7 ms·
Google shared my phone number
- hn8726 1y agoOr one of the users helpfully updated the business profile with the phone number, since they had it and thought it might be useful for some
- mattigames 1y agoRandom users can update business profile numbers and Google publishes them without asking the number's owner for permission? Seems like a huge oversight.
- mcv 1y agoAlso a nice opportunity to steal a company's business. Didn't some food delivery service get their own phone numbers listed for various restaurants a few years ago?
- jfoster 1y agoNot sure about phone numbers, but some of them were creating "websites" for restaurants.
- zelphirkalt 1y agoIt is so ridiculous how that works. Just imagine for a second that you make a lieferando fake website and bring that online and somehow manage to make the URL look alike. How quickly the lawsuits would be on your ass. Yet according to one of the top level comments, nothing is done here, when lieferando does this and even throws in some identity theft.
- DidYaWipe 1y agoYes. I always bring this up when people in forums start talking about using these scumbag food-delivery operators.
- onli 1y agoNot an oversight, illegal publishing of PI obtained without permission.
- o11c 1y agoOnly businesses have rights and thus may need to give permission. Individuals are considered common property. Laws are useless when you live in a country that doesn't care about enforcing them.
- rplnt 1y agoThey got the permission to publish it. Are they required to verify the number ownership though?
- onli 1y agoThe author of the article and owner of the data says he does not give permission, so no, I think they don't.
- saalweachter 1y agoThe tricky part is that the most straight forward verification -- call the number, ask "is this Bob's Shop?" -- fails immediately if Alice picks up and says "yes".
- ferngodfather 1y agoIf the owner isn't registered with Google business, yes. Other users (local guides) are asked to confirm the change. If they are registered, the request goes to the business owner to approve in my experience. We used to get lots of phantom requests telling us our opening hours had changed but if you're registered you can just decline them.
- saghm 1y agoThis sounds like you're either forced to work with them, or they can just publish pretty much anything and claim plausible deniability about whether it's true or not?
- ferngodfather 1y agoI guess but what's the alternative? Either leave the info out or make maps paid to cover the cost of human reviewers.
- saghm 1y agoThe alternative is just only including info from registered businesses. If a third party provides info on an unregistered business, Google could reach out to the business to confirm and ask if they want to register. Unless they say yes, they can just not include it. Having a smaller set of correct information is better than a larger set of mixed correct and incorrect information is better for pretty much everyone...other than Google, of course.
- AStonesThrow 1y agoI am a Local Guide and Google never prompts me to confirm anything. Local Guides are ordinary unpaid Google accounts who submit reviews, photos, and other edits as I’ve detailed here. We are sometimes prompted to answer questions, but only with a blank to fill in. https://support.google.com/maps/answer/7084895?hl=en https://support.google.com/maps/answer/7084895?hl=en Google says "We review all the edits you make."
- 1y ago
- strogonoff 1y agoYou’d think users can update business information on Google Maps. Instead, most of the times when you correct, say, working hours, it just gets rejected by the business owner who wants people to keep traveling there in the evening just to be turned away or see the closed doors because their staff goes home early every day.
- AStonesThrow 1y agoBut wait, there’s more crowdsourcing! Google Maps actually processes historical data about how busy the location is throughout the hours and each day of the week. You can find this rendered as a little bar graph with a blurb describing the current estimate. This is believed to be aggregated from everyone’s Android devices reporting their locations in a very small radius. Also, Maps asks its users to answer extended questions about amenities. Such as: parking types, accessibility features, kid-friendly, vegan/vegetarian. When I am on board a bus or light rail train, there is information about how full it is, what temperature, accessibility, etc. They are tracked in real time because the transit authority shares their live telemetry with Google. Once, Google had demonstrably wrong schedule information and I discovered that it reflected the official website’s version. (It was reporting every train canceled, but they were actually running.) When I worked in an office in 2012, we were trying to get our arms around various listings in 3rd party "Yellow Pages" publications, on paper and online. It seems that compiling business listings has been around a long time. And every business needs a Social Media manager to be aware of their footprint and manage multiple sites like this. Yelp, TripAdvisor, you name it.
