My time to shine as someone who's pretty deep in this game.
There's an enormous and growing market of fake GBPs for the purpose of selling leads called Local SEO Lead Gen. (each entity can bring in thousands of dollars/month.)
The thinking is why go through the headache of dealing with clients who can fire you the day after they begin ranking (Local SEO is heavily "front loaded" work wise), will always try undercutting you on price, etc, when you can CREATE YOUR OWN entity, get that ranked and then SELL the leads to that plumber. You're the one with 100% control and if the plumber isn't happy, there's a dozen others who'll gladly take those leads.
Advanced lead gen owners use software such as MultiLogin along with mobile proxy farms to have hundreds of separate Chrome "entities" saved, all using different proxies, their own cookies, etc. This along with an infinite amount of other tools for call tracking, CTR manipulation, etc.
Mobile proxies have really changed the game, giving these lead gen folks an advantage. Because of the nature of mobile proxies (where multiple people can "share an IP address"), it's more difficult to detect. Since EACH GBP entity can bring in thousands/month, it's miniscule in terms of cost.
Reviews? Laughably easy to purchase and outsource, starting around $5/review. Combine this with fake Dalle images to attach to the review and/or GBP itself, and things can only get worse from here.
Google has actually begun VIDEO verification where you literally have to facetime with a Google employee to verify you own the business you say you own... even this can be gamed since any type of manual verification will be outsourced.
Oh and the real masters of this business model? Well they don't bother SELLING the leads to contractors, they will quite literally start their own company and will hire their own plumbers, electricians, concrete crews, etc to squeeze as much profit as possible.
So this is why when I called a locksmith last week, they took down my info and then 30 minutes later got a call from no less than 5 other locksmiths who were "on their way to my house". Nobody's phone number matched, nobody wanted to tell me who they worked for. Totally sketched out with Google Maps' suggestions, I switched to yelp. The first service I called on yelp was reasonably priced, was actually the person coming to my house, and totally hassle free. How is Yelp dealing with this when Google can't seem to?
I wouldn't give Yelp too much praise. It's been alleged that Yelp engages in astroturfing and unfair business practices[0], and the documentary "Billion Dollar Bully"[1] even accuses them of "Mob-Like Behavior".
Oh definitely - I can't say that I've had stellar experiences with Yelp in the past for restaurants, barbers, etc, from the consumer side, and I hear it is much worse as a business. I was just very surprised that in this niche Google performed so poorly and Yelp so well. I wouldn't go on to generalize from this experience though.
These kinds of businesses are common for scams, by kind of business I mean “urgent” ones: such as a locksmith, or garage door repair. In either case its unlikely you already know/have one, and you urgently want the issue fixed, so you’re most likely to search google and pick the one with the most reviews.
I had this happen to me with the garage door case, dude showed up, different name on card than the van, and different than who I even called. Searching google maps for “garage door repair” turned up tons of businesses with fake sounding names, all a ton of fake 5 star reviews.
I used to work in this field (verifying local business listings). Locksmiths are traditionally the spammiest and scammiest industry of them all (along with taxis, before rideshare cut down their ROI). Basically any service area business has huge incentive to spam any and all business listing providers, and for whatever reason the locksmith industry became the worst of them. Flower delivery and personal injury lawyers often fall into the same bucket. You'll still see companies named "AAA Locksmith" and the like because this behavior dates back to the days of the Yellow Pages.
As to why Yelp is better than Google on this, I'd guess it's either that you got lucky, or that Google is more targeted than Yelp these days. I'm not up on the current state of how listing verification works now, but it's possible that Google's process is easier to target than Yelp's, and if there are any weaknesses, a locksmith marketer will figure it out pretty quickly.
Just to illustrate how long locksmiths have been a problem, here's an article from 2009 talking about locksmith spam on maps. The techniques have changed but the general reliance on sketchy tactics hasn't.
Specifically for locksmiths and garage door companies, Google Ads tries to fight back against this[0]. I've gone through this with a few clients.
However, they still let lead aggregators get verified, provided they have a local business license. However, "legacy" google ads accounts like locksmithdirectory.com seem to be able to advertise anywhere in the nation.[1]
Several years back I needed a plumber in a bit of a hurry. I used Angie’s List, now angi.com, with a little less hesitancy than using Google reviews or yelp.
The plumber I hired this way did a good job at a fair price. For less urgent work I hired this company for other work even after getting bids from others.
When I needed a plumber I reached out to a bunch of buddies to see who they use.
I got quotes from three of their recommendations and ended up using the one a buddy found on the back of a church bulletin. Guy was amazing - a one man shop - super professional, fair price, quality work and replacement parts. Done in less than 1 hour. It's great to have a trustworthy plumber.
I don't know about the US but in Europe many cities/communes will list registered businesses in the area, usually these are manually curated lists. so while you don't necessarily get ratings/reviews (which I have basically stopped trusting altogether), you'll get legitimate.
