How to recover a Google Business Profile controlled by someone else

First identify the type of access problem

Being unable to edit a listing does not by itself prove hijacking. The profile may belong to a forgotten corporate account, founder, former employee, contracted agency or account created through another Google product. Search the business name and city in Google and Maps, open the exact listing and check whether Google indicates that you already manage it. Review the Google Accounts historically used by leadership, marketing and location managers.

Do not immediately create a second profile. Google says there should be only one Business Profile for each business; duplicates can confuse customers and one may stop appearing. Before acting, record the Maps link, name, address, phone, website, category, hours, images and any suspicious changes. That baseline lets the business explain the problem without relying on memory.

• Exact Search or Maps profile link
• Legal and trading names
• Address or service area
• Official phone number and website
• Dated screenshots of unauthorized changes

Use Google's ownership-request process

For a storefront or hybrid business, Google directs an authorized owner to business.google.com/add. After entering the name and address and selecting the existing listing, Google may say that someone else manages it. The Request Access option opens a form that notifies the current owner. For a service-area business without a customer-facing location, Google directs the requester to contact support and choose transfer ownership of the listing.

Under Google's current help guidance, the existing owner has three days to respond. Approval produces an email and access. A denial may be appealed, and public edits can still be suggested. If there is no response, the confirmation email may offer View request and then Verify, although Google warns that the claim option is not always available. Preserve that message because it records the request and provides the route for checking status.

Do not send competing requests from several accounts or publicly threaten the listed owner. Select one authorized corporate account, assemble proportionate evidence connecting it to the business and respond consistently if Google requests additional verification. A contract dispute with an agency and an account intrusion are different problems and may require different legal or security support.

Protect customers while the request is pending

While waiting, check whether the phone, website, hours or booking links divert customers. Preserve each state before suggesting an edit. If there is fraud risk, publish a clear verification route for the official phone, domain and payment methods on controlled channels, but avoid announcing a hack without evidence. A precise warning protects customers better than a broad accusation.

Secure the Google Accounts that should have access: change compromised passwords, enable two-step verification, review devices and sessions and remove unknown recovery methods or forwarding rules. Do not share one password among an agency, reception staff and vendors. Google lets a business add people through their own accounts, so individual access can be removed without changing credentials for everyone.

If the listing displays a scam phone number, fake website or messages requesting payment, treat that as a fraud incident too. Preserve domains, numbers, ads and conversations; warn customers at risk; and use the appropriate hosting, registrar, advertising or safe-browsing processes. Regaining profile ownership does not automatically remove scam copies elsewhere.

Audit owners and managers after access returns

Google distinguishes owners from managers. Owners have full control and can add or remove users; managers can edit information, respond to reviews and manage posts, but cannot administer users or remove the profile. The company should retain primary ownership in a controlled corporate account, give every person named access and reserve owner status for those who truly need it.

New owners and managers must wait seven days before taking certain actions, including removing other users, transferring primary ownership or deleting the profile. Regaining access therefore may not allow every permission to be cleaned up immediately. Record the access date, monitor changes and schedule a permissions review when the limit ends.

Then check the name, category, address, service area, phone, website, hours, attributes, links, photos, posts, products and review replies. Compare the listing with the official website and relevant directories. Do not erase legitimate criticism or post compensating reviews: recovering access should restore accuracy and governance, not manipulate perception.

Prevention for businesses and agencies

Google requires Business Profiles to be verified and managed only by owners or authorized representatives. Its guidelines say representatives should obtain express consent, keep the owner informed, respond to access requests and transfer ownership when asked. An agency agreement should reflect those obligations and define what happens when the relationship ends.

Maintain a quarterly inventory of locations, primary owner, additional owners, managers, recovery account and responsible vendor. Require approval for changes to the phone, domain, name, category or closure status. When someone leaves the organization, remove their access through the offboarding process rather than weeks later.

Monitoring should detect material changes rather than create noise for every Google update. View the listing as a customer would, record changes and assign one person to accept, correct or escalate them. The objective is to prevent an old forgotten account from controlling a critical source of customer trust.

When specialist help makes sense

Seek support when the matter involves multiple locations, merged or duplicate profiles, an agency refusing to transfer ownership, active fraud, impersonation, compromised accounts or a denial requiring appeal. A specialist can organize the evidence, separate ownership, duplicate, security and reputation workstreams and prevent contradictory actions from complicating review.

ReputationGeo.ai does not control Google's decision and cannot guarantee recovery. Eligibility, verification and available options depend on the profile and evidence. If the dispute turns on contract, trademark ownership, unauthorized access or damages, consult qualified counsel in the relevant jurisdiction. For an initial review, send only the public link and a concise explanation—never a password or verification code.

How to turn this guidance into a responsible plan

Begin with evidence, not assumptions. Save the exact URLs, screenshots, publication dates, search phrases, review profiles and AI answers that are creating concern. Record where each item appears, who controls the source and whether the information is inaccurate, outdated, private, misleading or simply unfavorable. These distinctions matter because removal, correction, response, suppression and monitoring are different remedies. A credible adviser should explain those differences before recommending work or discussing timing.

Next, define the audience and the decision at risk. A result seen by prospective clients in Spain may require different language, sources and local signals from a result affecting investors in the United States. Decide which names, brands, locations and search questions matter most. Prioritization prevents a campaign from becoming a vague attempt to control the internet and turns it into a measurable program focused on accuracy, trust and discoverability.

Evidence, people and measurements to prepare

Create a baseline before changes begin. It can include the first two pages of Google for agreed searches, ratings and review volume, visibility of owned pages, recurring themes in AI answers and the status of platform or publisher requests. Keep personal data to the minimum necessary and share sensitive documents only through an agreed secure process. If a legal right may apply, involve qualified counsel in the relevant jurisdiction; reputation strategy does not replace legal advice.

Assign an owner for approvals, factual verification and customer responses. Review progress consistently, but do not judge the program by one daily ranking. Useful measures include corrected or removed items, response completion, the share of credible owned and independent sources, search-result composition, branded query trends and whether public information answers real questions. The objective is a more accurate and resilient digital record, not an artificial promise that criticism will disappear.

Keep a decision record, not just a list of links

For every material item, record the exact source, the factual concern, the person responsible for verification, the proposed route and the reason that route is proportionate. Include the date of any request, response deadline, platform reference number and next review date. This record prevents duplicate or contradictory reports and helps a new decision-maker understand why an item was corrected, challenged, answered, monitored or left alone.

A sound record also separates confirmed facts from interpretations. Label legal questions for qualified counsel, service failures for operational owners and public explanations for communications review. If an item changes, preserve the before-and-after evidence without collecting more personal data than necessary. This discipline is especially important when search engines and AI systems update unpredictably: it shows what actually changed and avoids claiming credit for movements that may have several causes.

• Source, URL, date and affected search or prompt
• Verified facts, disputed claims and supporting evidence
• Chosen route, owner, status and next review date
• Privacy, amplification and escalation risks