- strogonoff 1y agoIn a dense area where there’s 5 shops within less than a stone’s throw (pardon my reference) away from each other or on different floors of a building, this mechanism does not work. Besides, if the place is “not busy”, that’s when I want to go—who likes to wait in queues?
- varun_ch 1y agoThere’s a (somewhat dramatic) TED talk about this oversight from a few years ago: https://youtu.be/5c6AADI7Pb4 https://youtu.be/5c6AADI7Pb4
- yencabulator 1y agoYou can also change the address of a business, or mark them closed.
- bilekas 1y agoWell in the screenshot it clearly states : "Your phone number was Updated by Google." That doesn't really sound like it was any users input.
- tomlockwood 1y agoI've been narrowing my eyes at the "add your phone number/backup email" thing for a while now because it seems like a transparent and deceitful attempt to increase the reach of the FB/Google "cross device graph". So seedy.
- latchkey 1y agoOh it totally is, ignore it and don't ever add your phone as "backup".
- johnisgood 1y agoOf course. That said some (increasing number of) places do require phone number verification.
- josephg 1y agoIt makes sense. Phone numbers aren’t trivial to acquire in bulk; so requiring unique phone numbers per account is a good way to push back against bot farms. I’d really rather not provide it. But we don’t have many good options to demonstrate you’re a real human to computer systems.
- johnisgood 1y agoSomeone said "Phone numbers are very easy to get in large numbers. US-based SMS numbers that will pass verification for buying sneakers are ~$0.25 each.". Related submission: https://news.ycombinator.com/item?id=44084677 https://news.ycombinator.com/item?id=44084677
- AnthonyMouse 1y agoIt's worse than that. Not only are temporary bulk phone numbers cheap, phone verification is a profit center for spammers. Because they acquire a bunch of phone numbers for their own use, but each phone number can be used on any service that requires phone verification, so they can then sell phone verification service to other spammers or privacy-conscious individuals who don't want to give out their phone number, or set up a web page to do it that makes money from ads, and use the profits to expand their spamming operation. Not only that, the more services require phone number verification, the more profitable spamming becomes, because each number has an increased return since it can be used to sell an activation for an account on another service. Meanwhile people who actually want privacy get screwed, because the spammer's account is going to get banned for spamming in less than a month either way, but a normal user would want to keep the same account indefinitely, and then the site demands that they keep access to the same phone number indefinitely. So then the honest users are stuck paying a monthly fee at the retail rate for a separate phone number for each service in order to avoid giving them all the same phone number to correlate with you. Whereas the spammers pay the wholesale rate once and then more than break even. The anti-spam value of phone number verification is not just zero but actually negative. Its purpose is to harvest phone numbers from honest people for mass surveillance, and anyone requiring it is making the spam problem worse.
- sschueller 1y agoGoogle published my private cell phone number in the play store as after spending over a month trying to get my business number verified under the threat of account termination I ran out of options.
- brisky 1y agoSimilar situation - I was an independent app publisher on app store, but I don't feel comfortable publishing my phone number next to my apps. I don't do customer support. This punishes indie app devs. After I saw this requirement I decided to remove my app from the app store.
- surfingdino 1y agoNobody at those big corps has any control of or time to pause to think over the effects of their actions.
- Brajeshwar 1y agoI've long back realized that it is not just the big corps, but every employee of a company, after a while began to think everything outwards. Their focus, the work, they playbook always from them. There are only a very few that things from outside. During my consultation, the team I was helping keep talking about "Our App", "Our Process", "Our Use", "How do we get this data into our System?" I had to ask them multiple times, "How does your users or customers outside of your company uses them?" "Have you thought of how people usually do these kind of steps?"
- surfingdino 1y agoExactly. That's their default mode of thinking.
- jmkni 1y agoFYI it's blurred out in the screenshot but I feel like I can still make it out
- deleted 1y ago[deleted]
- threeducks 1y agoDefinitely readable. A stronger blur would not have helped the situation either. It is absolutely insane how well information from a blurred image can be reconstructed. For example, consider the "Data" column of the following image, which basically looks like a gray image without any content, but neural networks can recover most of the blurred characters: https://fips.fi/wp-content/uploads/2024/07/HDC_result_example_en-1080x612.png.webp https://fips.fi/wp-content/uploads/2024/07/HDC_result_exampl...
