Cold SEO emails, 'Google' calls and surprise invoices: what to check before you reply or pay

The short answer: check through a channel you already trust

Most service businesses get a steady stream of approaches they didn't ask for: emails saying the website has SEO errors, calls about the Google listing, messages warning that the Facebook Page will be shut down, and invoices for domain names or directory listings. Some are ordinary sales pitches, some are scams and a few are genuine notices.

You don't have to work out which from the message itself. Leave the message where it is, then sign in to the account or call the provider using details you already hold, and check there. Google, Meta and auDA each publish how they do and don't contact businesses, and the Australian Consumer Law limits demands for payment for things you never ordered.

Cold SEO emails: what Google itself says

Google's own guide to hiring an SEO is blunt: "Be wary of SEO firms and web consultants or agencies that email you out of the blue." It says Google gets these emails too, and it names the claims to distrust: "No one can guarantee a #1 ranking on Google. Beware of SEOs that claim to guarantee rankings, allege a 'special relationship' with Google, or advertise a 'priority submit' to Google."

The same guide says Google "never accepts money to include or rank sites in our search results, and it costs nothing to appear in our organic search results." A pitch that offers a paid place in the ordinary results, or says Google asked them to contact you, is describing something Google says doesn't exist.

If the email offers a free audit and you're curious, Google's advice is to "only grant read access to Search Console (at this stage, don't grant them write access)". You don't need to hand over a website login, a hosting password or ownership of anything to get an opinion. Offers to sell you links are a separate trap with their own rules.

Keep readingSee which link offers break Google's rules

Keep readingBefore you accept a free audit, see what a useful one includes

Calls about your Google Business Profile

Google does make some calls. Its Business Profile help says its automated calls come from a set of designated numbers, that you'll hear the call is from Google and why, and that they're used for things like checking your opening hours. It also says: "You won't be asked to sign up for a service, pay money, or give personal info." Its page on automated calls adds: "If a caller asks for money to keep your business on Google, it is not a call from Google."

The calls to worry about say your profile is unverified, is about to be removed, or can be moved to the top of Maps for a fee. For a caller pretending to be from Google, Google's advice is to hang up and "Do not press any buttons even if the voice prompt tells you to." To find out whether anything is actually wrong, sign in to your Business Profile yourself.

Google's policies for agencies that manage profiles point the same way. They prohibit misrepresenting as Google through robocalls, claiming that profiles will appear in Google Search or Maps at all times, and threatening that clients will lose their profile if they don't sign up. An agency that charges a management fee must tell you that Business Profile is a service provided at no extra cost, and you must keep ownership or co-ownership of your profile at all times.

Keep readingSet up and look after your Business Profile

Messages saying your Facebook Page or ad account will be shut down

Meta lists "false claims that you went against our Community Standards" and, for businesses, claims that you aren't complying with its advertising and commerce policies as typical features of fake emails. They usually come with a deadline and a link to appeal.

Meta says its representatives "will never ask you for your password, payment details or other sensitive information over chat, text, email or phone", and that its email only comes from fb.com, facebook.com, facebookmail.com, instagram.com, meta.com or metamail.com and their subdomains. Even when the sender looks right, don't use the link. Open Business Support Home yourself, which is where Meta says you'll find notifications about the status of your account.

Keep readingCheck who has access to your Meta and Google accounts

Domain offers and listing invoices you didn't order

Domain notices are convincing because they quote your real domain name. auDA, which administers .au, warned in 2019 about a company offering .au registrants a similar name, usually a .com, claiming to fulfil a "statutory obligation" and hinting at "far-reaching consequences" if the offer isn't accepted. Its advice is that you have "no obligation to register any domain names offered", and to check with your registrar if you're unsure. In a separate 2021 alert about emails from someone posing as an auDA employee, it says it "will only request this kind of material via your registrar."

The check takes a minute. Compare the notice with your own records: which registrar you use, when your domain actually renews and the account you pay it from. Renew only by signing in to that account.

