Google Enhances Business Profile Protections Against Evolving Scams
Updated guidance details WhatsApp and RCS verification as fraudulent callers increasingly target local business operators.
Google has revised its official documentation regarding fraudulent communications, introducing specific identifiers for modern messaging threats. Last updated on August 3, 2026, the new guidance explicitly addresses the rise of sophisticated outreach via WhatsApp and Rich Communication Services (RCS) that targets local business owners.
We observe that these updates are not merely cosmetic; they represent a significant shift in how Google expects operators to verify their identity. As phishing attempts become more nuanced, the burden of verification is increasingly shifting toward the business owner’s ability to recognize official platform behavior.
What is the new Google Business Profile scams guidance?
The core of the recent update focuses on the diversification of communication channels. Previously, most advice centered on automated robocalls and high-pressure sales pitches regarding "expiring" listings. The updated documentation now highlights how to verify legitimate texts over WhatsApp and RCS messages. This reflects a shift in scammer tactics, moving away from simple phone calls to encrypted or rich-media messaging apps where they can more easily spoof brand elements.
For a dental practice in Leeds or a 12-location HVAC operator, this means that a message appearing in a standard text thread with a Google logo is no longer a guaranteed marker of authenticity. Google now clarifies that while they may use these platforms for certain support functions, they will never demand payment for basic listing services or ask for sensitive verification codes via these channels.
How to identify Google Business Profile scams in the field
Scammers typically utilize a sense of artificial urgency to bypass a manager's critical thinking. Common scripts involve threats that a listing will be deleted within 24 hours or claims that a "verified status" has lapsed. Google’s updated guidance reminds users that the platform does not charge for the creation or management of a standard Business Profile.
We recommend that agencies look for these specific red flags identified in the new documentation:
- Requests for passwords or two-factor authentication (2FA) codes.
- Demands for payment to improve search rankings or maintain visibility.
- Automated voices that do not provide a clear way to opt-out of future calls.
- Messages on WhatsApp from unverified accounts claiming to be "Google Support."
Managing fraudulent outreach for multi-location brands
For larger organizations, such as a regional retail chain, the risk is compounded by the number of employees who may have access to the physical storefront phone. If a technician at one of twelve locations answers a scam call and provides a verification code, the entire digital presence of that branch could be compromised.
Compared to how this worked before, where scams were almost exclusively telephonic, the inclusion of RCS means that employees may now receive legitimate-looking notifications directly on company mobile devices. This requires a centralized reporting protocol where all "support" outreach is routed to a single digital marketing lead or agency partner before any action is taken.
What this means for local businesses
To mitigate the risk of account hijacking and data theft, operators should implement a formal response plan. Based on the updated Google guidance, we advise the following actions:
- Conduct Staff Training: Ensure that anyone answering the business phone or managing the company WhatsApp account knows that Google will never ask for a verification code over the phone.
- Verify via the Dashboard: If a caller claims there is an issue with the profile, hang up and log directly into the Google Business Profile dashboard. Any legitimate critical issues will appear as a notification within the secure platform.
- Report the Incident: Use Google’s official "Report a Violation" form for any suspicious calls or messages. Providing the caller ID or the originating WhatsApp number helps Google's internal teams track and block scam networks.
- Enable Advanced Security: Use Google’s Advanced Protection Program for the primary owner account of the Business Profile to add an extra layer of defense against phishing.
Frequently asked questions
- Does Google ever call businesses directly?
- Yes, Google may occasionally call for automated tasks like verifying holiday hours or confirming business details for Google Maps. However, these calls are typically automated or strictly informational. Google will not call you to sell SEO services, ask for money to keep your listing active, or request your password. If a caller asks for payment or sensitive account information, it is a scam.
- How can I tell if a WhatsApp message from Google is real?
- Google has started using WhatsApp for certain support interactions in specific regions, but these accounts will always have a verified green checkmark. Even with a checkmark, Google will never use WhatsApp to request your verification codes, payment information, or login credentials. If you receive a message that feels high-pressure or asks for sensitive data, treat it as fraudulent and report it through the app's reporting tools.
- What should I do if I accidentally gave a scammer my verification code?
- If you provided a code, your profile may be at risk of being hijacked. Immediately log into your Google Business Profile manager and check the 'Users' section for any unfamiliar email addresses. Remove any unauthorized users instantly. If you have lost access to the profile, you must follow Google's official 'Request access to a Business Profile' process to reclaim it, and consider changing your primary account password and enabling hardware-based two-factor authentication.
Related reading