Hiya jaycroft, et al. First time / long time, here. It sounds like you're already taken care of, but I hope this will benefit /someone/ reading through here. Iofd, I am a card-carrying ALoA member and professional locksmith.
The Associated Locksmiths of America (ALoA) [0] has its own search tool [1]. Of course, the same rules apply as everywhere. Not all good locksmiths are members, and not all members are good locksmiths. But, personally, I'll take the word of a trade organization over that of an advertiser any day. The real tragedy here is that both google and yelp apparently missed the opportunity to serve up a tool like this, in favor of (I'm guessing here) whoever bought the most expensive SEO package.
To answer your question: In my experience, yelp is dealing with this by being a smaller service, in every sense.
Google has, by making itself the de faco choice for each and every mode of search, become a "bucket of crabs" [2][3]. As such, it as an environment is selecting for that crab who can best pull down the other crabs, and not the "tastiest" or whatever.
That said, I can't think of anyone, off the top of my head, who puts any money into yelp. Where I live, it simply isn't popular. It's not a part of the culture, the same way that google is, and so is not as attractive to interlopers, "puppy mill"-style franchises, etc. I believe you're getting better results simply because it's too small a bucket for bad-ish actors to see it as a viable feeding target.
Back to the trades: Imho, screw search engines at large - even ALoA's. Ask your friends for recommendations. Don't have any friends? Call up your favorite cafe, and ask them who they use. Even if their tradesmen work strictly in the commercial space, and you're looking for someone to do some residential work, they /really should/ be willing to recommend another tradesman. One doesn't work in the trades for very long, without being exposed to the other players in one's area.
Lastly, I beg you: if you've found a tradesman who treated you well at a fair price - evangelize on their behalf. Tell your friends and family. Ask that locksmith for a dozen business cards. Most of us will knock a few bucks off of a service call if we were recommended by word-of-mouth. Not everything needs to be an on-line affair.
[3] - The only entity that wins, in this scenario, is the cat who owns the bucket... I know a number of very good tradesmen who feel like they need to spend very big money on SEO and advertising just to come out one index-position ahead of their competition. If the numbers -one and -two position, on google specifically in my area, would put aside what I call their "advertising cold war," they could both afford to take a very nice holiday every year. Sadly, they choose to subsidize some advertiser's very nice holiday. So goes the world.
That's very possible - reviews by obscurity or something. Although I really feel like 10 years ago the roles of Google and Yelp were very much reversed here. Changing times changing strategies I suppose.
> Oh and the real masters of this business model? Well they don't bother SELLING the leads to contractors, they will quite literally start their own company and will hire their own plumbers, electricians, concrete crews, etc to squeeze as much profit as possible.
Now, this part is funny. It's come full circle to a legitimate business. (Kind of)
Kind of the same path Google attempted with SEO spam, making the easiest path to success actually producing content people spend time on and link to.
Of course, this has devolved into the "life story before the recipe" sites that have become the shining failure of what can go wrong by focusing on these metrics.
The incentive to put the story on the page along with the recipe comes not from Google, but rather from US copyright law, which has decided that a plain recipe is not copyrightable; there has to be some "personal expression".
This doesn't make sense to me. Isn't the recipe itself still not subject to copyright law? What is the benefit to the creator to adding the personal expression portion?
No: that's the point: copyright law says that a plain recipe is not copyrightable -- i.e., if I copy your recipe, you cannot sue me for copyright infringement unless the recipe is mixed in with your opinions and subjective perceptions and such.
Right, I get that, but the thing people value (I think) is the recipe itself, which is also the part that can be copied (when separated from the opinions and subjective perceptions, which I suspect most people don't care about).
It is an attempt to stop copying of the recipe by allowing the site owner to sue the copiers for copyright infringement, which is not possible -- at least in the US -- for plain recipes.
The video calls must be new. When I first made a Google My Business profile, there was no verification. Not even address verification. And then I couldn't get the listing delisted from Google either (my friend made a prank listing).
At some point they added postcard by mail verification. Then they added having to upload documents (articles of organization, pictures of store). And then the last time my account got suspended I had to make a video showing the above as well as including the cross streets in the video.
It doesn't surprise me so many people are gaming this system because it's effectively a free pass to the top of local Google searches as well as getting into Maps searches.
One thing I don't understand is why many or most of these fake businesses weren't thwarted by postcard verification. I could only come up with a couple possibilities:
- Google stopped doing postcard verification, or a loophole in the creation process lets savvy scammers avoid it (like an alternate verification method or providing a different address for the postcard).
- New business entries go live before the postcard verification, and that period is long and lucrative enough to be worth exploiting.
