The Business Profile Was Hijacked
Why this matters
For many residential shops the map listing is the phone. A homeowner with a leaking water heater searches, taps the listing, and calls whatever number it shows. If someone else controls that listing, they control where your calls go, and they can do it for days before anyone notices, because the phone simply goes quiet. This case follows a six-person appliance repair shop through it in the order that matters: stop the bleeding first, then work out how it happened, then get the listing back and keep it.
The signal
On a Thursday the office manager mentioned the phones had been slow all week. The call log confirmed it: the shop usually takes about 9 inbound calls a day, and from Monday to Wednesday it had taken 6, 5 and 4. Slow weeks happen. Then a regular customer called the office line directly, annoyed: she had searched for the shop, called, and a man had come out, quoted roughly three times the shop's usual price for a dryer repair, and asked for payment by a money transfer app. He was not from the shop.
The owner searched for the shop on his phone. The listing had the right name, photos and reviews, and a phone number nobody recognized. The website link went to a page that was not theirs. The hours said open 24 hours.
Stop the bleeding before diagnosing
Two things were bleeding at once: calls going elsewhere, and customers being visited by someone using the shop's name. The second is the more serious, because a stranger is going into homes on your reputation.
Warn the customers who might have been reached. The shop could not know who had called the false number, but it could reach its own recent customers and anyone with an open job. The office texted and emailed every customer from the last 60 days from the shop's own accounts: our listing was tampered with, our only number is the one in this message, we never ask for payment by a money transfer app, and if someone visited claiming to be us please call. Two more customers called back; one had let the man in and paid a deposit.
Report the impersonation. The owner filed a police report that afternoon, with the customer's account and the false number, and gave the report number to the customer who had paid so she could dispute the transfer with her bank or app. Customers deceived by an impersonator are also worth pointing to the FTC's fraud reporting site and your state attorney general's consumer protection office.
Put the real number everywhere you control. Website header, booking page, social accounts, the email signature, a pinned post. None of these fix the listing, but a customer who checks a second source finds the right number.
Submit a public edit on the listing. Most map platforms let anyone suggest a correction. The owner suggested the correct phone and website from a personal account. Sometimes this is accepted within hours; sometimes the hijacker reverses it. It cost five minutes and was worth trying.
Do not call the false number to argue. It tells the hijacker you have noticed and gains nothing.
The customers the impersonator reached
Legally, the shop did not do that work and is usually not responsible for it, though how far that holds depends on your state and the facts, so a customer threatening to sue is a question for your attorney. Commercially, the customer believes it was you, and she will tell her neighbors either way. The owner decided to offer each affected customer a free visit to inspect what the impersonator did, and that decision turned out to matter for a reason beyond goodwill.
The customer who paid a deposit had a gas dryer, and the impersonator had "repaired" it by pulling it out and pushing it back. On the inspection visit the tech smelled gas before touching anything. He had the customer and her family leave the house without operating any switches, lights or appliances, called the gas utility's emergency line from outside, and waited at the curb until the utility had shut off the supply and cleared the house. The flexible connector had been kinked and cracked when the dryer was shoved back. Any shop offering these visits should brief its techs that the work they are walking into was done by someone with no training, and treat every gas, venting and electrical connection the impersonator touched as suspect until tested.
How it happened: reading the notification trail
With the bleeding slowed, the question was how a stranger got control. Three explanations are common, and they need different recoveries:
- Someone logged in as a manager, using a phished or reused password.
- Someone requested ownership through the platform and was granted it because nobody responded.
- Someone created a duplicate listing and got the real one marked closed or merged.
The owner could not see the listing's history; the shop was not a manager on it. That itself was the first clue. The listing had been created years earlier by a technician, since departed, using his personal email. When the owner reached him, he logged in and found these notifications, none of which he had opened:
To: (former tech's personal inbox)
Mar 02 Someone has requested ownership of
"Ridgeline Appliance Repair". Respond by
Mar 09 to keep control.
