Fake Google Maps listings hijack real business addresses

Drug dealers in London have been creating fake “pharmacy” listings on Google Maps at addresses they do not operate from, including a coffee shop and an office building used by the accountancy firm PwC, to advertise illegal goods. A London Centric investigation published on 18 September 2026 found the listings used AI-generated shopfront photos, and that no one at the real addresses knew their location had been co-opted. For any brand that manages locations on Google, it is a reminder that a real address is no guarantee the pins attached to it are all yours.

What happened

London Centric reported that dealers registered listings under the search term “pharmacy” tied to real London addresses, then used them to advertise cocaine, ketamine, cannabis, counterfeit banknotes and firearms. The fake listings carried AI-generated images of storefronts. Another claimed to be a two-storey riverside building with a giant marijuana leaf over the door. Reporters visited six locations, among them a Soho sexual health clinic, a coffee shop and a central London office used by PwC, and found no one aware that their address appeared on Maps as a place to buy drugs. Asked about the findings, Google said it encourages people to report inappropriate content, which helps it keep the information on the service authentic and reliable.

“Nobody at any of the locations had any idea that their address was listed online.”

London Centric

Why it matters

Fake and hijacked listings are a brand-integrity problem, not just a map clean-up problem. When a fraudulent pin attaches itself to a real address, or impersonates a category a brand competes in, it pollutes the local results customers see and chips away at trust in the map itself. This is not a one-off: in March 2025 Google said an investigation had uncovered more than 10,000 illegitimate listings, including fake businesses and legitimate profiles that had been hacked or hijacked, and it sued an alleged network of scammers over fake profiles. Google has said it acts once alerted to fraud. Cheap, convincing AI-generated photos now make fake fronts faster to spin up than platforms can take them down, which shifts the burden onto brands to watch their own presence.

What this means for multi-location brands

At enterprise scale, no central team can eyeball every pin across hundreds or thousands of locations, so listing integrity has to be a monitored, automated discipline rather than a manual one. Claim and verify every location, then keep location listings accurate and centrally governed so a rogue pin or a duplicate stands out against a clean baseline. Watch for impersonation and misattributed activity with reputation monitoring across the whole estate, and use the business locations data API to detect unauthorised changes in bulk instead of one profile at a time.

The same hygiene that makes a brand findable is what protects it: a Google Business Profile that is verified, complete and consistent is easier for search and AI answers to trust, and makes an impostor at your address quicker to catch. Treat it as an operational control, and fold fake-listing checks into ongoing Google listing management rather than reacting after a customer reports something wrong.

The bottom line

Verification gets a brand onto the map, but it does not keep the map honest around it. As AI makes convincing fakes cheap, the brands that stay trusted will be the ones monitoring their listings across every location, ready to catch and report a fraudulent pin before customers do.