- They're paying local property owners to accept a postcard and read them the number - postcard mules. That seems hard to scale as big as some of these networks. Two of the "chains" had dozens of locations in one metro, all seemingly created in the same month or so. Also, some of the addresses seem like multi-unit commercial buildings where one person wouldn't receive a postcard.
Getting an address = potentially thousands if not tens of thousands of dollars in profit. Being creative on how you attain addresses is one of the main criteria for this business model.
One unique method is working exclusively with a local plumber, electrician, etc and HAVING THEM get you the addresses while you retain control of the GBP entity and sell them the leads.
The pitch goes like "you've seen the success I've had getting other clients tons of leads right? Get me 3-4 addresses in the cities you want to target and I can get them ranked" The client then asks around, uses their own address, etc to find them for you.
Thank you. That makes sense for a lot of cases. I saw some business names that had 50+ locations in one city, but I guess given enough motivation, that can be done.
Related: I submitted edits for some of the businesses (marking them "Doesn't exist") and Google rejected the edits. My Maps contribution history says "NOT APPLIED - Google couldn't verify your edit" for a long list of fake businesses. If that's how they process reports - about new businesses with obviously anomalous reviews - it's no wonder this continues.
The 'fixing up mistakes in the map' team is quite separate from the anti-spam team.
Using volunteer reports for anti-spam doesn't work because the spammers play a numbers game, and perhaps only 10% will be reported by a good citizen like you.
I guess I don't see them as mutually exclusive. I agree that relying on volunteer reports isn't sufficient, but from what we're looking at here, neither is relying on an anti-spam team/proactive detection.
(Google Maps PMs, if you're reading this: feel free to contact me to hear my experience. There are some seemingly simple, low-false-positive ways to improve reporting of fake businesses and accounts.)
To point 3, a friend of mine uses one of his client's addresses (with consent) as his GMB location. I'm assuming anyone who knows property owners would easily be able to convince most of them for a small monthly fee to use their address for this purpose.
That being said, it's very fragile. The above friend was very well reviewed (300+ >4.5 stars) and popular in his market. He told me recently Google suspended him and it destroyed his business for a bit. Not sure if he's back up but he seems to be doing better now.
What baffles me is how these networks flourish so easily yet Google can't tell a real business from a fake. The number of people calling me lately (I'm in the same business) about the Business Profile being removed by Google. Even active retail shops that have had their account for many years, with a clearly visibly business on Google maps. Their GBP simply vanishes and in a few cases, the only solution was to simply start over with a new profile.
Google has more data and more money than anyone on this planet, so they easily could tell fakes apart from real ones if they really wanted. The question is why they do not want to do so ... Will end up another dumb topic to be regulated in the EU in the future.
How can they start over with a new profile? It seems to me they would have to either move or get a new business name? I’m not trying to bust your chops. I am genuinely interested in this whole thing.
It was actually suggested by someone at the BGP support team. We had a different employee there create the new listing while sitting in the store. It went live with 24 hours, only none of the old reviews, pictures, or reviews were there. So they are starting over on that front.
this makes me think that they felt like some other aspect of that GBP was why they deleted it. But since they won't tell us why, we have no idea. I could guess, but any guess is just that, a guess.
The weird thing is that it’s often impossible to manage your own GBP. I was on the board of a small private school where a couple of knucklehead students posted some weird reviews. We couldn’t do anything until I was able to leverage a high level google contact, which is something I hate to do.
Removing reviews should be difficult for the owner of a business. It seems weird to me that someone would think it appropriate for a business to remove reviews of their business as they see fit otherwise you just get business owners removing all bad reviews
It was a weird situation where the review ran afoul of policy, but the organization wasn’t able to respond in a way that allowed them to follow a Google process. (Ie someone set something up 15 years ago with a defunct domain name or similar, and there was an “orphaned” instance of the place.)
The “fix” was to essentially reestablish the lost ownership of the business (which had paid Google Workspace and GCP presence) with their listing. Once they regained control, they were able to file a complaint and a Google reviewer removed the content.
It wasn’t a situation of “This place sucks” getting taken down.
> Google has actually begun VIDEO verification where you literally have to facetime with a Google employee to verify you own the business you say you own... even this can be gamed since any type of manual verification will be outsourced.
I feel that this is going to be a big negative externality of AI: since it makes faking everything much easier, all verification processes will become more difficult and expensive. Eventually there will start being "you must come to this office and present ID" steps, with all the associated costs.
This is interesting. I'm curious how do they achieve the opposite, i.e. deleting dozens of legitimate reviews from legitimate accounts when they have angry customers?
What's the mechanism they use to convince Google to remove them?
IF I think to insult them, I will make sure to take your comment into consideration. but since I HAVE NOT and do not intend to insult them, then it seems your point is moot.
Someone can create a bunch of them, using some evasive techniques to avoid Google identifying them as one person.
When people call asking for service, that's a potential lead. This info could be sold to a contractor.
