Takeaways from an Irish Locksmith: Listing Spam Scandal

“I did what people normally would do — Googled ‘locksmiths near me.’”

These telltale words preface a scandalous account of listing spam I recently ran into on an Irish call-in radio show on RTÉ. I’m going to share a summary of it in today’s column, offer my best understanding of the root of the problem, and close with takeaways both for consumers and for local business owners who operate in Your-Money-Or-Your-Life (YMYL) industries, like security.

When local search reads like a mystery novel

Host, Katie Hannon, and her team did a good job of structuring this unfolding mystery on the Liveline with Joe Duffy show. Sir Arthur Conan Doyle would definitely have gotten hooked into this plot.

Caller #1

On a bank holiday, a woman came home to find herself locked out of her house. She called the first locksmith she found on the web. The locksmith told her the lock cylinder needed to be replaced, did the work, and 5-6 minutes later, presented her with a bill for €391 ($419.35 USD). She had been so frazzled by the ordeal, that it wasn’t until the next day that she began to wonder why the charge was so high, but when she re-contacted the company to ask for a breakdown of the cost, she was informed that while the fee might appear large, it reflected the expertise of their staff.

Later, a licensed locksmith would confirm for the customer that, on a bank holiday, the charge should have been about €200.

Caller #2

“I did what people normally would do - Googled ‘locksmiths near me.’ I needed it done as quickly as I could. I took the first one that popped up. I spoke with a young lady, and she said she’d have someone get in touch with me,” said the next caller of his experience of hiring a locksmith when his door handle stopped working, when questioned about the locksmith’s online presence, he answered, “It looks very professional with very good reviews. There was certainly nothing to warn you.”

After a series of non-fixes, the locksmith got the caller’s door open but said he’d leave it without any lock unless the customer was willing to pay for replacement of the mechanism. Not wanting to risk having a door that couldn’t be made secure, the customer found himself with a bill for €1,143 ($1,225.87 USD) and began to worry he’d been overcharged when friends remarked that he could have gotten a whole new door for that amount.

Later, a licensed locksmith would confirm that the charge for the work should have totaled less than €500.

Caller #3

When one woman needed a rusty door lock replaced, she did what most of us would do,

“I just Googled ‘Dublin locksmith.’ It had reviews and everything.”

The locksmith who arrived charged her €60 for the service call but told her he’d need to order a €400 ($429 USD) replacement lock. When some days had gone by with no follow-up, she re-located the Google Business Profile she’d clicked on and again spoke to a receptionist. The receptionist told her she’d need to email the man on the invoice she’d received, but when her email went unanswered, the customer set out to find the elusive locksmith.

Via the Internet, she located a street address, and that took her to the house of a completely different person…

The Case of the Retired Locksmith

Caller #4 was the gentleman whom the woman with the rusty door lock found at the Dublin residence, and he is a retired licensed locksmith who served the industry for 45 years. I won’t do screenshots in this piece, but my own research confirmed that he appears to be the victim of impersonation via a Google Business Profile, and other local business listings. The top-ranked listing I found for the search in question featured the retired locksmith’s name and a 4-star rating on the basis of some questionable reviews + a few complaints.

It turns out that not only does the retired licensed locksmith know about this scandal, but he has felt so upset by customers being overcharged by the alleged impersonator, that he has been going to their homes to explain that he is not the service person they contacted and to offer them advice on what steps they might take. He is proud of the reputation he worked hard to build over more than four decades and is understandably unhappy to find his good name being tarnished, saying,

“I wouldn’t have survived this long in business if I had given a bad service to people.”

He has reported the issue to the authorities but has yet to receive a response, and unfortunately, there isn’t much he can tell these homeowners to do. In most cases, they did receive the work they paid for, but the charges simply were not commensurate with industry standards.

Google… I don’t know how they operate their business

During the radio program, Caller #5 phoned in to say that she, too, is a licensed locksmith, and has had four local people reach out to her lately after apparently receiving outrageous charges for basic services from this same entity. She stated:

“Google, I feel, is partly responsible for providing disinformation, but I don’t know how they operate their business. I would really like to know what is going on beneath all this because I do feel that there is an establishment that may be running companies like this. They’ve seen a niche in the market, and they’ve grabbed onto it, and they are making an absolute fortune. They’re unlicensed, and they are ripping people off.”