- lostlogin 1y agoThe person who posted it has said elsewhere here that the number is faked. And yes, your comments re blur have plenty of precedent.
- lo0dot0 1y agoAlgorithms can see the difference between RGB 245, 245, 245 and RGB 246, 245, 245 (it's 1, 0, 0) but the eye can probably not, also depending on the monitor hardware. Thus the blurring effect might not be as strong as it looks like at first glance.
- kgeist 1y agoI heard new AI crawlers extract text from images too, hoping to get that extra dataset. So with that kind of blur, it might end up in LLMs.
- Dan-Q 1y agoBlog owner here. You're welcome to unblur it: I swapped the number out in the screenshot for one of Ofcom's list of official never-to-be-assigned telephone numbers for drama (e.g. film & TV) use (https://www.ofcom.org.uk/phones-and-broadband/phone-numbers/numbers-for-drama https://www.ofcom.org.uk/phones-and-broadband/phone-numbers/...) before I applied the blur. That number isn't mine, and will never belong to anybody!
- aydgn 1y agoAnyone using Google Search can edit a business's phone number. Weird, but true. https://www.google.com/search?q=Three+Rings+CIC&hl=en#irp=ph https://www.google.com/search?q=Three+Rings+CIC&hl=en#irp=ph
- AStonesThrow 1y agoAnyone with a Google Account who uses Google Maps can submit edit suggestions, but they are all reviewed before publication. You can inform them if the business doesn't exist, has a different address, new website, existing website doesn't work, new business hours; all sorts of things. Not limited to businesses: includes bus stops and train stations, historic landmarks, basically anything where you can drop a pin and see a database entry. This is probably linked to the process for Search. It's called "crowdsourcing". https://support.google.com/business/answer/3038311 https://support.google.com/business/answer/3038311 The article mentions having control of the Google Business Profile. It was sometimes called "Google My Business". You can register and verify that you're the owner, and then you'll have tools to reply to reviews and manage your own Maps entry, etc. https://business.google.com/us/business-profile/ https://business.google.com/us/business-profile/
- danpalmer 1y agoI do this quite a lot, most get accepted, some don't. It typically takes a few days to get reviewed and published.
- cookiengineer 1y agoThis is what happens when Google isn't sue-able by private entities. In Germany, lieferando (subsidiary of takeaway.com) registers domains in the form of restaurantname-city.de, points them to their lieferando cloudflare account, and claims ownership for the google business entry where they set the phone number to their own call center. Then they call the business owner and _force them_ to sign the contract with them, because effectively the owner knows they cannot be found anymore via google, and everyone that wants to order something will reach the call center hotline and leave a negative review after the hotline tells them wrong number, effectively destroying their business. And the people working for lieferando via Zeitarbeitsfirmen know this, and mention this in the call to pressure the restaurant owners to get their sales provision. Crimeflare before it got taken down had around 130k domains that were pointing to the lieferando website using this kind of scheme, I helped provide the dataset for a couple of local business owners that were extorted this way and refused to abide by that scheme. Guess what happened, nobody could be sued and the financial damages were too small to escalate it on the European court level. Sadly, class-action lawsuits don't work the same way as in the US, apparently. Effectively Google does not abide by the laws and gets away with it due to their financial structures of their holding companies. And they certainly know about this, they just don't give a single fvck.
- chaosbolt 1y agoWow that scheme sounds exactly like mafia activities in the Sopranos or other movies.
- mikae1 1y agoGeez. Has there been any good write-ups about this in the German press?