The other piece is making the GBP compelling enough--through fake reviews, submitted by web browsers running on separate IPs--to have folks contact them.
More ambitiously, the person doing this creates their own business, hiring out service crews to do the work and capturing more of the profit.
> Oh and the real masters of this business model? Well they don't bother SELLING the leads to contractors, they will quite literally start their own company and will hire their own plumbers, electricians, concrete crews, etc to squeeze as much profit as possible.
So... the real masters of the business model are the ones... actually operating the businesses they claim to be operating?
The difference is that these companies figured out that the real business is SEO and leadgen and the actual work is secondary. The capital H hard problem isn’t plumbing it’s finding work. Once you own the sales funnel it’s game over for anyone else.
I have an interesting story in that vein. (genericised to avoid shaming anyone)
Back in the late '00s I did development for a SEO-focused agency. We got a small firm that did a specific type of rental equipment. This was an industry that was traditionally very local and Yellow Pages oriented, to the point where leading brands were usually names like "A-Amazing AAA Aardvark Services".
The page was good enough that it started ranking on out-of-region searches.
So we built them a huge "directory" site. It had pages of spun content for almost every named city in the country, and we peppered it with a few listings of local service providers.
It was on the edge of being an actual useful resource; they went to their industry trade show and could say "We're page 1 (and frequently result 1) for that service name in almost every city in the country." It had your usual late-2000s/early-2010s good-practice SEO stuff-- well-formed URLs, tidy redirects everywhere, a few paragraphs of text on every page. They started taking a listing fee, allowing coverage at a per-county level.
It worked very well; getting real listings improved the actual user value of the rubbish content site and added further randomness to the generated content.
But anyway, they got greedy. They still had people calling their central phone number and wanting them to do reservations for them, which let them take a much higher commission than a listing fee paid. We built them some tooling to manage that sort of reservations. This is essentially the business model the fake GBP you mention is, except that for one narrow segment of the country, they were the service provider. More importantly, they replaced all the individual vendor contact info with their own.
They really wanted to hand over things to one of the owners' sons, who (along with the owner) had some very colourful pasts and questionable decision making abilities. So we let them go their own way, and continued to experiment with the model in other industries. Got good results in one other vertical, and a handful that just rotted on the vine.
But when we turn away, the site starts tanking in rankings. Maybe SEO spam detection improved, maybe removing the phone numbers made it obvious there wasn't much real content there. They ended up making various frantic changes trying to salvage the flow, but it was never the same. When I left the agency in the late 2010s, they were making frantic rework efforts trying to recapture the lost magic.
So I'd say the business concept can work, but it's weird how we have it being a SEO guy first. You'd think you'd find the service companies driving things-- by forming some sort of marketing/branding co-op with similar firms in different markets, they could split the costs of maintaining the SEO presence, and hiring a captive developer means they would be able to organize a flat rate dev contract rather than paying a high per-lead commission.
95% of the 100+ comments on this business are fake, presumably from a comment/review farm that was paid by the business owner (though I don't know that).
The same commenters - some of which Google Maps describes as "Local Guides" - also have commented on dozens or hundreds of businesses that don't exist at all.
The fake business entries are basically using Google Maps place locations for SEO and presumably, referral lead gen. Create dozens of business places with random addresses throughout a metro area, name them after a service that someone might enter ("Heating repair"), and list a Web site or phone number. Wait for less-savvy consumers search or stumble across them and call.
Among the dozens or hundreds of fake Google Maps businesses that this network has touched, here's two:
That address is actually a random suburban house, not an appliance store.
Some of the fake businesses have gone undetected for years, and in that time, have collected a few real reviews from people who called and didn't receive the service. Here's one from "Heating Cooling Repair Services": https://www.google.com/maps/place/Heating+%26+Cooling+Repair... :
> If i could give them zero stars i would, don't waste your time.. I scheduled an appointment to fix my broken AC unit and was pleasantly surprised at getting an appointment the same week. I took off early from work to ensure I was home before the scheduled time. Nobody ever showed up, nobody called, and I called their number multiple times to see if maybe something came up and they never answered their phone.
The fake Google Maps reviews are as generic as you'd expect. For example:
> I have been a patient at this medical laboratory for several years and have always had a great experience. The staff is friendly and efficient, and the facility is clean and well-maintained. I appreciate the quick turnaround time for test results and the ability to easily access them online. Overall, I have always received top-notch care at this facility.
Google Maps doesn't have a way to report an entire account as a bot; one can only flag a specific comment. There's also no way to provide enough information for Google Maps' trust & safety team to understand what's happening and figure out how they're evading Google's bot detection. So, it continues unabated.
> Google Maps doesn't have a way to report an entire account as a bot; one can only flag a specific comment.
I had been leaving reviews for about a decade on a number of businesses I interacted with.
