Recovering Control When a GBP Hijacking Triggers a Duplicate Flag
How bad actors exploit automated system conflicts to lock legitimate owners out of their profiles.
The GBP hijacking duplicate flag represents a sophisticated evolution in local search fraud, where attackers exploit Google’s automated cleanup tools to lock out legitimate business owners. This tactic involves more than a simple password breach; it leverages the system's own internal logic against the merchant. Last updated: February 21, 2025.
Recent reports indicate that bad actors are successfully gaining access to verified profiles, altering core data, and then intentionally creating conditions that cause Google to flag the listing as a duplicate. Unlike a standard suspension, a duplicate flag often renders the profile invisible or unmanageable in the primary dashboard, leaving the rightful owner with no clear path to remediation through standard support channels. The attacker effectively uses Google's automated hygiene processes to camouflage their activity.
The anatomy of a duplicate flag hijacking
The exploit typically begins when an unauthorized user gains manager or owner access, often through a phishing attempt or a compromised third-party integration. Once inside, the hijacker does not simply change the phone number; they strategically alter the address or name to match another entity or create a 'shell' profile first.
We have observed cases where a hijacker creates a secondary, low-quality listing with nearly identical information. They then suggest an edit to the original, verified profile to match this new shell. Google’s algorithms, detecting two profiles for the same business at the same location, trigger the 'Duplicate' status. The system then defaults to the hijacker-controlled version or merges the data in a way that strips the original owner of their administrative rights. This process effectively weaponizes Google’s efforts to maintain data integrity.
Consider a dental practice in Leeds that has operated for a decade. A hijacker might claim a nearby abandoned office space, name it identically, and then suggest an edit to the original practice's address to match the new location. Because Google's primary concern is removing redundant listings, the system may merge the two, giving the hijacker full control over the Leeds practice's 500+ reviews and ranking history. Compared to a standard 'Suggested Edit' which a merchant can decline, this merge often happens without a 48-hour approval window, leaving the owner blindsided.
How does the duplicate status prevent recovery?
When a profile is marked as a duplicate, it enters a state of digital limbo. In a standard hijacking, a business owner can usually request access back through the 'Claim this business' flow. However, if the listing is flagged as a duplicate, that flow often breaks. The merchant may receive a message stating the profile is already managed by another user, but the 'Request Access' button may be missing because the system does not allow management of a profile it considers redundant.
For a 12-location HVAC operator in Chicago, this could mean losing years of reviews and search history in an instant across an entire service region. Because the 'duplicate' status is an automated safeguard, human reviewers at Google Support often struggle to untangle which profile was the original and which was the fraudulent clone. The hijacker relies on this administrative friction to maintain their hold on the listing. While platforms like Bing Places require manual verification for mergers, Google’s high-velocity automation creates a gap that attackers exploit to bypass standard security protocols.
Recovery workflows for a GBP hijacking duplicate flag
To regain control, owners must treat the situation as a data integrity dispute rather than a simple password recovery. The first step is identifying the 'Master' profile in Google's eyes. If the hijacker’s shell has become the primary listing, the original owner must prove the shell is the fraudulent entity. This is often difficult because the 'Original' profile may have been deleted or disabled by the system during the merge.
We recommend gathering historical evidence, such as the original CID (Customer ID) number and past verification emails. A local business should document that their Google-verified history predates the creation of the duplicate. The goal is to force a 'de-merge' or a reinstatement of the original CID while simultaneously reporting the hijacker's email address for fraudulent activity. This requires reaching out to the specialized 'Business Redressal' team rather than general support agents who may not have the permissions to un-merge CIDs.
What this means for local businesses
This vulnerability highlights the need for stricter internal security and proactive monitoring of profile changes. If you find yourself locked out due to a duplicate flag, follow these steps immediately:
- Document the Evidence: Capture screenshots of the duplicate listing, the current hijacked state, and any notifications regarding unauthorized access. Use tools like the Google Maps URL to find hidden CID numbers.
- Identify the CID: Locate the original CID of your verified profile from your browser history or old performance reports to prove your historical ownership. This is your most valuable piece of evidence.
- Initiate a Data Integrity Appeal: Contact Google Support specifically citing 'fraudulent merge' or 'hijacking via duplicate' rather than a general suspension appeal. Request a 'manual CID review' to compare the age of the accounts.
- Audit Management Permissions: Immediately remove any unknown users and change the primary owner's Google account password, ensuring two-factor authentication is active on all manager accounts.
- Monitor for Re-merging: Even after recovery, hijackers may attempt to trigger the flag again. Monitor your profile status daily for 30 days following a successful recovery to ensure the attacker hasn't left a 'backdoor' manager account active.
