A fake Google Business Profile scam call works when a busy employee believes the caller has authority over the business listing. This 2026 guide gives teams a short training method that stops callers from taking access, payment or verification details.
Why this matters
A caller can claim that a Google Business Profile is unverified, at risk of removal, receiving bad reviews, or due for a paid upgrade. The message is designed to produce one unsafe action: sharing a verification code, granting account access, following a link, installing software or paying a fee.
The actual topic is bigger than one platform. ASD’s social-engineering guidance, updated 9 April 2026, says attackers can spoof caller ID, impersonate staff or executives, and use voice cloning or deepfakes to sound convincing. Staff need a response that works even when the caller knows the business name, address and listing details.
Cyber Aware security awareness training gives MSPs short, story-driven lessons and tracked completion. The objective for this scenario is clear: no one validates a caller by the number displayed on the phone or by their confidence.
What you will need
Prepare these items before the first training session in 2026:
- A named owner and backup owner for the business’s Google Business Profile.
- The official Google account used to manage the profile, with access limited to approved administrators.
- One published callback rule: employees never use a number, link or screen prompt supplied by an unexpected caller.
- An internal route for reporting suspicious calls, emails and text messages.
- A 20-minute team briefing and three 5-minute practice scenarios.
- A list of actions that require a second person’s approval, including adding users, changing recovery details and payments.
Do not ask reception, sales or customer-service staff to decide whether a caller is genuinely from Google. Their job is to pause the conversation, collect minimal information and use the approved escalation route.
1. Define the protected actions
List what a caller is trying to make the business do. In a Google Business Profile scam call, the risky action is often not obvious. It might be reading out a one-time passcode, giving a remote-support operator access to a device, sharing a login prompt, confirming card details, or changing an administrator email.
Make the list visible at the point calls are received. A receptionist needs a different prompt from an administrator, but both need the same decision rule: no sensitive action happens during an unsolicited call.
Use this script in training: “I cannot make account or payment changes on an incoming call. I will have the profile owner review this through our normal process.” The script takes under 15 seconds and does not invite a debate.
Expected outcome: employees recognise that the requested action, not the caller’s story, determines the risk.
Common mistake: limiting the lesson to payment requests. Account recovery codes and remote access can be more damaging than a small fee.
2. Teach the independent callback rule
The independent callback rule is the centre of the programme: end the unexpected call, then use a trusted channel already controlled by the business. Sign in to the known Google account from a saved bookmark or ask the designated profile owner to check it. Do not search for a support number while the caller waits, and do not use a number in a voicemail, text or email.
ASD says people should verify unexpected requests using a known, trusted contact method. Its guidance also warns that caller ID can be spoofed, so a familiar-looking number is not proof of identity.
Set a 10-minute target for escalation after a suspicious call. The call recipient records the displayed number, claimed organisation, time, request and any email or text sent by the caller. The profile owner decides whether any legitimate action is needed.
Expected outcome: staff move the decision to a channel the attacker does not control.
Common mistake: putting a caller on hold while searching online, then returning to the same caller. That is not an independent verification.
3. Give staff a safe call-ending script
People share information when they feel trapped by urgency. Give them words that end the call without apologising or explaining internal processes.
Use one of these scripts:
- “I do not make profile changes from incoming calls. Please send the request through the verified account process.”
- “I cannot provide verification codes or account details by phone.”
- “Our profile owner will check the account directly. I am ending this call now.”
Run the script twice in the session: once against a polite caller and once against a caller who claims the profile will be removed in 30 minutes. The right response remains identical. Urgency is a reason to verify, not a reason to comply.
Cyber Aware phishing simulations reinforce the same principle across email. The platform tracks who reports a simulation as well as who clicks, so a report-first culture does not stop at phone calls.
Expected outcome: staff can exit a pressured conversation in less than 30 seconds.
Common mistake: asking the caller to prove they are legitimate. A skilled scammer will keep the employee on the line and provide more convincing material.
4. Practise the four common pressure tactics
A training programme should rehearse pressure, not teach staff to memorise a script for one exact scam.
- Removal threat: the caller says the listing will disappear today unless the recipient confirms a code.
- Review threat: the caller says negative reviews or a ranking problem can be fixed after an immediate payment.
- Verification lure: the caller says an SMS code is needed to confirm the listing owner.
- Support takeover: the caller says a browser tool or remote-access session is needed to repair the profile.
For each role-play, require three actions: end the call, report it internally and let the profile owner inspect the account through its normal sign-in. Do not role-play an actual access code, real password or live account.