And therein lies a very large key to this common problem. Neither consumers nor legitimate business owners in this case (and in many) have a clear idea of what Google’s omnipresent local search results consist of, how they are ranked, or how often they contain spam.

Vulnerabilities in Google’s local search platform make it quite possible for a scenario like this one to take place, of an individual apparently spoofing the identity of another company and creating a listing around it. It’s also possible to hijack the listing of another business and insert your own phone number so that you receive the calls that should be going to your competitor. It’s possible to pay for fake reviews that make a dubious business look trustworthy, and as my honored colleague Joy Hawkins recently reported, you can repeatedly spam Google’s review component without any lasting consequences.

Lack of meaningful competition in the local search space has not motivated Google to fix this problem of listing spam over the past several decades, despite volumes of reporting both by major media outlets and industry journalists. At the same time, Google has never succeeded at widely engaging with or offering adequate support to the millions of local business owners whose data they use to populate their local search results. No matter how many times they rebrand and reshape local search, Google just isn’t getting the basics right to create a trustworthy, manageable platform or consumer experience.

So, where does that leave local business owners and Google users?

The cause and effect of local online scams

“You have to be so careful about who you have come to your home to fix a lock or deal with your security.” — Katie Hannon, RTÉ host

Misinformation, disinformation, and web spam are a threat to public safety in YMYL scenarios. I remember writing an article nearly twenty years ago about having a medical emergency and realizing that Google’s local pack results were full of inaccurate listings for ERs and hospitals. And clearly, when it comes to home security, no one would want someone untrustworthy working on their locks.

Meanwhile, I was listening to another Irish call-in show recently in which guests had lost tens of thousands of euros to scammers allegedly claiming to be from the online finance app Revolut, and the subsequent nightmare they’ve gone through in realizing that even the real Revolut isn’t like a real-world local back with an office and phone number you can contact for emergency help if you’re robbed.

Imagine spending 12 hours with a chatbot because it’s the only source of customer service available to you after having $10,000 dollars taken from your account! One of these callers even wondered afterward if the person she was speaking to at the scam company was a real human being or AI with a Dublin accent. Scenarios like these seem to me to stem from and create the following cascade:

1. Civil societies function on members having a certain degree of respect for authority, whether the authorities are teachers, medical experts, licensed professionals, or government leaders.

2. Many members of society have mistaken tech companies and their products for authorities, implicitly trusting that if something is as big and powerful as Google, it must be vetted, regulated, accurate, and authoritative.

3. In non-daily circumstances like suddenly needing a lock changed, having a medical emergency, or thinking your finances might have been compromised, people are flustered. They reach out for the quickest possible help to get themselves out of trouble and are not in any state to use their best critical thinking. Very intelligent people who say they would normally know not to give out sensitive information to strangers find themselves doing so in emergencies.

4. Because scammers know people are vulnerable during a time of stress, they build business models around exploiting others during these episodes.

5. This is a global problem that no government, regulatory body, or tech company has effectively solved. It has been nearly 20 years since Google Maps first appeared, and in the US, there are still no meaningful consequences for a search engine that profits from publishing spam that fools, misleads, misdirects, and even harms people. Regulation does not keep pace with rapid technological development.

6. Invested tech companies are now actively worsening this problem by presenting AI as an authoritative source of information rather than as an amalgamation of whatever data it has been fed, good or bad, real or not real. If countless people have already been scammed by others who use platforms like Google Business Profile to misrepresent themselves via spam listings and reviews, there’s pretty much no end to what bad actors could do with the opportunities AI will offer to spoof legitimate entities to disastrous consequence.

The effects of scams on communities are deeply serious. Scams undermine how humans feel about the societies they live in. Living in a setting in which people have to be constantly suspicious of their neighbors is stressful, and long-term stress undermines physical health. Some callers I listened to expressed shame at having been fooled, and others were reticent about admitting to anyone that they were swindled for fear of looking out-of-step with the times and the tech. All of them suffered financially, which is especially difficult in Ireland right now given that its people are experiencing what they call a “cost of living crisis,” which appears to have its same root as the 40-year transfer-of-wealth scam American economists cite as the cause of our present state of poverty in the US.

