Understanding Google My Business & Local Search
Illusory Laptop Repair – A Most Elegant Google Places Hack
This story of intrigue comes to you via a discovery of Eric Petreska, the quite brilliant head of of Maximum Results Marketing, a local search marketing firm in Spring Hill Fl.
When you search for virus removal Olean NY you see an interesting result.
Not our listing for a service my brother provides…. no, the other one…for Illusory Laptop Repair. A quick drive by or Streetview look-see would soon convince you that 154 Main St, Bradford, is anything but a vibrant downtown location. It is however, smack dab at the centroid of the Bradford.
What is this? MapSpam creeping into the hinterlands? Not to worry, I am on it…
Well rather I am it. OK I admit it, I created it. I couldn’t resist. You know scientific protocol testing, that sort of thing… all for the good of humanity. I couldn’t very well report on it, if I hadn’t tested it.
The truth? It is such an elegant hack, so simple yet so powerful, I really wanted to prove to myself that this one was in fact real. The local area code phone # rings into my office via Google voice, the record was secured via a PO Box that I have access to in Bradford PA. Sometimes the most powerful hacks are really not hacks at all, just a simple creative use of an existing feature .
Here is Eric’s description of how it works in his own words (bold mine):
The problem is the differences between how the Post Office interprets addresses and how Google places interprets addresses.
If I create a new listing in google places and I give it this information
Name: Maximum Enterprises
Street Address (1st line) : 100 W. 1st Street
Street Address (2nd line): 225 E. 9th St. Suite 101, #9876 (my note: this could be any deliverable address PO Box, UPS Box or Street Address)
City: Los Angeles
State: California
Zip Code: 90112
Then I select “Verify by mail.”
Google sends the PIN number with this address:
Maximum Enterprises
100 W. 1st Street
225 E. 9th St. Suite 101, #9876
Los Angeles, CA 90112
Here’s what happens. The Post Office eventually delivers that PIN# to the UPS store at 225 E. 9th St. Suite 101 (it will take a bit of extra time for handling, the ZIP code is actually wrong for the UPS store, so it will kick around the Post Offices a bit before it eventually gets delivered). The guy at the UPS store puts in in box 9876 (fictitious box #, he’ll probably trash it or return it, but if I had an actual box there, and used that number for my address on Google, it would go in my box).
I get the PIN and verify it, and Google places my location marker at 100 W. 1st Street (49 feet from the point that Google uses for “Los Angeles, CA”).
The post office delivers to the last address line, the line on the envelope closest to the ZIP code. Google places the marker at the first address line. This difference in handling allows anyone to “verify by mail” for any address they want to use that is in the same city as their actual mailing address (or a UPS store/Virtual office location in that city).
The technique would work with almost any second line address that is viable… a real street address, UPS stop, a PO Box. It could be used to achieve multiple listings in a city by using your real address in the line two, a listing in addition to your main location in the burbs or with a PO Box, like in my case, to get presence in a different city for a very low cost. I removed the PO Box from the second line of my listing after getting verified without any need for reverification so as not to have a PO Box visible on the Places page.
I do not know if this technique is still viable. It was reported to Google approximately two months ago. They have not informed me whether it was patched and I have not tested whether it still works. If you try it for yourself (in the name of science and discovery only!), let me know.
© Copyright 2025 - MIKE BLUMENTHAL, ALL RIGHT RESERVED.
Comments
36 Comments
Walked around all afternoon carrying laptops. Couldn’t find the place. Very cold and windy. No gr8 place for coffee. Wish I were back in mountain view sipping a lattee
I’m wondering what about trying it with the phone number of the listing as well…
@Goo.gler
Surreptitious astro turf WILL NOT get you that bathrobe.
@Abby
Trying what with the phone number?
@ Mike
I meant sticking 2 (or more) phone #, veirfy by one of them but then remove it & use the others… but obviously why would anybody want to do that…? 🙂
@Abby
Any change to the primary number will precipitate a reverification.
Has anyone at Google commented on (either positively or negatively) the use of a PO box as a means of creating/verifying a street address in Maps/Places?
Is a physical location near the marker is better for ranking than a service area?
Google has noted repeatedly that a PO Box IS NOT a means to verify a business address.
From the Google Business Listing Quality Guidelines:
Do not create listings at locations where the business does not physically exist. P.O. Boxes are not considered accurate physical locations. Listings submitted with P.O. Box addresses will be removed.
Historically, spammers used the centroid because it did offer better ranking but that is no longer the case. It is however a point that is equal distance from most points in a city so if you want maximum exposure for a single spam location it is preferable.
Google has noted repeatedly that a PO Box IS NOT a means to verify a business address
But Google seems OK with use of a UPS box as your experiment demonstrated.
Does Google really view these 2 addresses as different?
123 UPS Store Street, #12345
Bigcity, NY 45678
vs. :
PO Box #12345
Bigcity, NY 45678
Google is not OK with either UPS or PO Boxes. I used a PO Box in my experiment explicitly to demonstrate how to circumvent their rules.
For the record, I think their rules make sense but I think they need to enforce them fairly and equitably.
Google does view the two addresses differently in an automated sense in that they can’t or haven’t set up filters on the former but have on the latter.
Awesome experiment, Mike. In my former, non-search life second address lines were always scrutinized extra because of the way the post office delivers packages.
@Justin
It was a loophole that never occurred to me. Although I suppose that there are some legitimate uses for the second line… like in towns without address level mail delivery or on a college campus where mail isn’t rec’d at a given building but it has a specific street address.
[…] Illusory Laptop Repair – A Most Elegant Google Places Hack, Mike Blumenthal […]
“I think their rules make sense but I think they need to enforce them fairly and equitably.”