- cookiengineer 1y agoAt the time we didn't know how large the scheme is, because you only find out effectively about those domains if you let your own root/resolver running and listen for the A/AAAA entries coming from cloudflare. So the real number of those domains is likely to be much much larger if you would have the same dataset like crimeflare had. You can find articles about it with the keyword "Schattenwebsites lieferando" because that's what the press seems to have settled on. Different press teams counted different amount of websites because of that. Another team where I knew people from the CCC that helped them confirmed the 120k number though. Our final number in Q4 of 2021 was 130k domains that we found out about, and we were trying to contact a bunch of other business owners to be able to escalate the lawsuit onto the Landsgerichtsebene (so that it can go into the Bundesgerichtshofsebene afterwards, and then to the EU court). [1] https://www.stern.de/wirtschaft/lieferando-lockt-kundschaft-mit--schattenwebsites--von-restaurants-weg-30394366.html https://www.stern.de/wirtschaft/lieferando-lockt-kundschaft-... [2] https://notizlo.ch/wie-man-gegen-lieferando-domains-arbeitet/ https://notizlo.ch/wie-man-gegen-lieferando-domains-arbeitet... [3] https://t3n.de/news/lieferando-restaurants-schattenwebsites-1358508/ https://t3n.de/news/lieferando-restaurants-schattenwebsites-... [4] https://www.trendingtopics.eu/lieferando-provisionszahlungen-ueber-schattenwebseiten-von-restaurants/ https://www.trendingtopics.eu/lieferando-provisionszahlungen... [5] https://www.deutschlandfunknova.de/beitrag/schattenwebseiten-lieferando-erstellt-tausende-website-fuer-restaurants https://www.deutschlandfunknova.de/beitrag/schattenwebseiten...
- avereveard 1y ago[flagged]
- n_u_l_l 1y agoThere is a phone number on your website, and the same one is also part of the public info on the business's Google Play developer profile. Please correct me if I'm wrong, but both are published by you. I don't think it's unexpected when you use one phone number as both personal and business number. Initially I still felt like it wasn't correct of Google to publish this as public phone number, but I think Google Play clearly asked what phone number customers can use to contact you.
- Dan-Q 1y agoPost author here. There shouldn't be one on the website (and I can't see one?), but the Google Play developer profile is unfortunate: thanks for pointing it out.
- deleted 1y ago[deleted]
- TrueGeek 1y agoI got a Twilio number to give to Google for my Play store listing. It simply takes a message and then emails it to me.
- codazoda 1y agoI should do this. Did you have to code something for it or will Twilio just do this if you set some settings?
- TrueGeek 1y agoYou can set it up in the Twilio studio without having to write code. I'm not 100% positive, but I seem to remember there was a template for it and I just had to fill in the details
- modeless 1y agoSo what actually happened is you gave Google your phone number for the specific purpose of publishing it so customers of your business can contact you, and forgot. You should update your post so people aren't misled.
- danpalmer 1y agoThere are at least 3 alternative explanations posted in these comments. Applying Occam's Razor here, the explanation given in the post seems like possibly the least likely option. One way to shed some light on this would be to use Takeout to get a copy of data held and see if they still have the number and what they hold it for.
- Dan-Q 1y agoNot sure that Google offer Takeout on Business Profiles. Businesses aren't often protected by the kinds of PII-protecting laws (GDPR etc.) that individuals are, and so tech companies are less-inclined to make tools to streamline bulk export of data.
- charcircuit 1y agoGoogle takeout is older than the laws you bare referring to.
- Dan-Q 1y agoSure. But I still don't think it covers Business Profile. But I'll check.
- danpalmer 1y agoSo was the identity verification process you spoke about in the blog post for your personal account or your business profile? If it was your personal account, I really don't see how a personal verification ends up on a business account. I'm not saying it's not possible, but it seems like it would introduce extremely bad data. I've verified my phone number, but (personal speculation) I doubt Google would want my number showing up on my employer's business profile. If it was for your business account... I can see how that would be unexpected, but also the point of verifying that would I guess be to increase the level of trust that customers could have in the business based on it being verified, and I can see how that might lead to that number being public. It also sounds like this is what you did with Play too, and as a user I would expect that Play's company data aligns with data on Google Search. I can empathise with the shock here, I've had people call me up from google searches and finding my number on my CV, but I am struggling to find a link here that doesn't make sense.
- saravanan2661 1y agoThis was one scenario where the number was auto-mapped to the person's business. It's definitely wrong without consent. But for someone like me who isn't associated with any business or company, is my personal data secure? Are there any possible threats?
