chicago had their GBP phone number changed to a call center that redirected to an out-of-town locksmith. The business owner didn't notice for 11 days. During that window, customers who called from Google Maps reached a competitor. The business estimated losing 40-60 calls — approximately $8,000-12,000 in lost revenue — before discovering the change via a regular dashboard audit.

Multi-location restaurant chain: 60% GBP impressions lost

A 12-location restaurant chain had 3 of its locations marked as "permanently closed" via bulk edit spam over a weekend. The listings were removed from Local Pack results for those locations within 24 hours. After recovery, the chain implemented weekly GBP audits across all locations and saw a 60% increase in GBP impressions at those locations within the first quarter — recovery combined with active optimization.

Law firm: category change buried their ranking

A personal injury law firm had their primary GBP category changed from "Personal Injury Attorney" to "General Contractor" by a competitor's spam campaign. The category mismatch removed them from Local Pack results for personal injury searches within days. Recovery required Google support intervention to restore the original category — a 5-day process.

Listing hijacking vs GBP spam — what's the difference?

6 best practices to prevent listing hijacking

1. Verify your listing with postcard or video — not phone. Phone verification is the weakest form. Postcard or video verification creates a harder ownership record that's more difficult for attackers to dispute. If your listing is currently phone-verified only, upgrade it.
2. Enable two-factor authentication on your Google account. The Google account managing your GBP must have 2FA enabled. A compromised Google account is a direct path to listing access.
3. Audit your GBP dashboard weekly. Set a recurring calendar reminder. Check: primary category, phone number, hours, address, website URL, and the list of managers. Takes 3 minutes. Catches changes before customers do.
4. Set Google Alerts for your business name. Create a free Google Alert at google.com/alerts for your exact business name. You'll receive an email if your business name appears in new web content — which often precedes or accompanies a hijack attempt.
5. Audit manager access quarterly. Remove any former agencies, employees, or contractors from your GBP manager list. Go to GBP → Settings → Managers and remove anyone no longer working with you.
6. Use a dedicated Google account for GBP, not a personal account. If your personal Google account gets compromised, your GBP shouldn't. Keep them separate, and keep the GBP account credentials locked down.

Common listing hijacking mistakes to avoid

• Ignoring GBP dashboard notifications — Google sends emails when edits are suggested. These often get filtered to spam. Check your Google account's notification settings.
• Granting owner access to agencies without tracking it — agencies need manager access, not owner access. Owner access means they can remove you. Always set agencies as managers, never as owners.
• Not documenting your original listing data — before a hijack happens, screenshot your full GBP profile: NAP, category, attributes, hours. This becomes your evidence for Google support if recovery is needed.
• Using a personal email for GBP management — personal email accounts are targeted for phishing. A dedicated Google Workspace account with strong security is significantly safer.
• Waiting for customers to report problems — by the time a customer tells you they called a wrong number, you've already lost dozens of calls. Proactive weekly audits are the only reliable detection method.

Frequently asked questions

Related glossary terms

Sources

Akshay VR

Marketing Head · theStacc · ex-Sr Marketing Specialist, ARKA 360 · Malappuram, Kerala

Akshay leads editorial and content operations at theStacc. He writes about local SEO, content operations, and the specific vulnerabilities that cost businesses organic traffic and local visibility.

LinkedIn Author page More terms by Akshay