Issue #57: The Noticeboard With Your Name On It... Your listing is not your shopfront...

This weekly dispatch is specifically designed for restaurant and small business owners who are trapped in the daily grind and ready to move from "struggling artist" to strategic operator.

There is a box on your Google listing that anybody can put something in. Last week an Australian business found a phone number hidden inside their Google listing.

You think of your Google listing the way you think of your front window.

Yours. Your name on it, your photos in it, your hours. Somebody from Google verified you by post, years ago, and that was that.

It is not a window. It is a noticeboard, in a public place, with your name across the top.

Anybody with a Google account can pin something to it. A photo. A correction to your hours. A new phone number, suggested helpfully.

Most of what gets pinned there is from customers and most of it is good. That is the whole reason the board exists and it is why it works.

But nothing checks who is pinning. And you are not standing next to it.

Two things, twelve days apart, and neither was announced.

One. Somebody worked out that a photograph can carry a phone number.

On 10 September, Search Engine Roundtable reported a scam first surfaced by two local search practitioners [4]. A single contributor account had been uploading AI-generated photographs onto business listings. Each image carried a phone number that was not the business's.

The point was not vandalism. It was lead theft. A customer rings the number in the picture, reaches the scammer, and the job goes somewhere else. The first business to notice was a roofing company.

Let me be precise about the size of it, because the number going round is wrong. The 150-plus figure is photo uploads, not businesses. Search Engine Roundtable's own estimate of the listings affected is dozens, possibly hundreds. The account disappeared about a day after the story ran [4].

Google has never commented on it. No statement, no blog post, no change to the help pages. I looked.

Two. Google started emailing owners about spam reviews.

On 22 September a business owner posted a screenshot of an email nobody had seen before [5]. It reads, in part:

"Google has detected a spike in spam reviews on your Business Profile and removed them so they do not affect your Google rating. To protect your Business Profile, new ratings, reviews, and other user contributions have been temporarily paused. Google will lift this pause once the risk is mitigated, typically within a few days. No action is required on your part."

Read the middle of that again.

Not just the spam. New ratings and reviews. Paused.

Last week we spent an entire issue on why your review count matters more than your star rating. Here is the sentence that should worry you: somebody else spamming your listing can switch off your real reviews while Google sorts it out.

Typically a few days, Google says. And no action is required on your part, which is an easy thing to write when it is not your Saturday.

This one is a single screenshot from one person. Google has not announced it, and nobody knows whether it has reached Australia. I am telling you it exists and exactly how thin the evidence is.

This is an example from Australia, only from last week.

On 29 September SmartCompany published an investigation into a review extortion racket running against Australian small businesses [3].

Move It with Gina, a Sydney removalist. Around six one-star reviews in two days. Then a WhatsApp message asking for money to make them go away. Owner Gina Tsigaris reported them to Google, got nowhere, and they came down only after she went to the media. Her conversion rate dropped 25%.

Lonsdale Kitchens by ISPS Innovations in South Australia. Twenty-four or twenty-five one-star reviews. The rating fell from about five stars to 4.3. The demand was US200areview,US4,000 for twenty. Google eventually removed them, and took some of her genuine five-star reviews with them.

Now the detail that ties this issue together.

Owner Theresa Ferretti looked closely at one of the reviewers. There was a phone number embedded in the profile picture [3].

Be clear about what is and is not the same here. The American case was fake photographs uploaded onto a victim's listing to steal their calls. The Australian case was an extortion racket, and the number sat in a reviewer's own profile picture rather than in the venue's photos.

Same idea underneath, and it is the idea that should bother you. Put the number inside the picture, where no filter reads it and no owner thinks to look.

Everything above is somebody reporting an incident. Here is Google describing its own rules, in its own words, on pages that are live today.

One. Anybody can contribute. Google's framing, in its own announcement of the programme: it enables "anyone with a Google account to contribute their local knowledge" [6]. No Local Guides level required. No review history. No proof you have ever been there. I went looking for a documented barrier but there isn’t one.

Two. You cannot delete what somebody else put there. From Google Maps Help, unambiguously: "You can only delete media that you've added on your own account. You cannot delete media contributed by someone else" [2].

You can request removal. That is a different thing and it is the only power you have.

Three. There is no off switch. No setting disables customer photo uploads. Google documents has no such control, and its photo page offers reporting as the remedy rather than disabling [7]. Note the shape of that evidence, as with point one: this rests on the absence of a control in the documentation, not on Google stating there is none.

Four. Reports take as long as they take. Google's published guidance on reporting a photo: "The review process can take several business days" [7]. No service level. No escalation path. No hours figure.

Five, and this is the one that should move you. Google's documentation on user-suggested edits, checked at source on 5 October 2026:

"Once notified, you have 4 days to accept or reject the suggestion."

"If you don't respond within 4 days, Google may automatically publish the update if it is supported by other publicly available information, such as your business website."

And, on the same page:

"Google may apply suggested user edits to your business information without prior review. This happens in cases where edits are necessary to meet policy guidelines" [1].

Four days. And note the condition, because it decides which edits actually slip through: Google publishes where the change is supported by other publicly available information, such as your business website.

So the edit that gets through unopposed is not the wild one. It is the one that matches something stale about you somewhere else — last year's hours on a directory you forgot about, an old number on your own contact page, a seasonal closure you never took down.

A stranger suggests the change. The stale page appears to confirm it. You are in the kitchen, or away, or that notification went to an address you set up in 2019 and have not opened since.

Which is a reason to go and read your own website this week.

That one went into Google's help documentation quietly and was spotted on 23 September [8].

I am not going to give you an industry average spend here, and I want to tell you why.

I went looking for a published Australian figure for average spend per visit. I could not stand one up. The numbers in circulation either have no traceable source or measure something else entirely.

So do this one on your own numbers, which are better anyway.

Take your average spend per head. Multiply by a normal Saturday's covers. That is one Saturday.

Now suppose your hours get edited to show you closed on Saturday nights, and it takes you a fortnight to notice. Nothing looks wrong from inside the building. The phone is quiet, and quiet is just quiet.

Double it. That is the fortnight. Not from bad food. From a line of text somebody changed and you did not see.

Here is a real number, and it is Australian. In January 2024 the ABC reported that Pum's Kitchen, a Thai restaurant at Maroochydore, had been listed as permanently closed with the pin at the wrong address. The owner put the lost revenue at about $12,000 across late November and December [9].

That was Apple Maps, not Google. I am labelling it rather than quietly borrowing it. The mechanism is the same and so is the lesson: the hours were corrected within two hours of a journalist making a phone call, after the owner had got nowhere alone.

The short answer, and you wont like it.

No Australian body can make Google change your listing [13].

Scamwatch, which is the ACCC's reporting front end, is the closest thing to a lever. Its words: "With your consent, we can use your report to work with organisations and remove scam websites, scam ads and contact details" [10].

That last phrase is the one that matters if a fraudulent number is sitting on your profile. And note the first phrase — tick the consent box. It is the only lever in the form.

ReportCyber is the police route, and it is the wrong one unless you have actually lost money or personal information. The official guidance is blunt: do not use it for a scam call where nothing was lost. Report that to Scamwatch instead [11].

ACMA does not take your call. Its remit is the phone companies, not the platforms. There is no ring-ACMA-and-kill the number-option. If an Australian number is being used for a scam, the obligation to act sits with the carrier that holds it, under a registered industry code — and that code gives customers no direct complaint mechanism, directing them to Scamwatch instead [12].

And the law is coming, but the part you would want is not here yet. Digital platforms were formally designated under Australia's Scams Prevention Framework on 23 May 2026. Most obligations do not start until 31 March 2027 [13].

One has already started. Since 1 September 2026 a designated platform must belong to AFCA, the external dispute resolution scheme. That is a complaints path, not a duty to protect your listing.

So right now, today, there is no enforceable Australian duty on Google to protect your listing. The remedy is Google's own process, on Google's own clock.

Which is exactly why the ten minutes below is worth more than any phone call you could make afterwards.

The instinct, when a report goes nowhere, is to send it again. And again.

Stop. Google's policy on misuse of support channels was spotted on 29 September. There is no announcement and no date on the page, so assume it is live now.

It says that "repeated unfounded submissions can result in rejection of all further complaints without assessment" [14]. The photo reporting page carries its own version: submitting multiple removal requests for the same content "might delay the review process" [7].

So the escalation that feels like persistence — sending the same unfounded report again — is now the thing that gets your future complaints binned unread.

One report. Correct the first time. The third prompt below is about nothing else.

Google publishes an annual number, and these are its own figures, not an audit.

In 2025 it says it blocked or removed over 292 million policy-violating reviews, removed over 13 million fake Business Profiles, blocked 79 million inaccurate or unverified edits, and placed posting restrictions on more than 782,000 accounts [15].

