On Google Maps, Inna Bogdanov is standing in front of a plaza in Richmond Hill, Ont., a few steps away from a Scotiabank branch. Click on the pin marking her apparent position, and you get a website that belongs to the bank.
鈥淗ello, Inna speaking,鈥� said a woman who answered a call to the listed phone number and confirmed her identity to CTVNews.ca. 鈥淚鈥檓 a mortgage broker. I used to be a mortgage specialist with Scotiabank.鈥�
According to Richard Trus and Sydney Eatz, 鈥渋nternet police鈥� who investigate questionable content on Google Maps, Bogdanov is 鈥済hosting.鈥� It鈥檚 essentially gaming Google Maps to deceive users who rely on the widely-used platform to find the businesses they are looking for.
Google Maps collects data about all manner of places people go, asking users to participate in voluntary questionnaires to learn about things like parking, wheelchair accessibility, ambiance, and hours. Contributors get points when they add reliable photos, reviews and other information.
Trus explains these points are like a currency denoting the level of trust users have with Google. The more trust they accrue, the more they can add and edit on the map.
鈥淕hosters鈥� build trust and add pins near legitimate businesses that appear similar to the actual business listing, hoping that misdirected consumers will contact them thinking they are speaking to their bank, for example.
鈥淭he 鈥榞host鈥� could be an employee of the business, business competitors, hackers and paid consultants onshore and abroad,鈥� Trus told CTVNews.ca in an interview.
Bogdanov鈥檚 seemingly random pin near the Scotiabank branch raised alarm bells for Trus and Eatz.
鈥淚f you aren鈥檛 paying attention and you searched for Scotiabank, and then you click call, it will call her phone,鈥欌�� Eatz said.
According to Trus, Bogdanov pretended to be a Scotiabank employee on four separate occasions beginning two months ago.
In a second phone conversation with CTVNews.ca, Bogdanov denied placing the pin listing her phone number, or having any knowledge of its existence.
The difference between actual business information and deceptive map points can be hard to spot if you are using a smartphone, or not fully zoomed in. Trus is convinced many users won鈥檛 notice these pins before placing a call, and potentially disclosing personal information to an unknown third party.
鈥淚t used to be people would call you with scams. Now you are actually calling them thinking you are calling your bank,鈥� he said.
Scotiabank spokesperson Rick Roth said client security is a top priority.
鈥淲e encourage our customers if they have or experience any suspicious activity to contact the bank (and) if there is anything nefarious about their suspicions to obviously escalate that to the proper authorities,鈥� Roth said. 鈥淲e would obviously work with any third party hosts to ensure that our customers wouldn't be deceived.鈥�
Over the past two years, Trus and Eatz estimate they added a combined 11,000 businesses to Google Maps, becoming level 10 guides in the process. It's a top rank they say just 200 out of 50 million users achieved.
鈥淚f you have enough trust, you can do things on Google Maps that are evil,鈥� Trus said.
For example, they claim they could add their personal cellphone numbers to the Google Maps listing for Prime Minister Justin Trudeau鈥檚 office.
鈥淭hat鈥檚 where it becomes a national security issue,鈥� Trus said, noting that he could easily add his number to the listing for the RCMP or Revenue Canada too.
Eatz and Trus explain that Trudeau鈥檚 office does not have tighter security controls on Google Maps than say, a Tim Hortons coffee shop.
Trus also worries about how inaccurate information on Google Maps could be used against first responders in the event of a terror attack.
鈥淭ake for example the shootings that happened at the YouTube headquarters,鈥� he said. 鈥淭he police come. They dial the number that they think is the YouTube headquarters, and it goes to a terrorist organization who says, 鈥楪o to this corner. The shooter is over there.鈥� Then there is an ambush.鈥�
Google pointed to its 鈥渕anual and automated system鈥� for detecting fraud and spam, without offering specific details, in a statement to CTVNews.ca.
鈥淲e take allegations of fraud very seriously,鈥� company spokesperson Alexandra Hunnings Klein wrote. 鈥淲hen an issue like this one is reported to us, we investigate the claims. Upon completion of the investigation, we take actions in line with our findings.鈥�
Eatz recently presented her concerns to a House of Commons committee undertaking a two-week review of the misuse of Facebook data, following reports that research firm Cambridge Analytica obtained the personal data of millions of users, including more than 600,000 Canadians.
鈥淭his is bigger than the Facebook breach,鈥� said Trus. 鈥淭here needs to be increased security. Listings need to be categorized so that banks are only editable by banks. Law offices are only editable by lawyers. Government offices should be under the lock and key of government. It shouldn鈥檛 be this Wild West system where I can add myself as the Prime Minister of Canada, and if I have enough trust, Google believes me.鈥�
