How do you tell a real call from Google?
The Google Business Profile help page on protecting against fraudulent calls and texts has been updated. The new version explains how to recognise legitimate messages arriving over WhatsApp and RCS and replaces dated examples with current ones. A concrete answer to a problem small businesses hit constantly.
The guidance was refreshed to cover messaging channels
On August 3, 2026 Search Engine Roundtable reported that the Google Business Profile help page on protecting against fraudulent calls and texts had been updated. Per the report, the update adds guidance on identifying legitimate messages over WhatsApp and RCS and replaces outdated pandemic era examples with new fraud examples.
Google's own help page addresses three channels: automated phone calls, WhatsApp messages and RCS messages, with SMS also in scope. The guidance is no longer built around phone calls alone but covers the channels business owners actually use.
What the legitimate one looks like, what the fake one says
The help page starts by describing legitimate communication. Automated calls from Google come from designated numbers and identify themselves clearly. The example sentence on the page has the call coming from Google Maps to update business hours. Such calls may involve checking business information on Maps, making reservations, confirming prices and availability, or scheduling appointments for Google users.
On messaging, the verification mark is the key signal. Verified messages can be identified by a blue verification checkmark. WhatsApp accounts appear as "Google Maps" or "Google Maps" plus a country name, while RCS messages show the sender as "Google".
The signature of the fake side is equally clear. Per the page, scammers typically say they work with Google or for Google and try to sell various schemes and online marketing services to unsuspecting businesses. The sharpest dividing line is this: legitimate Google communication never asks for private or sensitive information, Google does not ask for payment details over the phone, and it does not guarantee special placement in its products.
The recommended behaviour is concrete too: on a suspicious automated call, hang up and do not press any buttons; verify by contacting the company directly using a trusted phone number rather than information in the message. The page also provides a webform for reporting to Google along with official reporting channels specific to the United States.
The target is not the system but the business owner
This kind of fraud is not a technical attack but an exercise in persuasion. The target is the small business owner who knows visibility on Google Maps matters but not how the system works. So the defence is not technical either, it is knowledge based: knowing what legitimate communication looks like.
That the update covers messaging channels matters here. An owner who treats a phone call with suspicion may not apply the same suspicion to a WhatsApp message with a Google logo as its profile picture. Documenting concrete markers such as the verification checkmark and the account name closes that gap.
The second point is naming the most common lie. A promise of special placement or ranking is something this page explicitly rejects. That gives a yardstick not only against scammers but against agencies making the same promise. That assessment is ours.
What it means for businesses in Türkiye
The assessment below is our reading, not something stated in the sources. The reporting channels on the help page are specific to the United States; no separate procedure for Türkiye is given in the source.
The problem itself, however, is thoroughly familiar in Türkiye. "We are calling from Google, your business is not ranking at the top of the map, let us fix it right away" is an opening small businesses hear constantly. With WhatsApp being a primary communication channel in Türkiye, the risk on the messaging side is larger still.
Four practical notes. First, team knowledge: if more than one person manages the profile, what legitimate communication looks like has to be shared with the team, because fraud usually lands on the least informed person. Second, the payment rule: appearing on Business Profile and updating its information is free, so any call asking for payment over the phone fails that single test. That is an administrative decision rather than a technical one and can be written down and pinned to the wall. Third, the verification habit: use the channel in your own records, not the number in the incoming message. Fourth, access hygiene: review once a year which account owns the profile and who has access, because a delegated access left in place is the quietest risk.
In short this is not a technology problem but a communication discipline problem. That last sentence is our own comment.
The UNALSOFT take
In our brand management work, the Business Profile is not a record handed over and forgotten but an asset with clearly defined ownership and access. Who the manager is, which account signs in, and how incoming requests get verified are all written down at the start. This update is a reminder of why that discipline matters: the easiest way to lose your profile is not an exploit but a convincing phone call.
Who holds your Business Profile?
Let's set out your ownership, access and verification rules together.