Fake Phone Number in a Google Business Profile Photo: What to Do

Overview

A Google Business Profile can show the correct phone number in its official contact field and still send customers toward a scammer.

The attack is surprisingly simple: a third-party contributor uploads an image that visually contains a different phone number. A customer sees the number inside the image and calls it, even though the structured Business Profile phone field is unchanged.

A widely reported September 2026 campaign used AI-generated images containing fraudulent phone numbers across unrelated Google Maps listings. The technique itself is not necessarily new, but the recent pattern is a useful warning for every local business:

audit what customers can see, not only the fields you own.

This guide reflects Google reporting and removal documentation reviewed on September 14, 2026.

First 30 minutes: do these steps in order

If a customer or employee finds a suspicious phone number inside a Business Profile image, treat it as an incident, not a photo-quality problem.

If customers may already be calling the fraudulent number, move customer protection higher on the list. Publish a clear temporary warning through channels you control while the removal request is being reviewed.

1. Do not delete or recreate the legitimate Business Profile. Preserve the real listing.
2. Screenshot the full profile with the business name and visible context.
3. Screenshot the malicious image at the highest useful size.
4. Capture the contributor name or profile associated with the upload, if visible.
5. Record the fake phone number exactly as displayed.
6. Save the date and time you discovered the incident.
7. Save the image share link or URL if Google makes one available in your workflow.
8. Verify your structured phone number, website link and booking link are still correct.
9. Report the image once using the most accurate violation reason available.
10. Create an incident log for report dates, support case IDs, affected locations and outcomes.

Confirm which problem you actually have

Several Google Business Profile problems can look similar at first glance. The response depends on where the wrong number appears.

Preserve evidence before it disappears

Fraudulent user-generated content can change quickly.

The image may be removed, reordered, replaced, or become difficult to find after you report it. That is good for customers, but it can make support escalation harder if you have no record of what happened.

Preserve enough evidence to explain the incident without repeatedly reopening the malicious content.

Your evidence record should include:

For a multi-location business, keep a separate line for each affected location rather than assuming one report covers the entire brand.

• business name;
• Google Maps or Business Profile link;
• affected location;
• date and local time discovered;
• screenshot of the business profile;
• screenshot of the image;
• fraudulent number shown in the image;
• contributor name or profile link, if visible;
• image link, if available;
• report reason selected;
• date reported;
• Google support case ID, if you contact support;
• customer reports connected with the fake number;
• date the image disappears or is removed.

Verify every contact surface before you report

The visual photo scam is dangerous precisely because it can coexist with correct profile fields.

Before reporting the image, verify your legitimate contact routes so you know what customers should use instead.

Check:

Then verify the same information on your own website.

A strong service business contact page gives you an owned reference point you can send customers to if the Google listing is temporarily confusing.

• Business Profile phone number;
• website link;
• appointment or booking link, if present;
• business hours;
• address or service area;
• messaging options, if enabled;
• location-specific contact details for multi-location businesses.

How to report the malicious photo

Google allows business owners and users to report customer-uploaded photos and videos that violate policy.

The exact interface can vary between Search, Maps and device types, but the current official process is built around opening the Business Profile or Maps listing, selecting the offending photo, choosing Report a problem or Report, and selecting the most accurate violation reason.

Depending on the content and interface, relevant reasons may include spam, personal information, privacy concerns, or content that is not actually a photo or video of the place.

Choose the reason that most accurately describes the content you are reporting.

Do not invent a more dramatic category because you think it will be reviewed faster.

Report the contributor when the pattern is abusive

Google's current Business Profile Help documentation says a user profile that contributes policy-violating content can also be reported.

That matters when the malicious photo is not an isolated mistake.

Consider reporting the contributor profile when you can document a pattern such as:

Do not organize a mass-report campaign or ask unrelated people to submit duplicate complaints. Keep the evidence factual and use Google's reporting process.

• repeated fake phone-number images;
• similar uploads to multiple unrelated businesses;
• clearly misleading AI-generated business images;
• other content intended to divert or impersonate customer contact.

When to contact Google Business Profile support

Escalate beyond the normal photo report when the business risk is significant, especially when:

Give support a concise incident summary.

Include:

A clean incident record is easier to escalate than a long thread of screenshots with no dates or context.