- miros_love 1y agoThe same. One day I got a call at 2am. A few years ago I worked for a company that no longer exists today. They had, among other things, a job search service connected to their ID system. I was also doing my own project at the same time and needed Python developers. I was young and naive and thought I could find a junior and train him quickly. So I posted a vacancy on this job board: "Looking for a Python developer without experience." It turned out that they showed my phone number and it couldn't be turned off. I received about 3-4 calls from very strange people who demanded to know how to become programmers. For some reason, they all started calling at about 5am. I even gave some useful advice to the first one, because I was taken aback by such impudence. Today I use about 4 different phone numbers to separate my private life and data leaks like that.
- netsharc 1y ago> For some reason, they all started calling at about 5am. My guess is the reason is they're from one particular geographical area, where 5am your time is their "start of business day" o'clock?
- arresin 1y ago> My guess is the reason is they're from one particular geographical area I wonder what geographical area that is.
- RataNova 1y agoThe fact that they quietly slurped up a personal number from a verification process years ago and then just decided to publish it later is exactly the kind of dark pattern you'd expect from a smaller, shady adtech company, and not the world's largest one
- oarfish 1y agoI cant be the only one who's default assumption about personal data is exactly this.
- RataNova 1y agoAt this point, "they'll use it however they want, eventually" feels like the default mental model for any data you hand over, no matter what the original context was
- jeroenhd 1y agoIt's possible, but I think it's more likely that the Google account that has made the Three Rings app (https://play.google.com/store/apps/details?id=uk.org.threerings.pwa https://play.google.com/store/apps/details?id=uk.org.threeri...) with a listed phone number (+44 7795...) also claimed ownership of the Three Rings website through whatever domain tools Google offers. In that case, the developer provided Google with a way for Three Rings customers to reach them and they then published that number. I don't know why the app's developers decided to use their personal phone number for their Google Play business contact information, but that seems like the most reasonable explanation to me. If the author did not provide that phone number to Google Play, then he will need to also update his information there to get the phone number delisted, or it will be a matter of time before it appears on the Google Search page again.
- speleding 1y agoIn our case Google updated the company phone number from the Chamber of Commerce register. We don't provide phone support, but by law you have to have a phone number in that register (in the Netherlands). I put a voip number in there that goes straight to a voicemail, it tells people we don't offer phone support. So I removed it from the Google Business profile, but every once in a while they decide to "helpfully" put it back.
- weberer 1y ago[flagged]
- noobermin 1y agoPhone support is different than providing a number through which you can be contacted for non-support purposes.
- speleding 1y agoIf someone does leave a message we get an email from the voip service with that message as an attachment, and we listen to it. I figure that should be good enough to comply with the law. That's better than trying to call e.g. Google. (We provide email support, of course. Setting up a call center would make our $9 SaaS product more than twice as expensive. We figure that customers rather pay a low price than have phone support. And there are many competitors they can go to if they really want to talk to someone.)
- jtwaleson 1y agoPro-tip, just say that "you have not gotten a business phone line yet" when registering at the Chamber of Commerce. That's a loophole I've used to stay unlisted, after my previous company got weekly spam calls.
- sdflhasjd 1y agoI've got my own personal story about a cold call revealing my personal phone number had been leaked by Lusha, a "GDPR Compliant" B2B tool that sourced data from shady apps. On a day off work, I got a cold call to my personal mobile. This salesperson called me by my name and then tried to flog something relevant to my job. Being hugely irritated, I shared my thoughts with the caller demanded to know where they'd found my number. They were at least a little bit apologetic, and said they found it on LinkedIn using a plugin called "Lusha". Lusha's website has claims about being GDPR compliant, but at the same time being a "crowsourced data community". They do at least publish a "Privacy Policy" and some contact details for a data controller. I emailed them with a Subject Access Request, which they responded to two weeks later in a very cagey manner. Actually, I did some sleuthing of my own. I found an unlisted link for a broken OneTrust request form. This didn't seem to be linked anywhere on the website and I literally guessed the URL for it. After some poking around in the debugging console, I recieve a more fully furnished copy of my profile. The data source for my email was... "Lusha's email guess algorithm" - now, one of the downsides of working for a small business and getting a firstname@domain.com is that guessing it isn't particularly difficult. The