Thieves have always existed. The internet has simply allowed them to scale up and cause harm to vast numbers of people. When societies are unprepared and unprotected from swindles, an unfortunate outcome is that people have to look out for themselves (a very anti-social state of affairs that improves life for no one), but this is where I believe we’re at in the absence of better regulation, and I’ve got a few tips to share.

Tips for increased safety amid Google Business Profile spam

Let’s start with tips for customers — folks like you and me who are using the internet to navigate our local landscape:

1. Understand that spam is widespread on Google

Know that it is very easy to create illegitimate Google Business Profile listings and that a recent large-scale study by Uberall found that Google is the platform with the highest percentage of suspicious local business reviews. Know that Google does not have adequate safeguards in place to identify and remove fraudulent information from their product. The local results you see when you search for nearby businesses may well contain both fake listings and fake reviews and do not deserve your unqualified trust.

2. In a quiet moment, create a list

To protect yourself from being manipulated in a time of stress, consider the types of sudden incidents that take people unawares at some point or another in many of our lives. These might include:

• Medical incidents requiring emergency assistance

• Auto accidents and malfunctions requiring roadside assistance, auto repairs, and sometimes legal assistance

• Security needs, like locksmith assistance or home security malfunctions

• Damages from weather events like storms or fires, requiring rescue or urgent remediation services

• Household malfunctions like septic overflows or plumbing problems, garage door failures, major appliance repairs or replacements, and other needs that require urgent assistance

• Financial emergencies, such as fearing your banking card has been lost or stolen

It may sound like I’m trying to turn back the hands of the clock to pre-internet times, but at this point, you will be better off writing a list of the names, phone numbers, and addresses of reputable resources and keeping a copy of it in your wallet, purse, vehicle, and home rather than trusting random local business listings for YMYL scenarios. You could definitely put the list on your mobile phone, but you might want a paper copy as well in case your phone gets hacked, lost, or runs out of juice.

When you are not in the middle of an emergency, you can thoroughly research and contact your options to vet them. You can ask your friends and family for recommendations. And if you are traveling even a little distance from home, you can make such a list to protect yourself from being scammed in an unfamiliar setting.

In short, Google may be fine for helping find a quick cup of coffee or a slice of pizza, but don’t trust the local packs or Google Maps if your money, health, bank account, or life is at stake. Don’t invest Google’s results with an authority or accuracy they don’t possess. As a seasoned local SEO, I don’t like having to say this, but it’s my honest take on the state of affairs.

3. Start relying more on people in your life and less on the internet for YMYL decisions

Speaking of ethical scandals, we all need to be bracing ourselves right now. Large publishers you once trusted for vetted, fact-checked information that is hand-researched and hand-written by experts and authorities, may be making decisions right now to replace some of their staff with AI. We are already seeing results in the form of shocking pieces being published like this one (now removed) from Microsoft, which advised tourists to Ottawa to enjoy visiting a local food bank on an empty stomach.

The combination of spam local business listings and reviews + the increase of what could be a real mess of AI-generated nonsense in both chat-based and organic results could mean you should be very careful of letting the internet be your guide when making decisions that involve your life, health, money, security, or major purchases. Publishers have profit goals in view in replacing human authors with AI-generated information, but you need recommendations from people who have your best interests in mind. And that, of course, lands you back in the circle of your friends and family.

You are likely better off asking your mother, your neighbor, or your friend from work where to find a trustworthy outfit to replace your broken windshield than you are asking ChatGPT, Bard, New Bing, local listings, or organic results. You are likely better off steering clear of the web and asking your existing doctor where to find a specialist, if the need arises. Word-of-mouth recommendations are a tried-and-true method that long pre-dates the internet of finding reliable help, and it works on the basis of trusting that real people in your life want the best for you. They may not always get it right, but lived experiences are a rich source of useful information we all can share.

