Scammers Are Hiding Phone Numbers in Google Maps Photos — And Reports Aren't Sticking

There is an active scam running against Google Business Profiles that most owners will never spot in a rank tracker, an audit tool, or a Search Console report. It happens entirely in the photo gallery.

Scammers are using the Google Maps contributor program to upload AI-generated images to business listings, with a phone number rendered into the image itself. A customer opens the listing, sees a photo that looks like the business, reads the number printed across it, and calls it. They reach the scammer instead of the business.

Why this one works

Every defence a business has been told to build is aimed somewhere else.

The listing's actual NAP data is untouched. The phone field is correct. Nothing in the profile has been edited, so no ownership alert fires and no verification flow is triggered. The attack surface is the one part of a Business Profile that anyone on the internet can add to without permission and without any claim of ownership.

And it targets the most trusting moment in the whole local journey. Someone who has scrolled to the photos has already decided they want this business. They are not evaluating the number; they are dialling it.

There is a second reason it works: a phone number inside a JPEG is not text. It isn't in the profile data, it isn't crawlable in the way a listing field is, and detecting it requires reading the image. That's a materially harder problem than spotting an edited phone field, which is presumably why these have persisted.

The scale, and the part that should worry you

Reports describe the same numbers appearing across dozens — plausibly hundreds — of listings, with at least one contributor account operating at volume rather than picking off single targets. This is being run as a campaign, not as opportunism.

The more troubling detail is what happens after businesses report it. Owners describe reporting the photos through the standard flow and getting no meaningful action. The scam appears to be built on that assumption: that the gap between reporting and removal is wide enough to keep the phone ringing.

That's the part with implications beyond this specific scam. If contributed-photo abuse can be reported and simply sit there, the reporting mechanism isn't a control. It's a formality.

Google does run machine-learning detection over contributed content, and has publicly described tackling exactly this pattern — numbers overlaid on contributed photos to redirect calls. The systems exist. The complaint from business owners is about enforcement speed, not about whether Google is aware of the technique.

What to actually do

Look at your photo gallery. Today, and then on a schedule. Not the ones you uploaded — the ones other people did. Most owners have never opened the "by customers" tab. Any image with a phone number visible in it that you did not put there is hostile until proven otherwise.

Check every location, not just the flagship. A multi-location business is a wider target, and the branches nobody watches are the ones worth attacking.

Report the photo, then follow up rather than assuming. Given what's being reported about response times, treat a submitted report as the start of the process. If you have a Google Business Profile support channel or an agency partner with escalation options, this is what those are for.

Watch your call volume for a quiet drop. This scam is invisible in your analytics by design — the calls never arrive, so there's no anomalous event to see. What you'd notice is call volume falling while impressions and profile views hold steady. If you track calls at all, that divergence is your only early warning.

If you run local for clients, add this to your monthly check. It takes under a minute per listing and there is currently no automated alternative.

The wider point

Local SEO has spent years treating the Business Profile as a data problem — get the categories right, get the hours right, keep the NAP consistent. This is a reminder that the profile is also a surface other people can publish to, and that user-generated content on your listing is part of your attack surface whether you monitor it or not.

Reviews got that attention years ago because the damage was visible. Photos haven't, because until now the worst case was a bad picture.

Sources

• Search Engine Roundtable: Google Maps Business Profiles Phone Number in Photo Scam
• Google Maps Community: Abuse of Google Business Profiles using fake photos and fake phone numbers
• Google: Maps 101 — how we tackle fake and fraudulent contributed content
• Google: How Google Maps uses AI to fight fake Business Profiles