Your listing shows someone else's phone number, your access is gone, or a “manager” you never added is making changes. This is recoverable — but the clock matters. Here's the playbook.
By John Traugott, founder of RankFrost · Updated July 2026
The short answer
First, find out which kind of hijack you're dealing with. If you still have access, open your profile's user settings and look for owners or managers you don't recognize — remove them, change your Google password, and turn on two-step verification. If you've lost access entirely, go to the Google Business Profile site, find your business, and click through “Request access” — Google emails the current owner, and if they don't respond within about a week, you can often claim it back with proof you're the real business. And if someone merely edited your public info (a rerouted phone number is the classic scam), suggest the correction as an edit and report it. Every path works better with documentation ready: your business license, utility bill, and photos of your signage.
Knowing which one hit you decides which fix to run.
Run these in order — most hijacks are resolved by step 3 or 4.
Secure your Google account first. Change your password and turn on two-step verification before anything else. If the attacker is inside your account, every other fix can be undone behind you.
Audit the user list. In your Business Profile settings, review every owner and manager. Remove anyone you don't recognize — and check that the PRIMARY owner is still you, because a manager can't remove an owner.
Fix the public listing. Correct any changed phone number, website, or hours directly. If you can't edit, submit the corrections as suggested edits from the public listing while you work on access.
Request access / ownership. Locked out? Search your business at the Google Business Profile site and click “Request access.” The current holder gets about seven days to respond; silence usually means you can proceed to claim it with proof.
Escalate to Google support with evidence. If the request stalls, contact Business Profile support with your documentation: business license, utility bill at the address, photos of signage, and screenshots of the hijacked state. Persistence wins these — polite, documented, repeated.
Watch it for 30 days. Hijackers retry. Check your info weekly for a month, keep two-step verification on, and never approve access requests you didn't initiate.
Signs: edits you didn't make (phone, website, hours), a suspension notice for changes you never made, review replies you didn't write, or losing access outright. A rerouted phone number is the most common and most damaging change — check yours from the public listing today.
Yes. Use the “Request access” flow on the Google Business Profile site. The current holder has about a week to respond; if they don't, Google typically lets you verify with documentation that you're the real business at that address.
Simple cases (removing a rogue manager, fixing a bad edit) take minutes to days. Ownership disputes run one to several weeks, driven by the ~7-day response window plus support review. The documented and persistent get their profiles back.
Almost never permanently. Reviews belong to the listing, not the person holding it, so recovering the profile recovers the reviews. If reviews seem gone during the mess, see why reviews disappear.
Yes — that's the public-edit attack. Anyone can suggest edits to any listing, and Google sometimes applies them automatically. It's why you should check your own public listing monthly even when everything seems fine.
Two-step verification on every account with access, a quarterly audit of your user list, remove ex-employees and old agencies promptly, and always be the primary owner of your own profile — let helpers be managers, never owners.
Book a free 30-minute call. I'll figure out which kind of hijack you're dealing with, walk you through the exact recovery path, and help you lock it down for good — no obligation.
Request a Free Call →