When a customer reaches someone pretending to be you
Consider this constructed complaint. A customer says they found your business on Maps, followed its website link and paid a deposit. Your team has no booking. The website repeats your logo and staff biographies, but the domain and payment instructions belong to someone else.
The Maps listing carries a disputed link. A separate website copies your identity. The customer may have lost money. Each needs an owner and a separate response.
If money has been lost, ask the affected customer to contact their bank immediately. If your own accounts show signs of unauthorised access, involve your IT or security owner and use the relevant official recovery channel now. ASD's business email compromise recovery guidance calls for immediate financial and cyber reporting where email compromise is suspected. Don't delay urgent escalation while collecting a perfect evidence pack. A copied website alone doesn't establish that anyone accessed your accounts.
Give reviewers evidence they can assess and customers a reliable route to your business. Track provider action separately from report submission.
Establish what the evidence actually shows
A similar name can belong to another genuine organisation. An old phone number can be an ordinary error. Describe the observable behaviour before deciding how to report it. Copied identity details combined with a diverted contact or payment route give a reviewer more useful evidence than an accusation without supporting records.
Google's guidance on reporting a business on Maps separates ordinary information edits from misleading listings and suspected fraudulent names, phone numbers or URLs. Use that distinction to choose the initial route. The table below is our triage guide.
| Case | Evidence | Route |
|---|---|---|
| Genuine namesake | Independent businesses share a name | Namesake diagnostic |
| Ordinary wrong fact | Stale contact or panel details | Profile edit or panel correction |
| Suspicious Maps listing | Copied identity and diverted contact details | Maps report or eligible redressal complaint |
| Copied website | Copied identity and unauthorised payment details | Host and domain-abuse reports |
| Possible account compromise | Unrecognised logins or account changes | Security owner and account recovery |
If both organisations are genuine, check confusion between two genuine businesses. For an innocent panel error, correct an inaccurate Knowledge Panel. If your own listing has disappeared or become inaccessible, diagnose your existing Business Profile before treating it as a fake listing.
Describe the observed copying and diverted contact details as suspected impersonation. Criminal intent requires separate evidence.
Capture a report-ready evidence pack
A reviewer needs to locate the content and understand what it misrepresents. Our recommended evidence pack keeps the observation, genuine business details and customer impact together. Store it privately with access limited to the people handling the response.
- Save the exact page URLs and the public Google Maps listing URL. A search query or screenshot alone may leave the target ambiguous.
- Record the observation date, local time and time zone. Save screenshots showing the address bar or listing context alongside the disputed content.
- Quote the copied name, logo, biography or other identity element. Record the phone number, domain, email or payment instructions that differ from your approved details.
- Describe observed customer impact. Separate a customer's report from what your team has independently confirmed.
- Include proof of the genuine identity, such as your established website, approved contact page and relevant business records.
- Name the report owner and the provider receiving each report. After submission, save the reference, receipt or dated copy of what you sent.
In the constructed example, the evidence record might say that the genuine business uses example.com, while the disputed Maps link opens example.net. At a recorded time in AWST, the second site displayed the same staff biography and a different deposit instruction. The customer reported making a payment. The team hasn't independently confirmed the recipient. Both domains are reserved for examples.
That wording separates visible copying from an unverified financial claim. The reporting owner can supply private supporting records where relevant without publishing the customer's name, bank details or messages. Redact personal information from anything shared more broadly.
Capture only what you can safely observe. Don't enter credentials, download suspicious files or make a test payment to strengthen the report. Ask your security owner to handle evidence that requires deeper investigation.
Report the suspicious Maps listing through the right route
For a place whose offensive, harmful or misleading information makes you believe it may not exist, Google's misleading business reporting instructions direct you to open the listing, choose “Suggest an edit”, then “Place is closed or not here”, select “Offensive, harmful, or misleading” and submit. Follow the current help page if the interface changes.
For suspected fraudulent activity involving a business name, phone number or URL, use the Business Redressal Complaint Form. The form excludes straightforward factual corrections. Its visible content selector includes address and title wording, but its stated eligibility remains fraudulent activity involving the name, phone number or URL. Match the complaint to that stated scope.