Mar 09 Ownership request approved. You are no
longer the primary owner.
Mar 10 Edit published: phone number
Mar 10 Edit published: website
Mar 11 Edit published: hours
That eliminated the first explanation: no login to his account, and no manager change except the ownership transfer. It eliminated the third: there was one listing, not two, and it was the original with its reviews intact. What happened was the second. The hijacker requested ownership, the request went to an inbox nobody watched, the response window ran out, and the platform handed it over. Nothing was hacked. The shop had left its most important customer channel in the hands of a former employee's dormant email, and the platform's process worked exactly as designed against it.
The timing fits: March 10 and 11 fell on a weekend, and the calls began falling on Monday, the first weekday after the phone and website edits. Call volume on a listing does not drop the instant a number changes, because some customers have the old number saved or come by referral; the drop gets deeper as more of the week's callers are new searchers.
Getting it back
Recovery runs through the platform's ownership process, not through argument. As of 2026 the large map platforms each have a request-ownership flow and a business support or redress form; the exact steps and verification methods change, so read the platform's current help pages rather than relying on a forum post.
Request ownership from a shop-owned account. Not the owner's personal login and not the office manager's, but a dedicated shop account with multifactor, recorded in the account inventory. See related: The Account Inventory Every Shop Should Keep.
Be ready to verify. Platforms verify by some combination of a video showing the business location, signage, vehicles and tools; a code mailed to the address; a phone call or text to a number on the listing (useless here, since the hijacker holds it); and business documents. Gather them before you start: the business registration or license showing the name and address, a utility bill for the address, and photos of the trucks with the shop's name. Name, address and phone must match across them, so a shop whose documents show an old address should fix that first.
File the support report too. Use the platform's form for a listing that has been taken over, attach the police report number, and describe the sequence plainly: former employee's account held primary ownership, ownership was transferred on this date by request, phone and website then changed. Keep every case number and the date in a log.
Plan for days, not hours. The shop got ownership back on the ninth day after discovery. The verification video was accepted on the fourth; the rest was waiting. During that time the public edit had been accepted and reverted twice.
What would have changed the outcome
A shop-owned primary owner. If the shop's own monitored account had been primary owner, the ownership request would have landed in an inbox someone read, and declining it is one click. This is the single control that prevents this case. Ask every listing's current owner to transfer primary ownership to a shop account; for one held by a departed employee, the offboarding procedure is where this gets caught. See related: The Employee Offboarding Digital Access SOP.
Two managers, both shop people. Owner and office manager, so one person on holiday does not leave requests unanswered.
A weekly glance at the listing. Search the shop by name from a phone every Monday and check the phone number, website and hours. Thirty seconds. The listing's phone had been wrong since the weekend; a Monday check would have caught it on the first day of the call drop, three days before the customer called.
A suspicious call-volume trigger. A drop of a third or more against the usual weekday count, two days running, is worth a search of your own listing before anything else. Here that rule fires on Tuesday: 6 calls on Monday and 5 on Tuesday against a usual 9, drops of 33 and 44 percent.
When it is not a stranger
If the evidence points to a competitor or a lead-generation outfit (they sometimes take over listings to sell your calls back to you or to other shops), the recovery steps are the same, but the conversation after it is not. Deceptive use of your business name can raise claims under state unfair-competition and consumer protection laws, which differ by state, and possibly federal trademark law if your name is registered. That is a question for a business attorney, and the record you kept during recovery (notification trail, edit history, call log, customer accounts, police report) is what you walk in with.
If customers have left reviews about the impersonator's work under your name, report those reviews through the platform once ownership is back, explaining the takeover. See related: Fake Review Extortion and Review Bombing.
References
- See related: Recovering a Hacked Business Social Account
- See related: The Account Inventory Every Shop Should Keep
- See related: The Employee Offboarding Digital Access SOP
- See related: Customers Got Texts Pretending to Be Your Company
- FTC consumer guidance on reporting impersonation fraud, and your map platform's current help-center pages on ownership requests