Some were pretty bad and I had extensive reviews with photos etc. The most egregious was a hotel in Lisbon where all the fire extinguishers were empty (with pictures).
One day I got an email from google maps that one of my reviews had been reported and flagged, and that they removed all my reviews ever and disabled my ability to post reviews.
To this day, I have no way to reverse the decision, or even find out which review was reported and flagged. I can’t leave new reviews anymore, can’t talk to anyone at google about it (of course), and all my reviews have indeed been taken down (verified by going to places I remember reviewing and not seeing my review anymore when not logged in)
On one hand I feel it’s google’s loss for their own idiocy and blind automation, but on the other I feel like it’s just letting the scammy businesses win: just report reviews you don’t like and they’ll get taken away making your scammy business have only 5 star reviews.
I own a business in Somerset, UK. The site we are on is roughly 40% us and 60% Somerset County Council property. We each have our own UK postcode - normally reserved for around 5-80 properties.
The SCC bit has multiple uses - a transport division (minibuses for schools) and nowadays the vestiges of supported living. Its being wound down and is being sold off.
We moved to Yeovil Five Ways from near Hazlebury Plucknet (yes!) around 10 years ago. Google had no idea what was going on at this site when we moved in and I looked us up. Our bit was formally NHS - a clinic. The first thing I noticed was that their idea of the SCC "Resource Centre" was way off so I submitted a change - went through in seconds. When the eye of Sauron eventually noticed that my business had moved, it screwed up the entrance. I tried to change it. No dice.
I can make a change to a publicly owned property but not my own.
Google's insistence on hiding behind computers ("the Algorithm") needs to be challenged. It is way more important than my silly little snag. Google need to employ more people and not sack them! When an org. becomes the de facto authority on something then obviously they have developed a monopoly. Monopolies need to have responsibilities enforced on them.
This may come off as a little intense but this seems like the central issue with capitalism in our world today. Competition is competition to lower human expectations to increase corporate profits instead of giving more to humanity on the back of the corporation that has grown a capability to do it.
To me that doesn’t come off as intense at all, it’s just correctly reducing this down to the real underlying problem. Vital social tools that we use to live our lives are being operated by shady corporations for profit and not the greater good.
Almost got scammed by something like this when our dishwasher broke last year. Found on Google Maps a listing for “[locality] Appliance Repair”, in a small shopping center storefront nearby. Called the number and sounded like I had reached a large call center, with the sound of other people talking and typing in the background, so this was the first red flag (the storefront on the map would have been this small little place). They wanted a credit card number in advance, for which they’d charge $75 or something as a deposit, also unusual for this kind of business around here. Halfway through giving them my number my spidey sense reached a tipping point and I hung up.
Double checking the map later and looking at Street View, the storefront was conveniently obscured by a tree.
Interesting. Something is up. A few more things that seemed odd:
1) It looks like most of the reviewers have only reviewed a few businesses. Maybe this is to avoid suspicion, but if the accounts are fake they seem underutilized. I didn't see any fakes with over 6.
2) On the page you linked, several of the reviewers (Thaddues Kelly Parks, Darren Meyer, and Adilson Vierra) gave a standard glowing review but only awarded 3 stars. Also to avoid suspicion? Others gave 4.
3) All (almost all?) the fakes are within the last month. All of the extremely negative reviews are "a year ago". They are so negative I almost wonder if they might be fake too, and it might be extortion.
> 2) On the page you linked, several of the reviewers (Thaddues Kelly Parks, Darren Meyer, and Adilson Vierra) gave a standard glowing review but only awarded 3 stars. Also to avoid suspicion? Others gave 4.
The alternative explanation is: they're real people who are terrible with technology and the internet. I've run a site where people could rate their experience with others, and the correlation between stars and text was only so-so. Lots of people considered 1 to be best, even though clicking on 1 showed a text "Terrible" just below it. 3 Stars was actually pretty common for glowing reviews.
Everybody keeps forgetting that lots of people write reviews, especially when you ask them to ("hey, if you liked it here, please recommend us on Google Maps"), and some of those people will be the kind who gets these Amazon questions from other customers and reply "I'm sorry, I don't know how well they fit, I bought these pants for my son but he blew up the chicken coop and hadn't had time to wear the pants yet".
1. My guess is the same as yours - it’s to avoid suspicion. And maybe creating new accounts is easy enough that there’s no reason to over-use one account.
2. Yes, I imagine this is either to avoid suspicion or because the person writing/pasting this comment wasn’t paying attention and chose the wrong rating. Even fake reviews will have an error rate above 0 :-)
3. I was curious about that too. Another possibility is that the service really does suck, that’s reflected in the old negative comments, and eventually these businesses resorted to paying for reviews. All guesses though.