The Australian Government’s Scamwatch warns that impersonation scammers use spoofing to make calls appear to come from legitimate numbers. That makes “the number looked real” a detail worth recording, not a reason to trust the call.
Expected outcome: employees recognise the tactic even when the story or service changes.
Common mistake: testing staff with only obvious threats. Start clear, then increase realism after the report route is familiar.
5. Lock down ownership outside the training room
Training cannot compensate for vague account ownership. Document who owns the business profile, who has admin access, where recovery information is maintained and which changes require approval.
Review administrators monthly in 2026. Remove access for people who changed roles or left the organisation, and use the account’s security settings to review recent activity. The profile owner should also maintain a short contact list for finance, IT and marketing, because scammers often try one department after another.
A gap assessment can place account ownership, verification and escalation in a broader security review. It supports custom questions mapped to Essential 8, ISO 27001 and NIST, which helps MSPs turn a call-scam scenario into a documented control discussion.
Expected outcome: a caller cannot exploit uncertainty about who can approve a change.
Common mistake: giving every marketing or customer-service employee administrator access for convenience.
6. Report and preserve the call details
The receiver should report the call internally as soon as it ends. Record the time, claimed organisation, displayed number, request, account details named, any follow-up message and whether any code, payment, information or device access was provided.
Do not call the number back. Do not click a follow-up link. If money was transferred, contact the bank immediately through a known contact method. If credentials, access codes or account recovery details were shared, the account owner should change the relevant credentials, revoke sessions where available and follow the incident response process.
ASD’s social-engineering guidance says to report suspected attempts immediately to the organisation’s cyber security or IT support team and preserve the communication for investigation. For a scam attempt, use the official Scamwatch report form after internal containment is underway.
Expected outcome: the business can identify a repeat attempt and respond if the caller reached another employee.
Common mistake: deleting a voicemail, text or email follow-up before it is saved in the incident record.
7. Measure the behaviour every month
Measure what the team does, not just who completed training. Track suspicious-call reports, median time from call to report, report quality, and the number of staff who use the callback rule correctly in short drills.
Cyber Aware human risk reporting combines training completion, failed quizzes and phishing outcomes into a Human Risk Score. The score is not a verdict on an employee; it tells the manager where short follow-up is needed.
Review the data monthly in 2026. If reception reports calls quickly but marketing staff do not, assign the next 3-minute lesson to marketing. If the team still searches for the caller’s number while on the phone, repeat the independent callback drill.
Expected outcome: the organisation finds and fixes the decision point that remains weak.
Common mistake: measuring only the number of scam calls received. The leading signal is how quickly the first useful report arrives.
Troubleshooting
The caller knows the business address and opening hours
Treat public details as context, not authentication. Those details are widely available on business listings and websites; use the callback rule anyway.
The caller says the listing will be removed today
End the call and have the profile owner sign in through the known account. A deadline supplied by an unsolicited caller does not change the verification process.
An employee shared an SMS code
Assume the code was intended to authorise a change. Report it immediately, review account access and recovery settings, and change credentials where appropriate.
The caller sent a follow-up email from a familiar-looking address
Do not use its link or number. Preserve the email and inspect the account through the saved bookmark or known management process.
The team has no named profile owner
Assign a primary and backup owner before the next training session. No account should depend on an employee’s personal knowledge.
Tools and resources
- ASD social-engineering guidance, updated 9 April 2026, covers vishing, caller-ID spoofing and independent verification.
- Scamwatch accepts reports of scam attempts and losses.
- Cyber Aware awareness training provides short lessons, quiz tracking and reminders.
- Cyber Aware phishing simulations extend report-first practice to email-based social engineering.
FAQ
What is a fake Google Business Profile scam call?
It is an unsolicited call that claims to manage, verify, remove or repair a Google Business Profile in order to obtain money, access, a code or sensitive information.
Should staff give a Google verification code to a caller?
No. Staff should never read a verification code to an unexpected caller. End the call and have the approved profile owner inspect the account directly.
Can caller ID prove a Google Business Profile call is real?
No. Caller ID can be spoofed, so a familiar-looking number is not proof of identity. Use a trusted, independent account-management route instead.
What should staff do when a caller says a listing will be removed?
End the call, report it internally and have the profile owner sign in through a known bookmark or account process.
How often should staff practise scam-call response in 2026?
Run a 5-minute call-scam drill each quarter and add the callback rule to onboarding.
What happens if an employee shares an account code with a scammer?
Report it immediately, review account access and recovery settings, reset relevant credentials and follow the incident-response process.
One last thing
The best scam-call defence is not a better argument with the caller. It is an employee who can end the call in 15 seconds and move the decision into a trusted channel.