I could not agree more. How can I rank in the 7 pak say 2 towns over, if 5 out of the 7 are location spam for that city. One of my competitors has one real location yet has 75 Google place listings. And because he set them up quite awhile ago, he is ranking well for most locations. This guy is getting a lot of exposure at zero cost. At the expense of those that are paying for adwords and SEO.
Love the test Mike. If no one tries to hack something from time to time, how will you know if it is secure!
@James
Thanks. Not just test but publicize… otherwis only the “bad guys” get the goods. 🙂
We have noticed several of the same kind of listings in our area for moving companies. Often the companies have addresses that are vacant lots, street corners or parking garages. I have often wondered how you get a fake address past Google.
@Jake
Yes, I am sure that there are other techniques but this one was “sweet”… and dead on simple.
Mike
PS Don’t tell your friends 🙂
This is cute actually! I wonder how long it’ll be before Google pulls the plug on that little “hack”?
Anyway: Nice find and thanks for sharing!
Great test. Another method that has occurred to me is to use the “remote” phone numbers for verification, which can be had via services like MagicJack.
I am located in Mexico, but I have a MagicJack phone number in the 512 area coded (Austin, TX). I suspect it might be possible to do the same thing, if I wanted to rank locally in the Austin area. For $20/year, a business could buy several phone numbers and add themselves to an area remote to their actual location.
Personally, I don’t like the idea of virtual businesses being able to squat on geographical locations. If a user is looking for a local service, they don’t need their results cluttered up with businesses hundreds or thousands of miles away.
But I suppose it’s inevitable that some will game this, as well.
It won’t be long until the centroid metric is deprecated. For large cities it may not make sense, especially since the centroid is difficult to get to (Seattle) or there is nothing to do (LA).
@Kyle
This hack could be done on a neighborhood basis as well…. the centroid only has value these days by the fact that it is a single point closest to all others in a city… certainly not for ranking.
@Mike
Great experiment! You are at the wrong biz. You should go Locksmith!!
Hahahahahaha! Outstanding – thanks @PureSheer – I really needed that laugh today.
@PureSheer
At least I can have my brother fix a laptop if it actually comes in via the Places listing… not sure what I would do with a lock out call. 🙂
Do you guys really think that G will let this fly?
This particular security hole in Google Places comes about because Google isn’t doing postal address standardization properly. Postal addresses are parsed by the USPS from the last line upward. Google parses from the first line downward. So Google finds a different street address than the USPS does.
Then, Google doesn’t check the address against business records, like corporate registrations, business licenses, or Dun and Bradstreet. So Google can easily be suckered into displaying phony locations.
This is just one of many ways to overcome Google’s verification system. Others I’ve seen used include getting a chain of low-end convenience stores to forward Google’s postcards, getting temporary phone numbers from the gray market for phone number verification, and, of course, opening GMail accounts in bulk for email verification.
Google Places spamming is going industrial-scale. There are ads on Amazon’s Mechanical Turk freelancer market for Google Places spammers. Several heavily promoted commercial products and services are already available for spamming Google Places in bulk. Look up “Google Places Unleashed” and “Dominate Google Places” for some painful reading.
Craigslist faced many of the same problems, and lost that battle. Many categories on Craigslist are now mostly spam. Google search could go down the drain in the same way. Google had a good handle on blocking organic web search spam via link farms, but they have no clue about what to do about Places spam. Spamming Places turns out to be very easy, much easier than link farming. Google’s merging of Places results into web search could turn out to be the biggest marketing mistake since New Coke.
I’m writing a paper on this.
I promised a paper on this, and it’s now available. Mike Blumenthal’s technique is covered, along with other effective techniques Google Places spammers are already using.
“Places” spam – the new front in the spam wars.
It’s not a joke any more. So many SEO people are doing this that Google Places results are turning into junk in popular categories.
“Mountain View, we have a problem”.
@John
that summarize everything really nice & help you think what will be next, Or how Google will fight it.
just as a heads up- the biggest Spam technique that I’ve ever encountered with (& I’ve encountered & exposed heaps of them 🙂 ) was revealed couple of weeks ago.
We’ll publish it soon. Get ready to be amazed from it simplicity & impact.
Thanks for the heads up. I was wondering how the spammers did this.
You can use a mail forwarding service or virtual office to create a dummy location. It is a little more expensive than this method, but less prone to Google’s countermeasures to the 1st address line manipulation. Just be sure to map the address you are going to use – before purchasing it – to make sure it is not overloaded.
[…] gotten addresses in parks, cemeteries and random places along streets. (Mike Blumenthal has also reported on one address hack that can allow people to obtain listings using a fake address.) I’ve further received […]
[…] two address field to accommodate them. Unfortunately this was open to abuse by spammers as well (I demonstrated how this hacked worked in late 2010 with the creation of Illusory Laptop […]
Three years later your “business” still “exists” on a lonely corner of a lonely parking lot; still enjoying top natural search rankings. Priceless.
@ross
You noticed! I was just browsing and came across it myself. In fact I still even get calls.
It occurs to me that Google may have designed Pigeon to help circumvent some of this Places spam. You now need good organic signals to get into the local packs, so simply getting a Places listing and building some citations probably isn’t enough anymore.
This one with no effort or attempt still shows for Laptop Repair Bradford PA.
The theory that Pigeon is more about organic signals is obfuscated by some of the confusing results I see out there.
Plus I’m seeing more listings than before that rank in the pack with no website at all attached.
Which could point to domain authority if it’s a weak pack I guess. Or maturity of the listing?
Comments for this post are closed.