Google adds ways to spot fake Business Profile messages

Google has refreshed the guidance it gives businesses on spotting fraudulent calls and texts about their Business Profiles, adding new ways to tell a genuine Google message from a scam. The update, flagged across the industry on 3 August 2026, spells out how legitimate Google contact can arrive over WhatsApp and RCS in the countries where Google uses those channels, and repeats the line that matters most: Google never asks a business to pay for its profile or hand over sensitive information by phone. For brands whose location managers field these calls every week, the refreshed signals are a small but useful line of defence.

What happened

According to Google Business Profile Help, real automated calls from Google concern operational tasks, checking a listing’s information on Maps, confirming prices and availability, making reservations, or scheduling appointments, and the caller says up front that they are from Google and why. For messages, Google now points to platform verification: legitimate texts come from WhatsApp accounts named “Google Maps” or “Google Maps” followed by a country name and carrying the blue verification checkmark, or from RCS accounts registered as “Google”.

The warnings are blunter. Google’s guidance states that its operators will “never ask you for payment information over the phone or guarantee you a special spot in our products”, and that “Google will never ask you for private or sensitive information”. If a call is suspicious, the advice is to hang up without pressing any buttons; for a suspicious text, do not click any links and verify independently using trusted contact details rather than anything in the message.

Why it matters

“Google will never ask you for private or sensitive information.”

Google Business Profile Help

Scam calls and texts that impersonate “Google support” are an old problem that has not gone away, and the pitch is always some version of pay us to fix or protect your listing. The refreshed guidance is worth noting because the tell has moved: where Google uses WhatsApp and RCS for real contact, the verification checkmark and the exact account name become the thing to check, and anyone who has not been told to look for them is easier to fool.

What this means for multi-location brands

For a single owner this is a personal-vigilance issue. For a brand with hundreds or thousands of locations it is a governance one, because every location manager who can touch a profile is part of the attack surface. A scammer only needs one branch manager to believe a “Google” caller and hand over access or a verification code. The exposure scales with the estate, and so must the defence.

The practical controls are structural, not heroic. Keep profile access centralised and permissioned rather than scattered across local logins, so a single social-engineered manager cannot surrender the keys, and manage the estate through the Business Profile API and bulk tools rather than one-off calls and manual edits. Give location teams a simple, standing rule: Google does not phone asking for payment or codes, and legitimate messages carry the verified WhatsApp or RCS badge. And route the genuine operational work, hours, information accuracy, and responding to customers, through a governed listings management system, so staff are not conditioned to act on unexpected calls in the first place. Consistent, centrally managed profiles are both the security posture and the operational one.

The bottom line

The scam has not changed, but the signals for spotting it have. Multi-location brands should push the new verification cues to every location team and, more durably, shrink the attack surface by governing profile access and management centrally rather than one branch at a time.