2) could be a tactic. I rarely give 5 stars (because how often does something actually 100% meet expectations?) so I assume that 5 star reviews are either:
a) scammers
b) people reviewing with zero/way too little context ("this is the BEST maternity ward in the universe!!!")
Likewise, I figure most 1 star reviews have some sort of axe to grind.
So I gravitate towards the 3 star reviews - that's where the interesting stories are.
I experienced this while trying to get my air conditioner fixed on short notice during a heat wave last year. Got scammed in a minor way. Thanks for posting this. I saw it happening — dozens of clearly fake businesses with tons of 5 star reviews, with calls routed to the same call centers with the same predatory pricing schemes. Wasn’t sure how to report it, but calling it out like this is a good idea.
> Google Maps doesn't have a way to report an entire account as a bot; one can only flag a specific comment. There's also no way to provide enough information for Google Maps' trust & safety team to understand what's happening and figure out how they're evading Google's bot detection. So, it continues unabated.
But didn't they used to? Some of their old support articles used to mention the ability to report accounts, but that functionality seems to have disappeared.
I tried to report a business garnering fake 5* reviews last week and was frustrated that there was seemingly nothing I could do, especially since they buy and sell stolen goods.
I've seen random businesses listed appearing as a house in neighborhoods around the city before, but I always attributed them to a sole-proprietor type of business where they've listed their home address as their business address. I always thought it an odd decision, but could shrug it off as some people just are not as savvy about the implications of making those kinds of decisions.
But having it be the results of a bot farm makes sense too
Taking a step back, we rely on countless systems every day where some reasonable proof-of-personhood is critical for the application, yet our countermeasures are best-effort in-house fraud prevention relying on security-by-obscurity. I suspect virtually all systems of today are ripe for exploitation in a rapidly evolving cat-and-mouse game. We’re in the early stages of a dirt cheap, sophisticated AI content generation revolution. Yet, our rhetoric suggests that these are minor, isolated issues with specific companies.
I’m wondering if it’s time to properly categorize these attacks as a separate and omnipresent danger to computer systems that process and distribute human input, and take it seriously. (Is there already a term for this? Sybil-attacks?) Are security researchers or academia largely overlooking an elephant in the room? Maybe I live under a rock, but I haven’t seen any interesting movement in analyzing, much less mitigating, these threats systematically.
Specifically, I fear the huge boost in human-imitation AI will shift the scales in favor of gray/black actors, due to reduced general trust-levels (as if they weren’t already low). If fake reviews cost $5 today, but $.01 tomorrow, there’s simply no way our dams will hold to that pressure. We really need some answers on how to navigate the upcoming sea of bullshit, or we’ll regress quickly into a world that’s disorienting at best, for good actors, and offers plenty exploitation by bad actors.
You're right. It is an issue and a lot of players and researchers are already into it in an area called "Trust & Safety". However, these are problems that pertain to platforms as opposed to other tech enterprises, and as such, they are mostly dominated by these companies interests and strategies. E.g. it can be argued that misleading advertisement is still good business for GoogleAds or Meta. Refer to a discussion here on HN along the lines of "the optimal amount of fraud is non-zero" to get a better idea of the sort of thing I'm talking about. Moreover, aside from being problems of the closed platforms we chose to be the "winners" of the Internet most people use, it looks like the companies don't want any help in solving them, or won't make it any easier. A lot of people has done research on fake instagram accounts, for instance. It now got almost impossible to have API access to followers/following ratio or even scrape it, which is a key metric in that research. Anyway, I digress, but yes, it's an issue, it's a proper issue of platforms that take human input, and it's one they don't want our help.
I have constantly received emails(~monthly) from companies advertising these services to my business. The packages they always advertise are as follows:
1. 10 Google Reviews, 50 – 100 Words, REAL Active Profiles, Local Profiles, Drip Feed Method, 24/7 Ticket Support, for $94.99
2. 20 Google Reviews, 50 – 100 Words, REAL Active Profiles, Local Profiles, Drip Feed Method, 24/7 Ticket Support, for $179.99
I always assumed that if you have bad reviews, the go-to was to either change how you operate, change your business name, or do both.
I got scammed by this exact type of thing when I needed a tow truck ASAP to jump my car. They had a fake business <1 mile away with lots of good reviews. After giving them my credit card info right away and after a long delay, I gave it more scrutiny and realized it was definitely a fake business. I called multiple times to figure out where the F$&@ my tow truck was, each time talking to a different person with a filipino accent. An impressively sophisticated scam, Im not sure how google could fight it
AAA has been utterly useless. In the past 2 times I needed a tow, they couldn't arrange one in a timely manner, with lots of delays and miscommunications.
Huh my experience is very different. I used the app to get a jump start on my car and they came out in 20 minutes with no hassle. I think it really depends on your location.
