Google Sues Scammers Behind Thousands of Fake Business Listings on Maps

By Samantha Kelly featuring comments by Professor Josephine Wolff, Associate Professor of Cybersecurity Policy and Director of the Hitachi Center for Technology and International Affairs at the Fletcher School

Google is suing a network of scammers who manipulated Google Maps by faking or hijacking about 10,000 business listings to con people out of money. The main defendant named in the lawsuit is a Maryland man who allegedly played a central role in the scheme by helping coordinate teams of scammers around the world to carry it out.

The lawsuit, first reported by CBS News, states the man for two years “abused Google services to create fake online listings for businesses that do not exist and to bolster them with fake reviews from people who do not exist.” It also claims the man engaged in a “lead-generation” scheme by selling information to other scammers about the people he lured in by his fake business listings.

A common scam involved a victim calling a business, such as a locksmith, found on Google Maps, only to be rerouted to a different number. That number would connect them to an unrelated locksmith, who could charge an inflated price for the service once they arrive at the home. “This behavior misleads consumers and is likely to erode their trust in Business Profiles on Google as a reliable and safe way to find and contact local businesses,” the company said in the lawsuit.

Google said it received a complaint from a locksmith in Texas who was impersonated on Google Maps, and then started a deeper investigation into what uncovered a larger trend. The company used automated scanning tools and a dedicated analyst team to investigate complaints and suspicious activity, uncovering thousands of fake profiles or hijacked business accounts that had been taken over by scammers.

Google removed these fake listings from Google Maps, blocked the accounts that created them, and filed legal action in response. However, the lawsuit said the scheme by the Maryland man remains “active and ongoing” with his latest scam attempts against businesses in the Washington DC area within the last few weeks.

“Fake business listings are prohibited on Google Maps, and we use a range of tools to protect businesses and users,” Google general counsel Halimah DeLaine Prado said in a statement sent to CNET. “This litigation builds on our efforts and sends a clear message that impersonation schemes will not be tolerated.”

To avoid falling victim to these scams, Prado advised on “CBS Mornings Plus” this week that users visit ScamSpotters.com to look up the latest warnings. She also recommended checking URLs to ensure they match the legitimate business, pausing if asked for unnecessary personal information like a Social Security number for a mailing list, and watching out for misspellings, wire transfer requests or demands for gift card payments.

Time consuming to detect

Josephine Wolff, an associate professor of cybersecurity policy at Tufts University, said it’s not unusual for one person or a small group to generate a lot of scams or fake reviews and listings given how easy it often is to automate that process, especially with the introduction of large language models.

“That ability to scale up means that these efforts can have a very significant impact on a lot of people — and these scams can be very time consuming to detect given how many reviews and businesses are listed on services like Google Maps,” she said.

She noted how, in one part of the Google lawsuit, the company had to track down people leaving reviews for various businesses in different states and even countries about the issue.

“Automated tools may be able to help flag those types of incidents, but actually going through to see how plausible the reviews are requires a fair bit of effort,” Wolff said. “So it’s a big deal not just that this fraud was happening on a large scale, but also that Google took the time and trouble to root it out and file the lawsuit, most likely as a warning to other scammers that there can be consequences for this type of behavior.”

(This post is republished from CNET.)