For scale, Google says the community shared over a billion reviews and suggested 80 million updates to business hours and contact information in the same year [15].

Eighty million suggested changes to hours, contact details and more. Seventy-nine million edits blocked as inaccurate or unverified.

Now the gap nobody mentions. Google reports on reviews, edits, profiles and accounts. It does not report on photos. The last photo-specific figure it published was for 2022 — 200 million blocked or removed [16]. Nothing since. So the one medium the September scam actually used is the one Google has stopped counting in public.

Three prompts. All three are new — nothing in the Special Edition covers your listing's own integrity.

Set up the project. Call it The Listing Watch. Upload: a screenshot or written copy of every field on your Google Business Profile as it stands today; your real trading hours including public holidays; your phone number and website; your categories and attributes; and the email address your Google notifications actually go to.

That last one is not a joke. Go and check which address it is before you do anything else.

Write down what your listing says today, so you can tell tomorrow whether it moved.

You cannot spot a change if you have no record of the original. Most operators could not say from memory what their listing claims their Thursday hours are.

You need: every field of your profile as it reads right now, plus your real hours and contact details.

You get back: a one-page reference sheet, and a short list of the fields most worth watching.

Do this one first. The other two are useless without it.

Decide what you will do before the email arrives, not while you are reading it.

Four days is not long when you are running a kitchen. The difference between acting and not acting is almost always that nobody had decided in advance who looks, and what they do next.

You need: your fact sheet from Prompt #1, and an honest answer about who checks which inbox.

You get back: a one-page standing plan — who, what, in what order, and what to do when you disagree with the edit.

Fifteen minutes now saves the Saturday.

Google now penalises repeated unfounded reports. So the first one has to land.

The policy spotted on 29 September says repeated unfounded submissions can get all your future complaints rejected without assessment. That changes the job from persistence to precision.

You need: what you found, where, and when — plus any dated proof you have.

You get back: one report, written to the right category, with the right evidence and nothing that weakens it.

The hardest part is choosing the reason. There is no category that says "AI-generated fake carrying a scam number."

Pro Tip. Take the report it drafts and read it out loud once before you send it. If any sentence sounds like you are cross, cut that sentence. Cross is accurate and it does not help.

The ACT Model. Ten minutes tonight. Then once a month.

The struggling artist thinks they own it. They set it up once, years ago, got the postcard with the code, and ticked it off. Since then it has been a thing that exists, like the gas bill. When somebody says the listing is wrong they feel irritated rather than alarmed, because it is theirs, and surely nobody else can touch it.

The Savvy Operator stands watch. Not anxiously, and not daily. They know exactly what their listing says, they know a stranger can suggest otherwise, and they have decided in advance who looks and how fast.

Here is the whole thing in a line.

You do not own your listing. You own the right to object to it.

Last week I wrote about the AI machine that can’t recommend a venue if it can’t find any to say about it. This article is the uncomfortable other half of the truth. AI will happily repeat something a stranger wrote about you, and it will not ring to check.

One more thing, and then I will let you get back to it.

There is no Australian figure for business impersonation. I checked.

The National Anti-Scam Centre's annual report for 2025 puts total reported losses at $2.18 billion [17]. It does not break out business impersonation. Nothing else official does either.

What exists instead is two named Australian business owners in a trade publication, last week, describing exactly this scam happening to them.

That is not a statistic. It is a warning from two people who were standing where you are standing.

Until somebody counts it properly, businesses warning about scams happen by to them  is the best evidence any of us have.

Which, as it happens, is the other reason this issue has no average spend figure in it.

Open Maps. Look at the last twenty photos on your own listing.

Four minutes, and you will know something about your business you did not know this morning.

Here is the honest problem with everything above. It is another job.

You already run a kitchen, a roster, a supplier list and a family. Nobody needs a fourteenth tab open.

So do not run it yourself. Set your AI up as a second brain for the business and let it hold the detail.

Not a toy. Not a chatbot you poke when you remember it exists.

A working folder that knows your menu, your prices, your hours, your reviews and your suburb. And the twenty questions your team answers on the phone every week.

Feed it those things once and it stops handing you ideas. It starts handing you a scoreboard.

That is why I built Strategic AI Marketing. We set your AI up properly, on your real numbers, so it thinks with your business instead of guessing at it.

You do the cooking. It does the remembering.