These fake reviews are easier to identify. No profile photo, they typically have one or two 5 star reviews. If you click on few reviews of a business and if you see this pattern then most likely they are fake. In the past I want to choose a mover and this particular business has 4.9 stars with over 300 reviews. There is no way a mover can have this rating. I clicked on atleast 50 reviewers and all of them have only one review and it is a 5 star one. For some reason Google doesn’t care. I tried to complain about a particular review but there is no option to indicate the kind.
> We had a weird circumstance where we were out of town for an extended time and our HVAC unit quit working during a massive heat spell. Access to the house had to be coordinated and the bill had to be paid remotely. None of that was an issue for Roy, who was able to get out and repair the problem super quickly and for a completely reasonable amount. This is our first time using Seattle Metro Heating & Cooling Services. The experience was so positive that they will be our go-to HVAC professional from here on out.
Its a lead farm the review may be real but still worthless. The named business does not exist but there is some sort of lead company that has local contracts and randomly assigns the job to some random guy that says he is HVAC cerified.
Nearly all locksmith, towing and moving company listings are like this now.
Its basically automating fly by night contractors. The paying customers will find the guarantees and warrantee are worthless.
Your fake-meter is trivially easy to bypass with a few 3- and 4-star reviews and a fake DALL-E profile photo. This is already seen quite often in the wild.
Gaming the system never ends. I recall reading like 2 years ago where someone would drive around in a car with 50+ smartphones asking google maps for directions to pump up business rankings for GMB.
I recently ran into fake business on doordash of all places. I was in a hurry and ordered without reading too much. An hour and a half later canceled with a full refund from DD. Got curious and drove to the listed restaurant in person, it turned out to be some bank building. So it wasn't even a duplicate or impostor, it never existed. Since I got my money back, I'm assuming they are trying to scam doordash itself...
Doordash is into extremely sketchy territory. Here is a good link if you want to know more.also read the top rated comment from former grubhub executive.
What I’ve heard from people in the service industry is that tons of pickup orders never even get picked up. Maybe they’re banking on some percentage of delivery orders not even noticing that no food arrives? Still, seems highly unlikely to work out.
That's the part i'm not sure about. The menu looked totally legit, the phone number turned out some random person in Vegas (after i bothered actually calling). Someone took their time to set this up.
I think society will eventually be forced to adopt the broker model often featured in dystopian media. People will no longer trust big corporations and instead refer to local fixers and information brokers to get the information they need (for a fee of course).
"Need a real plumber? Well here's a good one for 5$. A competent lawyer? 50$ and I'll tell you."
The sad thing is that big corporations won't fix this problem unless they are allowed to fully compromise everyone's privacy. The can solve it in another way, but they won't. This is a people problem and requires people solutions (Governments).
I researched duct cleaners recently and found a similar set of dubious businesses. There are several businesses named "American Air Duct Cleaning of [insert city name]". Google Maps has 70-120 5 star reviews. They all say things like “David and Oscar did a great job”…. from Florida to Texas to other states... always David and/or Oscar for each place! All the reviews are in the last 6 months or so. All the reviews are relatively unique and the reviewers are not new Google reviewers… there’s definitely some sort of weird Google Review scam going on here. All the websites say “Family/Locally Owned & Operated" yet they're identical web pages.
I'm surprised by how unsophisticated the approach appears. Interesting to see the problem is not limited to duct cleaning businesses.
I remember this being especially bad for certain niches like locksmiths. In that space, someone would create fake businesses and then take the leads they got via phone, email, websites, etc, and then refer the business to some actual locksmith. With probably heavy mark-up to cover the referral fee.
Oh wow, see my other comment in another thread. I had a ridiculously bad experience trying to get a key fob made last week - all the numbers would lead me around in circles, then I'd get "spam caller" numbers calling me telling me they were on their way. Switching to Yelp reviews seemed to solve the problem for locksmiths in particular, and I really can't figure out why...
Replying to myself to add: for any other household service I probably wouldn't have even noticed. But, being in a vulnerable position, having sketchy locksmith services really freaked me out. You want my address and credit card info and also know that I have a disabled vehicle potentially outside of my garage? No thanks, not taking any extra chances here.
I’ve run into this when looking for an hvac contractor to do some work in my basement. Was just going through the listings and making a bunch of calls. It was definitely annoying encountering all the fake “store fronts”, but I also found that just by talking to them and asking a couple questions, it was super obvious which ones were fake and which ones were legit.
It’s possible my case was a bit unique in how obvious it was. I was specifically looking to find a small local shop or independent contractor just to do a walk through/consult on expanding the bare bones hvac setup in the basement for finishing. I was doing the work myself but wanted expert input so I could try to avoid the common problem in cold climates of basement living spaces being significantly colder than the rest of the house.
Independent contractors are easy. Many are just listed under their names, and even if they use a business name, their business number is almost always just the cell phone. When you call they’ll either not answer and you have to leave a voicemail to get a call back, or if they do answer, they’ll pick up with something like “this is <insert name>”. So for them you don’t even need to ask anything.