4. Know that asking to see credentials is not bad manners

Know the licensing laws of your country and/or state and request that any service provider show you proof of their credentials before you contract with them. I’ve heard kind people say they worry it sounds rude to ask for this documentation, but remember that legitimate service providers have to go through all kinds of steps to earn their credentials, and they will not be in any way annoyed by sharing the results of their efforts to be compliant with regulations. These credentials set them apart from scammers they already know exist in their geographic markets. If a potential contractor makes a fuss about proving they are licensed, it’s a red flag to you that they don’t have the necessary proof.

In sum, the internet can be a great place for local consumers to browse their communities and connect with local businesses, but when it comes to specific high-risk categories and transactions, you will be safer if you do your research ahead of sudden events and make sure you are working with licensed professionals with legitimate business credentials and contact information.

Now let’s turn to the local business side of this story. What can you do if you know your Google Business Profile categories are polluted with spammers, putting your neighbors and potential customers at risk of being scammed?

1. Report what you can

This shouldn’t be part of your job description; it should be Google’s responsibility to keep their index as free as possible from spam listings and reviews that violate their own guidelines. Nevertheless, you can report spammers to Google, and sometimes they will act on those reports, and that may help you move up in the local rankings. However, do go into this knowing Google often won’t act and that spammers will often simply come back. It’s not ideal, but you do have the following options for reporting:

• Use the Business Redressal Complaint Form to report Google listings you are convinced are spam and in violation of the guidelines, or review profiles you believe are the result of forbidden activities.

• If three weeks pass and you have seen no movement on what you’ve reported, you also have the option to post your redressal case ID in the Google Business Profile Community help forum to ask a product expert to consider escalating your case.
  

2. Treat credential content as central rather than as an afterthought

On your website, social profiles, and in areas of your listings like Google Updates (formerly known as Google Posts), create content that explains what your credentials are, and why you have them. Too often, service providers’ sites simply have a license number in the header or footer, with no explanation of why it matters. Build core content that educates potential customers as to what legal requirements there are in your field for licensed or credentialed providers, and take the opportunity to warn your community against spammers and scammers by teaching people to ask to see credentials before they hire anyone.

3. Don’t abandon business cards and fridge magnets

Tech news might make you think that everything has to happen online these days, but the truth is, being generous with handing out business cards, magnets, car stickers, and other tangible marketing assets with your contact and credential information on them is a great way to ensure customers come back to you in a moment of stress, instead of going with another random provider they find online. The oil change business I go to always places a little transparent window cling on my car that is branded with their name, contact info, and the date I should come in for my next service. Any service provider can offer a physical reminder to the customer of whom they should trust when the time comes.

4. Build a simple referral program

This is very easy to do when your business is a cafe or grocery store that locals visit on a regular basis. Offering a free cup of coffee after a customer’s fifth visit or a coupon for ½ off dinner with a friend is simple. But when you are in a YMYL category, chances are good that the same customer isn’t going to need you on a regular basis. What you want is for them to share your good name with their friends and family in advance of the need arising, and a branded merchandise campaign could be one good option for accomplishing this.

For example, imagine you own an auto glass repair company. You might invest in branded stainless steel water bottles that people can take in their cars instead of plastic. Your branding can include your name, phone number, address, and credentials, as well as your logo. When completing a job for a customer, you could let them know you have a special offer of one of these bottles if they agree to give a second one to a local friend or family member. You’ll not only be reducing plastic consumption in your community, but you’ll also be getting your brand name into people’s cars so that they remember it right away if their car window gets damaged. A plumber might offer a toilet brush set. A locksmith might offer a cool keychain charm. The point is to get your trusted name into the hands of your neighbors when they need you, making them safer from scammers and earning you new business.

In sum, you have some options for reporting online spam to Google, but your strongest bet will be to build real-world relationships with the people in your community so that they learn to trust you and recommend you to their circle.

Local listing and review spam harms communities, and AI is likely to take scams to as-yet-undreamt-of levels. While the internet is an amazing tool for finding things, it cannot replace the offline social contract of trust that surrounds time-honored word-of-mouth recommendations amongst family and friends. When your money or life is on the line, or if your business provides services for people with urgent, unexpected needs, trust is a must.