Understand the security risks to Google Business Profile and how to mitigate them.
Module 11 · Lesson 4
Permissions and Security
Protect your Google Business Profile with proper security practices and permission management.
Learning Outcomes
Set up two-factor authentication to protect your Google account.
Respond effectively to an attempted profile hijack or unauthorised edit.
Monitor your profile for unauthorised changes.
Key Concepts
Profile Security Threats
Google Business Profile is a publicly accessible system — any Google user can suggest edits to your business information, and Google may apply those edits automatically if it believes they are accurate. This creates a security vulnerability: competitors, spammers or malicious actors can suggest incorrect information (wrong phone numbers, wrong addresses, changed hours, or even profile closure) that Google may apply to your live profile without your knowledge.
Enabling Change Notifications
Navigate to your Google Business Profile settings and enable all notification types — including notifications when someone suggests a change to your profile and when Google automatically updates your information. This ensures you are alerted immediately to any unauthorised changes and can review and reverse them quickly. Check your profile information at least weekly for any unauthorised edits.
Two-Factor Authentication
Your Google Business Profile is only as secure as the Google account it is attached to. Enable two-factor authentication (2FA) on every Google account that has Owner or Manager access to your profile. With 2FA, even if a password is compromised, the account cannot be accessed without the second factor (usually a phone verification code). Go to myaccount.google.com/security to enable 2FA.
Responding to Unauthorised Changes
If you discover that your profile has been modified without your knowledge: immediately log in and revert any incorrect information, report the change to Google via the "Suggest an edit" process (you can now suggest edits to your own profile to correct false information), and contact Google Business Profile support if the changes cannot be reversed through normal editing.
Profile Recovery
In the worst case — where someone has successfully hijacked ownership of your profile — Google provides an ownership dispute process. You will need to provide proof of business ownership (business registration documents, utility bills showing the address). This process can take weeks, so prevention (retaining Primary Owner control, strong passwords, 2FA) is far preferable to recovery.
Step-by-Step Practice
Enable two-factor authentication on all Google accounts with access to your profile.
Review and enable all notification types in your Google Business Profile settings.
Check your profile for any recent unauthorised edits — review all information fields.
Document your profile's current correct information as a reference in case you need to reverse changes.
Brief all team members with profile access on security practices and what to do if they suspect a compromise.
Ian's practical tip: I have enabled two-factor authentication on all profile-linked Google accounts. I have enabled all profile change notification types. I have documented my correct profile information as a reference. I have a process for responding to unauthorised changes.
Practical Activity
Complete and record this task
The single most effective security action you can take is enabling two-factor authentication on your Primary Owner Google account. This one action makes your profile nearly impossible to hijack through credential theft — the most common attack vector. Do this today if you have not already.