When calling a number that is supposedly a small shop, I found that when I told them what I was wanting and asked “is that something you would do?”, the fake ones would immediately say yes. The legit places would ask follow up questions, or if it was an office worker, they would have one of their techs call me back.
Any verification you can get over the mail or over the Internet or over any other distant communication can be faked. Cryptography doesn't help, genetic material doesn't help, fingerprints don't help: They only prove that the entity you're communicating with has access to private keys and at least one person, assuming genetic material can't be faked at this point, not that you're always communicating with the same person. It's why the old cypherpunks insisted on exchanging public keys in person.
It's a very difficult problem to solve in a way that works for most people, i.e. secure, privacy preserving, easy to use, etc. It's easy to have one and not the other. It's not true that it can not be solved at all though. The guys from idena.io have a solution that definitely works, problem is it's not convenient and I highly doubt that it'll ever be adopted by the masses. But it is a sybil attack solution and it does work over the internet.
Edit: Just noticed you said prove that it's always the same person. They can not do that. But they can prove that it's a unique human. Which seems good enough for online reviews imo, where it doesn't exactly matter who the person is.
I own a real locksmith business in Albany, NY. The legit companies here are getting killed with bot farm reviews. I get multiple daily. They are going to town. I believe it is a scammer company here paying for it. Said scammer company also turns out to be the Google Guaranteed company lol. Can’t make this stuff up. Like a dozen fake negative reviews a week. Its taken me years to build a good reputation and now its being completely destroyed with fake reviews that go so low as to insult my manhood.
I got a COVID test at a local independent pharmacy. This same "Right Way Laboratory" processed the results and billed my health insurance company over $500 per test.
I got a COVID test from UW Hospitals and Clinics in Madison WI. This is a huge academic medical organization with tens of clinics scattered in all parts of the city and millions of square feet of hospital space.
I had to drive about 40 minutes to a drive through location beyond the other side of town. They also billed my insurance over $500.
Assuming you got accurate results in a timely manner, you got the better deal by not having to leave your neighborhood.
I see the same thing going on Youtube. Not just one spam account, but whole networks with hundreds of accounts dominating one comment section. All building one coherent story to scam people. It's often the most liked comments having 10x more upvotes than others. These are in the 100's and 1000's of upvotes.
Algorithmic and AI failures like this are starting to pave the way towards curation by skilled knowledge workers. Is anyone actually working on this again?
Yeah, thanks, I forgot to add Wikipedia to the list. It is a great resource but there are many forces trying to change it to suit their needs.
And even scientific papers often contradict each other, they are also good quality but far from delivering truth. At least in some fields, papers are just throwing random ideas to the wall seeing what sticks. We don't even have proper theories to guide this process.
I shouldn’t be saying this here but to be honest this hacker should be reviewed, I just used his services, and he’s the best, experience and ethical. Contact him for any hacking and recovery support via email, (expertwisehacker@gmail.com") you can tell him I referred you.
I shouldn’t be saying this here but to be honest this hacker should be reviewed, I just used his services, and he’s the best, experience and ethical. Contact him for any hacking and recovery support via email, (expertwisehacker@gmail.com") you can tell him I referred you
There's an enormous and growing market of fake GBPs for the purpose of selling leads called Local SEO Lead Gen. (each entity can bring in thousands of dollars/month.)
The thinking is why go through the headache of dealing with clients who can fire you the day after they begin ranking (Local SEO is heavily "front loaded" work wise), will always try undercutting you on price, etc, when you can CREATE YOUR OWN entity, get that ranked and then SELL the leads to that plumber. You're the one with 100% control and if the plumber isn't happy, there's a dozen others who'll gladly take those leads.
Advanced lead gen owners use software such as MultiLogin along with mobile proxy farms to have hundreds of separate Chrome "entities" saved, all using different proxies, their own cookies, etc. This along with an infinite amount of other tools for call tracking, CTR manipulation, etc.
Mobile proxies have really changed the game, giving these lead gen folks an advantage. Because of the nature of mobile proxies (where multiple people can "share an IP address"), it's more difficult to detect. Since EACH GBP entity can bring in thousands/month, it's miniscule in terms of cost.
Reviews? Laughably easy to purchase and outsource, starting around $5/review. Combine this with fake Dalle images to attach to the review and/or GBP itself, and things can only get worse from here.
Google has actually begun VIDEO verification where you literally have to facetime with a Google employee to verify you own the business you say you own... even this can be gamed since any type of manual verification will be outsourced.
Oh and the real masters of this business model? Well they don't bother SELLING the leads to contractors, they will quite literally start their own company and will hire their own plumbers, electricians, concrete crews, etc to squeeze as much profit as possible.