• the image remains prominent after the normal review period;
• customers are calling the fraudulent number;
• multiple locations are affected;
• the contributor repeatedly uploads new variants;
• the image returns after removal;
• another structured profile field has also been altered;
• you have customer reports of attempted payment fraud or impersonation.
• the legitimate Business Profile URL;
• the malicious image URL or screenshot;
• the fraudulent number;
• date first discovered;
• date reported;
• report reason;
• affected locations;
• contributor profile, if known;
• evidence that customers are being diverted, if available.

Google review can take time

Google says a reported photo or video is reviewed against its policies and that review can take several business days.

That means you need a customer-protection plan while the content is still visible.

Do not promise staff that the image will disappear immediately. Do not tell customers Google has already removed it until you verify the public listing yourself.

Protect customers while removal is pending

When there is a credible risk that customers are being diverted, use channels you control to make the legitimate contact route unmistakable.

Depending on the seriousness of the incident, that can include:

Keep the message simple.

For example:

Our official phone number is the one published on our website. We are aware of an unauthorized image on a third-party map listing that displays another number. Please use our website or confirmed contact details for bookings and payments.

Avoid repeating the scammer's number in promotional posts unless there is a clear safety reason. The objective is to direct customers to the official channel, not give the fraudulent number more visibility.

• a temporary notice on your website;
• a notice on the contact page;
• a social post from your official account;
• a short email to customers with active appointments, if appropriate;
• a staff script for incoming calls;
• a notice in appointment confirmations when there is a direct customer-safety need.

If customers may already have contacted the fake number

Ask staff to document credible customer reports without turning every unusual call into a fraud investigation.

Record:

If a customer reports actual financial loss or disclosure of sensitive financial information, advise them to stop contact with the fraudulent party and use the appropriate bank, payment-provider, platform and local fraud-reporting channels for their situation.

Do not try to recover a customer's money by negotiating with the number shown in the malicious image.

• when the customer called the fake number;
• what the person answering claimed;
• whether payment was requested;
• whether personal or account information was requested;
• whether the customer sent money;
• whether the customer was redirected to another website or messaging service.

Do not rely on these shortcuts

Audit all business photos, not just the newest one

A useful incident audit separates photos into three groups:

Look for:

A normal Google Business Profile photo audit is still useful after the incident. See Google Business Profile photos for service businesses for the non-fraud side of photo management.

• phone numbers;
• URLs;
• QR codes;
• payment instructions;
• WhatsApp or messaging handles;
• altered logos;
• fake support notices;
• AI-generated signs or storefronts;
• text that asks customers to contact a different business.

1. owner-uploaded photos;
2. customer-uploaded photos;
3. images you cannot immediately classify.

Multi-location businesses need a location-by-location response

A malicious contributor may target several locations or unrelated businesses with the same visual template.

Do not assume that checking the brand's flagship listing is enough.

For every location:

A shared incident spreadsheet can help identify whether the attack is isolated or patterned.

• open the public profile as a customer would see it;
• scan recent and prominent customer photos;
• verify phone, website and booking links;
• record suspicious content separately;
• report each violating image through the appropriate listing;
• note whether the same contributor appears repeatedly.

Monitor after the image disappears

Removal is not the end of the incident.

For at least the next week, check the affected listing daily for:

After the immediate risk passes, move the check into a regular local-presence routine.

A sensible long-term cadence for a small business might be weekly or whenever staff notice unusual customer-contact behavior.

• re-uploads of the same image;
• slightly altered versions;
• a new contributor account;
• changes to structured phone or links;
• customer questions about the fake number.

Build a simple local-profile incident playbook

A future incident should not depend on one person remembering what they did last time.

Document:

That turns a stressful surprise into a repeatable response.

• who owns primary Google Business Profile access;
• who monitors user photos;
• where screenshots are stored;
• who submits the first report;
• who is allowed to contact Google support;
• how staff confirm the official phone number;
• which owned website page is the source of truth;
• who can publish a temporary customer warning;
• how incidents are closed and reviewed.

Frequently asked questions

Keep an owned source of truth for customers

A Google Business Profile is valuable, but it is still a third-party surface where other users can contribute content.

Your own website should make official contact information, services and booking paths easy to verify.

OneStudio helps service businesses manage their website, booking flow, customer records and business operations in one place. It does not remove Google Maps content or police third-party contributors, but it gives the business an owned destination customers can use when an external listing becomes confusing.

Explore OneStudio features, keep your official contact details current, and make your website the place customers can verify how to reach you.