One, and it is free. Get your AI Visibility Snapshot. Four assistants, twelve questions about your venue, written down and dated. You will know exactly where you stand by the end of the week. It is at strategicai.marketing/free-ai-marketing-snapshot.

Two, if you want somebody else's eyes on your listing. Reply to this email with one word: SWEEP, and tell me your venue name and suburb.

I will run the ten minutes above on your listing myself and send back what I find. Every field, the newest photos, and anything that does not look like it came from you.

No pitch deck. No discovery call unless you ask for one. One reply, one useful answer.

Next Week on The Savvy Operator: What Your Beer Actually Costs You. Small venues are buying cases at retail, delivered by app, because it feels cheaper and faster than the wholesaler. It is legal — I checked. Whether it is actually cheaper, nobody in Australia has published. So I went looking, and found a bigger number sitting inside a question nobody is asking.

Until then, remember. The listing is not your window. It is a noticeboard, and somebody else has a pin. Serve your community. Be the operator.

Talk soon, Rowan

Rowan Shead

The Editor

The Savvy Operator

Owner of Strategic Ai Marketing

[1] Google Business Profile Help, Edit your Business Profile on Google, support.google.com/business/answer/3480441. Quoted lines: "Once notified, you have 4 days to accept or reject the suggestion"; "If you don't respond within 4 days, Google may automatically publish the update if it is supported by other publicly available information, such as your business website"; "Google may apply suggested user edits to your business information without prior review. This happens in cases where edits are necessary to meet policy guidelines" — the second sentence is quoted here because the first alone reads as a broader licence than the page grants. Google's own live documentation, read at source on 05/10/2026. Two separate research passes disagreed on whether this wording existed, so it was verified directly before publication.

[2] Google Maps Help, Add, remove or share photos and videos, support.google.com/maps/answer/2622947. "You can only delete media that you've added on your own account. You cannot delete media contributed by someone else." Business owners may request removal. Google's own documentation, read 05/10/2026.

[3] Simon Thompson, "Pay us or the reviews stay": The extortion scam targeting Australian small businesses, SmartCompany, 29/09/2026. Move It with Gina (owner Gina Tsigaris, Sydney): approximately six one-star reviews in two days, a WhatsApp demand for payment, removal only after she approached media, and a 25% fall in conversion rate. Lonsdale Kitchens by ISPS Innovations (owner Theresa Ferretti, South Australia): 24–25 one-star reviews, rating down from about 5.0 to 4.3, a demand of US$200 per review, and removal that also took some genuine five-star reviews; the rating later recovered to 4.9. Ferretti identified a phone number embedded in a reviewer's profile image. Australian, independent trade press, named sources, dated. Neither Google nor the ACCC commented in the article.

[4] Barry Schwartz, Google Maps Business Profiles Phone Number in Photo Scam, Search Engine Roundtable, 10/09/2026, updated 11/09/2026. Surfaced by local search practitioners Sam Sarsten and Naomi Stevens on LinkedIn. Trade press reporting a practitioner finding, not a Google disclosure. The 150-plus figure refers to photo contributions, not businesses — Search Engine Roundtable's own estimate of affected listings is "dozens, if not, hundreds." United States. Google made no statement about the incident; the contributor account's removal about a day later is Schwartz's observation. No Australian cases reported.

[5] Barry Schwartz, Google Business Profiles Email Notifications For Detection Of Spike In Spam Reviews, Search Engine Roundtable, 22/09/2026, from a screenshot shared by practitioner Antoine Cameron. The email also states that Google "will lift this pause once the risk is mitigated, typically within a few days", that "No action is required on your part", and that an owner who believes legitimate reviews were removed can request a review. A practitioner observation, not an announced Google feature. Scope unconfirmed — neither global nor Australian availability has been established, and no Australian report of this email was found. Distinct from the edit-alert emails Google did announce on 16/04/2026 [15].

[6] Google, Google Maps 101: how contributed content makes Maps helpful, blog.google, 19/02/2020: the programme enables "anyone with a Google account to contribute their local knowledge." No contributor eligibility requirement — no Local Guides level, no review history, no verified visit — appears in Google's Maps user-generated content policy or media guidance. Note the shape of this evidence: the absence of a barrier is established by its absence from the documentation, not by a Google sentence stating there is none.

[7] Google Business Profile Help, Report inappropriate photos or videos on your Business Profile, support.google.com/business/answer/6130451. "The review process can take several business days"; "If you submit multiple removal requests for the same content, it might delay the review process." Not to be confused with the 24–48 hours quoted elsewhere by Google, which is how long an owner's own upload takes to appear.