At the time of checking, the form asks for your full name, contact email, the impacted organisation, the disputed content, a public Maps location URL and a detailed explanation. It also offers an optional file upload. Use the public listing URL copied from the relevant Maps result. Quote the exact disputed content and explain how the phone number or website could affect users or the business, as the form requests.
For the constructed complaint, identify the copied business name and disputed URL, show the genuine domain and explain the reported diverted enquiry or payment. Keep the explanation specific enough for someone unfamiliar with your brand to assess it.
The Business Redressal form says action is not guaranteed and you won't receive status updates. Save your submission evidence and check the live listing separately. A quiet inbox doesn't establish whether the content has changed.
Report the copied website to the responsible providers
Scamwatch's business impersonation guidance recommends identifying the website's host and reporting the impersonation through that provider's reporting channel. Use the provider's official abuse route, describe the copied identity and supply supporting evidence. Request removal and track the response.
The host handles the website service. The registrar handles the domain registration. They may be different organisations, so record each recipient and request separately. A Maps complaint addresses Maps content. A search result pointing to a copied site still leaves the hosted website to be addressed with the responsible provider.
For a fake domain incorporating your registered business name or a misspelling of your domain, ASD's domain-reporting guidance describes identifying the registrar through a lookup and contacting its abuse channel. Include the disputed domain, its resemblance to your genuine domain and any copied business details. That guidance sits within email-compromise recovery. Apply its relevant domain-reporting advice without treating website copying as proof of email access.
If the issue becomes a dispute over domain rights or intellectual property, involve a qualified legal adviser and check the applicable authority's current process. Keep that decision with the person authorised to act for the business. This article doesn't establish ownership rights or a legal entitlement to removal.
Scamwatch also recommends reporting scam websites to the National Anti-Scam Centre. Keep that report alongside provider reports, with each recipient's role recorded. Check what remains accessible before marking the incident resolved.
Give customers a reliable way to verify your business
Scamwatch recommends warnings on genuine business channels, a customer reporting process and informed customer-service staff. Decide who approves the notice and make the genuine domain and contact method easy to verify. Publish only claims the business can confirm.
A constructed notice could read, “We've received reports of a separate website using our business identity. Our website is example.com. If you're unsure about a booking or payment request, type that address into your browser and use the contact details published there. Please send suspected impersonation reports through our contact page. If you've already paid someone you suspect is impersonating us, contact your bank immediately.”
Match the notice to how your team actually sends booking and payment requests. Give staff the same approved wording and a private reporting destination so customer accounts reach the response owner. Avoid reproducing a clickable malicious URL in the warning.
Use your contact and About pages to maintain a clear record of your genuine business. If the team can't publish or maintain a verification notice because of CMS access or template limitations, that's a defined reason to improve the website's verification and publishing foundations. Immediate warnings can still use other genuine channels while that constraint is addressed.
Follow each outcome through to the next decision
Track four outcomes separately. These checks are our management guidance, with no promised response time or search result.
- Submission recorded. Save the recipient, date, evidence sent and any reference or receipt. Assign an owner and next review date.
- Provider action observed. Check whether the disputed listing, page or domain has changed. Record what you can see and any provider response separately.
- Search result checked. Repeat the relevant query and inspect its destination. Record the query, surface, time and remaining discrepancy without assuming that host action has already changed every result.
- Customer harm reviewed. Record new reports, unresolved customer concerns and referrals to the appropriate financial or security owner. Keep personal information private.
Once immediate reports are underway, audit the third-party sources carrying your business details if incorrect identity information persists elsewhere. After official reporting, an SEO review can investigate persistent search representation problems. Agree which sources and search surfaces need investigation. Removal decisions and legal disputes stay with the relevant providers and qualified owners.
Return the continuing checks to your process for monitoring business information across search and AI. At the next review, the named owner should identify the unresolved observation, check its evidence and take the next action with the party able to address it.