Hacker News Reader

Comment by vineyardmike | Hacker News Reader

> That sounds absolutely insane.

It is absolutely insane that organizations are weaponizing this.

> Doesn't Google have any way to dispute the business ownership?

I can only speak for the US and it’s been a few years since I’ve done it, but yes Google does have a way. You can report an issue, and “claim” a business. Google will literally send a postcard with a unique ID to the registered physical address, and whoever gets that postcard can take ownership.

> Can I take over any business on the maps by just registering a domain that contains the business name?

Absolutely not (at least legally I assume). It’s probably trademark infringement and potentially fraud to misrepresent that business, and also Google has other methods to verify ownership (see above).

View on HN

> You can report an issue, and “claim” a business. Google will literally send a postcard with a unique ID to the registered physical address, and whoever gets that postcard can take ownership.

When you say "registered address", do you mean the actual business registered address (as in on Companies House in the UK, for example) or the address which was used to register the business with Google? Because if it's the latter, I think I see a problem ...

The "address" in question here is the location on Google Maps. I managed a few locations for a business and verified them this way. Google would frequently ignore our own posted opening/closing hours and phone numbers in favour of whatever some random user provided under "Suggest an Edit". Horrible system, and support requests just ended up at some Google contractor's inbox in India, where they request to have video calls at 3AM ET to verify our identity (again).

> Because if it's the latter, I think I see a problem ...

Believe it or not, someone spent at least a few hours thinking about this.

The address is physical address that a customer would go to when they look up the business on the map. If it's a restaurant, it's the address that has the tables and food and drinks.

So then how can the scam work after the german restaurant gets the unique postcard?

It certainly sounds like they would be sending it to the address provided by the scammer. The issue is their system assumes the first person to interact with it is trustworthy: gives a real phone number and address. If that first contact with Google was MITM'd, they seem to have no way to develop an un-compromised relationship with the real entity.

In Germany, everybody and their siblings usually ask for a recent copy of the trade certificate of registration--it actually is quite annoying. Google could do the same.

I don't think it does. The postcard should go to the place where the customers go, so for a restaurant its the place with the tables and the food and stuff.

If the address is different than the address of the shop-owner, then how would a user who uses google maps get to the shop? And why wouldn't the shop owner just create a new, correct listing?

Reply on news.ycombinator.com