Are Google's automated systems enough to prevent this?
Comparatively, other platforms like Yelp or Bing Places for Business have more manual friction points that make this specific type of automated 'loophole' harder to exploit. Google’s reliance on high-velocity automated edits allows these changes to occur faster than a human can intervene. The scale of the Google ecosystem is its greatest weakness in this scenario; with millions of edits daily, the system prioritizes removing duplicates over verifying the intent behind the merge.
While Google has introduced new video verification requirements to curb fraud, these often apply only to new listings. The hijacking of existing, high-authority profiles remains a lucrative target because the 'Duplicate' flag acts as a smokescreen. The industry needs a more robust 'lock' feature for core business data that requires a 24-hour waiting period or multi-factor confirmation before a name or address change can trigger a merge event. Without this, even a secure password cannot protect a business from a malicious 'suggested edit' that triggers an automated merge.
FAQ
What is a CID and why is it important for recovery?
A CID (Customer Identification) is a unique string of numbers Google uses to identify a specific business entity in its database. When a profile is hijacked and flagged as a duplicate, the original CID may be hidden or replaced. Recovering your original CID from old bookmarks, Google Ads reports, or browser history is critical because it allows Google Support to see the long-term verification history of your business. This proves you are the rightful owner who existed before the hijacker created the duplicate 'shell' profile.
How can a hijacker get access to my profile to trigger a merge?
Attackers often gain access through social engineering, such as sending emails that look like official Google notifications asking you to 'verify your information' or 'review a new manager request.' They may also exploit compromised third-party marketing tools that have API access to your Google Business Profile. Once they are added as a manager, they wait several days before changing the business name or address to match a duplicate listing, which triggers Google's automated merge and duplicate flag system.
Why won't Google Support just give my profile back immediately?
Google’s support team often relies on the same automated tools that the hijacker exploited. When a profile is flagged as a duplicate, the system technically sees two identical businesses and chooses one as the 'truth.' If the hijacker has successfully verified their version of the profile, the support agent sees two verified owners and may not have the historical context to know who is legitimate. You must provide a clear 'paper trail' of your original CID and verification dates to overcome this automated bias.
Can I prevent my business from being flagged as a duplicate?
While you cannot entirely stop others from creating fake listings, you can harden your profile by ensuring you have only one Primary Owner and that all Managers use physical security keys or two-factor authentication. Regularly audit your 'Users' list in the GBP dashboard. Additionally, monitoring your business on Google Maps for 'ghost' listings — secondary profiles with your same name or phone number — can help you report and remove duplicates before a hijacker has the chance to trigger a merge event.
Sources
Frequently asked questions
- What is a CID and why is it important for recovery?
- A CID (Customer Identification) is a unique string of numbers Google uses to identify a specific business entity in its database. When a profile is hijacked and flagged as a duplicate, the original CID may be hidden or replaced. Recovering your original CID from old bookmarks, Google Ads reports, or browser history is critical because it allows Google Support to see the long-term verification history of your business. This proves you are the rightful owner who existed before the hijacker created the duplicate 'shell' profile.
- How can a hijacker get access to my profile to trigger a merge?
- Attackers often gain access through social engineering, such as sending emails that look like official Google notifications asking you to 'verify your information' or 'review a new manager request.' They may also exploit compromised third-party marketing tools that have API access to your Google Business Profile. Once they are added as a manager, they wait several days before changing the business name or address to match a duplicate listing, which triggers Google's automated merge and duplicate flag system.
- Why won't Google Support just give my profile back immediately?
- Google’s support team often relies on the same automated tools that the hijacker exploited. When a profile is flagged as a duplicate, the system technically sees two identical businesses and chooses one as the 'truth.' If the hijacker has successfully verified their version of the profile, the support agent sees two verified owners and may not have the historical context to know who is legitimate. You must provide a clear 'paper trail' of your original CID and verification dates to overcome this automated bias.
- Can I prevent my business from being flagged as a duplicate?
- While you cannot entirely stop others from creating fake listings, you can harden your profile by ensuring you have only one Primary Owner and that all Managers use physical security keys or two-factor authentication. Regularly audit your 'Users' list in the GBP dashboard. Additionally, monitoring your business on Google Maps for 'ghost' listings — secondary profiles with your same name or phone number — can help you report and remove duplicates before a hijacker has the chance to trigger a merge event.
Follow us in Google
See Map Observer first in Top Stories
Google lets you choose the publications you want to see more of. Pick Map Observer and our local search reporting is surfaced higher in Top Stories — and badged as preferred in AI Overviews and AI Mode — whenever you search.
Related reading