[8] Barry Schwartz, Search Engine Roundtable, 23/09/2026, reporting the appearance of the four-day wording in Google's help documentation. Trade press as the spotter; the documentation itself is the source and is cited at [1].

[9] ABC News, 23/01/2024: Pum's Kitchen, Maroochydore, listed as permanently closed with an incorrect map pin without the owner's knowledge; owner Chris Pyatt estimated about $12,000 in lost revenue across late November and December. Hours were corrected within two hours of the ABC contacting the platform. This was Apple Maps, not Google. Included as an Australian illustration of the cost of a listing an owner does not control, and labelled rather than borrowed.

[10] Scamwatch (ACCC), Report a scam, scamwatch.gov.au, page last modified 28/01/2026: reports are used to "work with organisations and remove scam websites, scam ads and contact details." Australian, government primary. Note the conditional — the referral happens with the reporter's consent, which is a box on the form.

[11] Victoria Police, Report cybercrime, scams and online abuse, updated 10/06/2026: ReportCyber is for identity theft and fraud where money or personal information was lost. Explicitly: do not use it for a scam call where nothing was lost — report that to Scamwatch. Australian, government primary.

[12] Communications Alliance Industry Code C661:2022, Reducing Scam Calls and Scam SMs (registered 2020, revised July 2022). Where an Australian number is being used to perpetrate a scam, the provider holding the number must act to prevent its use. The code establishes no direct complaint mechanism for customers and directs consumers to Scamwatch. Cited here for the carrier obligation only; the characterisation of ACMA's remit in the body rests on this code, not on a separate ACMA page.

[13] Competition and Consumer (Scams Prevention Framework – Regulated Sectors) Designation 2026, effective 23/05/2026, designating banks, telecommunications and digital platforms. Most obligations commence 31/03/2027. One is already live: since 01/09/2026 a designated platform providing a regulated service must be a member of AFCA (ACCC, Scams Prevention Framework). Underlying framework: Treasury, Scams Prevention Framework, January 2025. There is currently no enforceable Australian duty on a platform regarding a business listing.

[14] Google Business Profile Help, Misuse of support channels policy, support.google.com/business/answer/7353941, spotted by Search Engine Roundtable 29/09/2026: "we require all Google Business Profile users to use the support paths responsibly", and repeated unfounded submissions "can result in rejection of all further complaints without assessment."

[15] Bibek Samantaray, Group Product Manager, User Generated Content, New ways we're protecting businesses on Maps, blog.google, 16/04/2026. For 2025: over 292 million policy-violating reviews blocked or removed; over 13 million fake Business Profiles removed; 79 million inaccurate or unverified edits blocked; posting restrictions placed on more than 782,000 accounts. Context from the same post: the community shared over 1 billion reviews and suggested 80 million updates to business hours, contact information and more. The post also announces proactive email alerts to verified, active owners about edits, described only as "starting this month" (April 2026) with no stated geographic scope — unlike two other protections in the same post, which are explicitly global. Whether an Australian owner receives this alert at all is therefore unestablished, which matters for the Four-Day Drill above. These are Google's own self-reported, unaudited figures, with no Australian breakdown. (Correction to Issue #56, which cited this source as "782,000–783,000 accounts." Google's figure is "more than 782,000." The reference in #56 has been amended.)

[16] Ashish Gupta, Engineering Director, User Generated Content, blog.google, 31/03/2023, reporting 2022 data: over 200 million photos and 7 million videos blocked or removed. Google's subsequent annual protection posts of 07/04/2025 and 16/04/2026 contain no photo-specific figure. Cited here only to make the point that photo reporting stopped, and deliberately kept apart from the 2025 figures at [15].

[17] National Anti-Scam Centre, Targeting Scams: report on scams data and activity 2025, published 30/03/2026, with the accompanying ACCC media release of the same date. In calendar 2025 there were 481,523 scam reports in total (combining Scamwatch, ReportCyber, AFCX, IDCARE and ASIC), of which 274,577 involved a financial loss, totalling $2.18 billion. Scamwatch data for phone calls as a contact method: $72.5 million lost across 2,012 reports involving loss, median loss $3,800. The report does not isolate business impersonation, and no official Australian figure for it exists. Australian, government primary.

Strategic AI Marketing's own citation record — 0/12 on 26/05/2026 and every reading since — is published at strategicai.marketing/we-did-this/.