For invoices, the Australian Consumer Law helps. Section 40 says a person must not, in trade or commerce, assert a right to payment for unsolicited services unless they have reasonable cause to believe there's a right to it. Section 42 says you aren't liable to pay for unsolicited services, which the law defines as services supplied "without any request made by the person or on his or her behalf." Both sections refer to a person, not only to consumers.

Section 43 deals directly with charges for an entry or advertisement in a publication. You aren't treated as having authorised one unless a document authorising it was signed by you or someone authorised by you, you were given a copy before payment was demanded, and it names the publisher and their address, describes the entry and states the charge or how it's worked out. If you didn't authorise it, you aren't liable to pay and you can recover a payment you've already made. The separate ban on demanding payment doesn't apply to some publishers, such as publications with an audited circulation of 10,000 or more copies a week and government bodies. If a large amount is involved, get legal advice before you rely on any of this.

Worked example: one week of offers at a plumbing business

This is a hypothetical example. A plumbing business in Geelong gets three approaches in one week. On Monday an email says the website has dozens of SEO errors and promises page one of Google within 60 days. On Wednesday a recorded call says the business's Google listing is unverified and will be removed, and to press 1. On Friday a letter arrives offering the .com version of its .com.au domain name, along with an invoice for a listing in an online trade directory nobody remembers ordering.

The owner handles each one without using the contact details it came with. The email's ranking guarantee is exactly what Google tells business owners to distrust, so it goes in the bin. She hangs up on the call without pressing anything, signs in to the Business Profile and finds it verified with no warnings. Her registrar account shows the .com.au renewing in March with the company she's always used, and she doesn't want the .com, so she ignores the offer.

For the directory invoice, she checks her files for a signed order and finds none. She writes back asking for a copy of the signed authority the invoice relies on, and doesn't pay in the meantime. The whole check takes about 20 minutes, and nothing she does depends on believing or disbelieving the senders.

A five-minute check before you reply, share access or pay

Use the same routine for every unexpected approach, whoever it claims to be from:

• Don't use the links, buttons or phone numbers in the message. Sign in directly, or call a number you already have.
• Check the claim where it would actually show up: your Business Profile, Meta's Business Support Home, Search Console or your registrar account.
• Never give a password, verification code or card number to someone who contacted you. Google and Meta both say they won't ask for them.
• Match every invoice to a signed order or quote before it's paid. If there isn't one, ask the sender for it in writing.
• Treat ranking guarantees, a claimed special relationship with Google and countdown deadlines as reasons to stop, not to hurry.
• If you want an outside opinion on your website, give read-only access and keep ownership of every account.
• Keep a short list of your real providers for your domain, hosting, website, ads and listings, so whoever opens the mail can check it.

When a cold approach is worth a conversation

Not every unsolicited email is a scam. Agencies and freelancers do prospect for work, and some cold approaches come from capable people. The difference is in what they're willing to do. A genuine provider will tell you their business name and ABN, explain what they'd change and why, avoid promising rankings, ask for limited access rather than your passwords, and put the scope, price and term in writing before any work starts.

Google suggests asking an SEO for examples of previous work, whether they follow the Google Search Essentials, and what results they expect and in what timeframe. Ask a cold caller the same questions, then compare the answers with providers you approached yourself.

Keep readingCompare agencies on evidence, not promises

If you've already clicked, shared access or paid

If you entered a password after following a link, go to the real site yourself and change it. Meta's advice for a phished account is to reset the password, log out of any devices you don't own and turn on two-factor authentication. Then check who has access to your Business Profile and Meta business accounts, and remove anyone you don't recognise.

If you paid an invoice for something you didn't order, contact your bank straight away and keep the paperwork. For an unauthorised listing, section 43 gives you a right to recover the payment. auDA says anyone who has handed over personal details in response to a fake email should report it to their state or territory police and to the Australian Cyber Security Centre at cyber.gov.au/report, and it asks people to notify Scamwatch about these emails.