Is Your Google Business Profile Hijacked? Here Is How to Tell and What to Do

The signs that point to a real hijacking, not a stray edit

• You can no longer sign in to manage the profile, or your edits stop saving.
• The listed primary owner has changed to an account you do not recognize.
• Multiple fields changed together (phone, website, and category at once) rather than one field drifting.
• You received (and possibly missed or ignored) an ownership-request notification from Google shortly before losing access.

If none of those apply and only one field looks wrong, you are far more likely dealing with a public suggested edit that went live automatically. That's a different, more common, and less serious problem, covered in our guide to unauthorized edits.

How it actually happens

The most common path is the "Claim this business" or ownership-request flow inside Google's own system. A bad actor requests ownership, and if the current owner ignores the notification, does not respond within Google's review window, or the account already looks unmanaged, the request can be approved. The other common path is credential compromise: an old marketing agency, a former employee, or a phishing attempt gets hold of the login for the Google account that manages the listing.

What to do the moment you suspect it

• Don't wait to "see if it fixes itself." Report it to Google immediately through the Business Profile support flow as an ownership or access dispute, not as a simple edit request.
• Document everything you can: screenshots of the current (wrong) listing state, any communication from the party who took access, and the date you first noticed.
• If a company calls offering to "restore" your listing for a fee shortly after this happens, treat that as a major red flag. It's a documented scam pattern reported repeatedly in the support community, not a legitimate recovery service.
• Change the password and enable two-factor authentication on any Google account that had access, in case the entry point was compromised credentials rather than the ownership-request flow.
• Once you regain access, immediately review and clean up the Users list. Remove anyone you do not recognize.

Why prevention matters more here than anywhere else

Recovering from a real hijacking through Google's support process can take days, and every day it's unresolved is a day your leads may be going to someone else. Two-factor authentication and a clean, current Users list close off the two most common entry points before they're ever tested. The other half, knowing the moment something changes rather than days later, is not something you can do by checking manually.

ProfileWard watches your profile continuously, so a hijack attempt is caught in minutes instead of days, before your leads have a chance to go anywhere else.