Business directory listings are one of the cheapest ways to get found online, which is precisely why scammers have turned them into a hunting ground. Understanding the mechanics of these schemes — not just the warning signs — is the fastest way to protect your business and your customers.

What does a fake listing scam actually look like in practice?

The most common version starts with a bad actor creating a duplicate of your real business listing on a directory site — same name, same category, sometimes even stolen photos from your website — but with a different phone number or address that routes to the scammer instead of you. A roofing company in Atlanta discovered this when several customers called to complain about a crew that had collected a deposit and never showed up. The customers had dialed a number from what looked like the company’s Google Business Profile, but was actually a cloned listing someone had created on a secondary directory that outranked the real one for a specific search phrase. The scammer pocketed roughly $4,200 in deposits over three weeks before anyone connected the dots.

A related variant is listing hijacking, where a scammer doesn’t create a new listing but instead submits an “edit” to your existing one through a directory’s open-edit system. Platforms that allow community edits — think Yelp, Yellow Pages, or older directory databases — can sometimes approve changes before the business owner is notified. The edit swaps your phone number or website URL for one the scammer controls. From the outside, the listing still looks entirely legitimate.

Why are small businesses targeted more than large ones?

Large chains typically have dedicated marketing or IT staff monitoring their digital presence continuously. A solo plumber or a family-owned HVAC company almost never checks every directory where their business data appears. There are hundreds of these directories — Manta, Hotfrog, Superpages, Cylex, and dozens of data aggregators that pull from each other — and most business owners are only actively managing three or four of them at most. That leaves a long tail of unclaimed listings sitting open, essentially unlocked doors that scammers can walk through at any time.

Cost also matters. Scammers target industries where customers expect to pay a deposit before work begins: contractors, movers, auto repair, cleaning services, event photographers. A fake listing in one of those categories can generate cash quickly before victims compare notes. The Federal Trade Commission has documented that home improvement and repair fraud consistently ranks among the top categories for small-business impersonation complaints.

How do fake invoice scams connect to directory listings?

This is a scam type that most directory-focused articles skip, and it’s worth understanding clearly. Once your business appears in a prominent directory, you become a target for listing-based invoice fraud. The scheme works like this: a company sends you an official-looking invoice — sometimes by mail, sometimes by email — billing you for a “renewal” or “verification fee” for a directory listing you never signed up for. The invoice uses real-sounding directory names, real-looking logos, and sometimes even references your actual business address pulled from a legitimate listing to add credibility. The amounts are deliberately small, typically between $49 and $299, because many business owners just pay small invoices without scrutinizing them.

The Better Business Bureau has tracked this scheme under the name “directory listing scams” and reports that businesses in the US lose tens of millions of dollars annually to it. The invoices are not for a real service. If you pay, you either receive nothing or get added to a near-useless “directory” with no real traffic. The key red flag is any unsolicited invoice for a listing you don’t remember authorizing. Real directories you’ve voluntarily listed with will have a record of your signup, and legitimate renewal notices are preceded by a prior paid relationship you can verify.

What’s the “Google listing” phone scam, and how is it tied to directories?

This one impersonates the directory itself rather than your business. You receive a call from someone claiming to be from “Google My Business support” or “the Google listing department” warning that your listing is incomplete, about to be suspended, or has been flagged for removal. They offer to fix it for a fee — often $200 to $500 — or they ask you to verify your identity by providing your Google account credentials. Neither Google nor any major legitimate directory proactively calls business owners to solicit payment for basic listing management. Google’s actual verification process is automated and documented publicly at support.google.com/business; it does not involve a sales call.

The danger here goes beyond losing money to the scammer. If you hand over your Google account credentials, the scammer gains control of your actual Business Profile and can redirect your legitimate listing to their own phone number or website — effectively turning your real listing into a fake one. This is how some of the most damaging hijacking incidents begin.

How can you tell if your business listing has already been tampered with?

Search your own business name right now in an incognito browser window, and look carefully at every listing that appears on the first two pages — not just your Google Business Profile. Check the phone number, website URL, and address on each one. If anything differs from what you set up, treat it as compromised until proven otherwise. Also call the phone number shown on any directory listing you didn’t personally claim and verify it rings your actual business phone.

Beyond manual searching, tools like Moz Local, BrightLocal, and Yext scan hundreds of directories and flag inconsistencies in your NAP data (Name, Address, Phone). These are primarily SEO tools, but the listing-audit function doubles as a fraud-detection sweep. Running one of these audits every few months is faster than checking directories manually and will surface listings you didn’t even know existed.

What concrete steps protect a business from fake listing fraud?

Claim every listing that references your business, even on directories you don’t actively use. A claimed listing with a verified owner is significantly harder to hijack than an unclaimed one. Start with the highest-traffic platforms — Google Business Profile, Yelp, Bing Places, Apple Maps, Facebook — then work through the mid-tier directories: Manta, Superpages, Foursquare, Hotfrog, and the major data aggregators like Data Axle and Neustar Localeze, which feed dozens of downstream directories from a single source record.

When you claim listings, use a dedicated business email address rather than a personal one, and enable every available notification setting so you’re alerted when anyone suggests an edit to your information. On platforms that allow community edits, check your listing weekly during the first month after claiming it, then monthly after that. Document your login credentials for every directory in a secure password manager — not a spreadsheet on a shared drive — so you can access and audit them quickly if something looks wrong. Finally, train anyone in your business who handles incoming calls or invoices to flag any payment request related to a directory listing for a second set of eyes before it’s approved.

What should you do if you find a fake listing or receive a fraudulent invoice?

If you find a fake or hijacked listing, report it directly to the directory through their official abuse or “suggest an edit” channel, and simultaneously contact the platform’s business owner support line to explain you’re the verified owner and the listing has been altered without your consent. Screenshot everything before you report it — the platform may remove the fake listing before any investigation occurs, and you’ll want documentation if you need to escalate. If customers have lost money because of the fake listing, that’s a situation to report to your state attorney general’s consumer protection office and to the FTC at reportfraud.ftc.gov.

For fraudulent invoices, don’t pay and don’t call the number on the invoice. Mark the sender as a scam with the BBB’s Scam Tracker, report it to the FTC, and if the invoices are arriving by mail, the US Postal Inspection Service handles mail fraud cases and takes them seriously. Keep the physical mailers as evidence — postmarks, return addresses, and envelope details matter in those investigations. The more reports filed against a specific operation, the faster regulators can act.

Is there a single biggest mistake small businesses make with directory listings?

Treating directory listings as a one-time setup task rather than an ongoing maintenance responsibility. You submit your information, maybe claim a few profiles, and then forget about it for two years. In that window, data aggregators overwrite your information with outdated records, platforms update their verification requirements, and bad actors test unclaimed listings for vulnerabilities. The businesses that stay clean are the ones that treat their directory presence the same way they treat their website — something that needs regular attention, not something that runs itself.

The good news is that most of the protective work is not time-consuming once the initial setup is done. A monthly 20-minute audit of your top five to ten listings, combined with email alerts for suggested edits, catches the majority of problems before they reach a customer. Fraud prevention in the directory space is less about sophisticated tools and more about consistent, boring attention to detail.