Today I found that Google has a funny feature that allows everyone to claim ownership of a particular business, and if the owner does not reject it in 3 days, then the business ownership is set to the new claimer.
So, it goes like this:
- The attacker claims ownership on BusinessX.
- The owner of the business in in vacation and does not check emails, or simply ignores the emails thinking it does not look legit.
- After 3 days, Google transfers the ownership of the business to the attacker.
- The owner of the business realises what had just happened and wants to reclaim their own business, but the attacker rejects every time and asks for money.
Obviously, this is spam, but in the same time I think it is clear that this behaviour is actually not okay in terms of security.
Why does Google still do that, though?
Is there any way for the owner of the business to "freeze" their ownership or prove it so that nobody else could just "claim it"?