Details
- Vector type:
- GMB Attack
- Risk level:
- Moderate
- Impact level:
- Moderate to High
Basically the concept here is simple: Find your target’s business listing either in the Google My Business system or one of the many business directories out there, and either suggest “Edits,” like new phone numbers or a change of address, and watch was your victim’s traffic and income from that directory dry up.
Alternatively, take control of their listing and really wreak havoc.
The Google My Business system is notoriously brittle and I’ve (Sasch) personally taken charge of clients’ business listings without any verification at all, as recently as December 2023. I essentially said “This is my business and I want to edit its details.” and GMB went “Okidoke. Go right ahead.” So I have first-hand experience of how easy it is to interfere with small and medium business listings, unless there’s someone keeping watch over what’s happening.
Defense
The worst thing here is that there’s literally nothing quick you can do if someone hijacks your business listings in the GMB system. The process of trying to reclaim what’s rightfully yours can take months. And if you’re reliant on it as a source of income, a hijack like that can prove to be fatal to your company.
With other directory operators you’re usually able to contact them and make corrections and reports.