data source for my phone number was more interesting. "L.S Mobile Apps Holdings Ltd." a company I'd never heard of, but eventually found an App Store[0] and Play Store[1] listing under a very similar name. Looking at the apps published by this company, you can immediately see where this is going: a "Caller ID" and an even more transparent "Contacts Backup" app - both having complete access to all your contacts. At this point it becomes clear where my contact information has actually come from: someone I probably work with has created a contact in their phone with both my email and personal phone number, then used one or two of these apps. I decided to pick the Contacts backup app to take a closer look. Installing the app on a wiped phone, I explored the UI, disassembled code and snooped the requests to their servers to see where exactly this mysterious "GDPR Compliance" was. The primary functionality is of course to create an account, upload all your contacts, and let you sign in on another phone to download them. There was some effort to make this work for most users, workarounds for edge cases, etc. It was more than the low-effort app I was expecting. All the sharing functionality was checked behind a "consent" dialogue (and I use that term extremely loosely). The deal was that app would helpfully hydrate my entire contacts book with missing details! All I had to do was share it in turn. What I found peculiar about this was it simply didn't work. It seemed as through not only would the server not populate the missing data, but the code that handled this client-side was unfinished. If you're wondering what the link between Lusha & L.S Mobile Apps is, they're effectively the same company. Yoni Tserruya, the co-founder of Lusha, has their fingerprints all over the the certificates used to sign the Android LSM Apps. It's clear this app's data is what they've built their company on. Now, both Google and Apple have well known to display "Data Sharing" information as part of the store pages. The Play Store page explicitly says "No data shared with third parties", whereas the App Store omits the usual section you'd see when data is shared with third parties. I contacted both Apple and Google with full details about what I'd found, and in the least surprising event to my saga, they did nothing. Sadly, instead of having any satisfying conclusion, what I saw was what I already knew. I even got angry when reading their privacy policy, and how completely clear that all this "GDPR Compliance" labelling they have is there to sell their product to EU customers and they're clearly not compliant. Here's some ragebait for the rest of HN who cares about their data: - French DPA (CNIL) says Lusha is full of shit, but they can't do anything because they're based in Israel[2] - Lusha doesn't think consent is important[3] [0] - https://apps.apple.com/gb/developer/lsm-apps/id1634388352 [1] - https://play.google.com/store/apps/dev?id=5128998142474323958 [2] - https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046775564?isSuggest=true [3] - https://www.lusha.com/privacy-articles/please-show-me-where-i-have-consented/
- praestigiare 1y agoTwice I have had listings for companies or organizations I was associated with get phone numbers added to their listings in Google Maps automatically. In both cases, it was worse than this: the numbers were people in the same industry, but completely unrelated. One was bemused, the other was quite angry with me.
- fdb345 1y ago[dead]
- Crosseye_Jack 1y agohttps://archive.ph/pyJ40 https://archive.ph/pyJ40 - As the site is being hugged to death!
- davidguetta 1y agoA few years ago i bought a Samsung with a feature that when possible, it gives me the name of unknown caller, i guess from the database they were gathering from other people's contacts. One day my neighbor call me, and i had not register his number, so Samsung shows "<his name> GRINDER", because someone else had him like that in their contacts ^^. He was openly gay within the neightborhood but he was also working as some sales representant for real estate and he was not exactly happy when i told him Samsung was broadcasting his sexual orientation to unknown people he would call >< (not to mention he told me hadn't used grinder in like 7 years).
- justusthane 1y agoThat seems absolutely insane! If this is (or was) actually happening, I’m surprised we haven’t heard more about this. As bad as your example is, I can easily think of way more damaging scenarios.
- blueflow 1y agoThere is a rumor that Instagrams "People you might know" feature also works on physical proximity.
- forgotmypw17 1y agoInstagram recently asked me for permission to “find devices on local networks”…
- dan-robertson 1y agoMy understanding is that this is usually for ‘play on smart tv’ situations, but the permission is most unclear.
- h2782 1y agoThat's a common justification for access, but it is no assurance to how they will actually use the data they gain access to. Knowing how critical profiling is to the IG/FB business model, I bet it snatches a lot of data to exploit later.
- saurabhshahh 1y agoNow, I use perplexity to get any customer care number of any company and most of the time they provide the right number compared to google.
- fsfsa3 1y ago[dead]
- neuroelectron 1y agoThis is quite an upsetting development and while I do think I know a solution it's in my best interest not to share it. That's just the nature of dealing with Google.