Fake spa listings defraud customers and hurt real businesses

Scammers in the US are using the addresses of real spa businesses to create fake online listings, lure customers into booking massages, and convince them to send deposits through PayPal or Zelle.

Key takeaways

• Scammers are using the addresses of real spas to create convincing fake listings, tricking customers into booking nonexistent services and sending deposits through payment apps.
• Consumers should verify a spa before booking or paying. Cross-check its address, phone number, website, reviews, and payment information, especially if you're asked to pay up front.
• Legitimate businesses can become victims too. Fake listings can lead to confused or angry customers showing up, reputational damage, fraudulent reviews, and even safety concerns for owners and employees.
• The tactic can extend far beyond spas. Salons, contractors, cleaners, repair services, pet groomers, and other local small businesses could have their addresses or other public information abused in similar scams.

How the scam works

According to reports from Mississippi, scammers have set up multiple online listings advertising 24-hour spas in Jackson, Ridgeland, and other locations across the state.

The listings used addresses belonging to legitimate businesses that weren't affiliated with the supposed spas. When the news outlet WLBT contacted the phone numbers associated with the listings, the calls went unanswered. Instead, the reporter received text messages asking what type of massage they wanted and, eventually, requests for payment via PayPal or Zelle.

The bogus listings also advertised hot stone, Thai and Swedish massage and included multiple five-star reviews.

While WLBT was speaking with one affected business owner, a customer who had been scammed arrived at the location. The owner said an increasing number of people had been showing up expecting appointments, including people arriving after the business had closed.

The fake spa listings are very convincing

The scam takes advantage of how we normally find local services. If you want a massage, you might search for "spa near me," look at the first few results, compare ratings and choose one that appears nearby.

A listing that includes a local street address, phone number, service offerings, opening hours, and positive reviews can create the impression of an established business.

The address is particularly powerful because it gives victims something they can verify. Search for it on a map, and they'll see a real commercial location.

In the Mississippi case, the Better Business Bureau (BBB) also pointed to out-of-state phone numbers and unusual payment requests as warning signs. Additionally, the BBB said that the scam has also been reported in Dallas, Miami and New York.

How can you spot a fake spa before booking?

Don't rely on a single business listing when choosing an unfamiliar spa, especially if you're being asked to pay before arriving.

Search for the spa's name independently and see whether it has an established website or social media presence. Compare the phone number, address and opening hours across those sources.

Search the address separately, too. Does the business shown at that location have the same name as the spa you're speaking with?

Look carefully at reviews instead of relying only on the star rating. Five stars don't automatically mean five-star legitimacy. Google explicitly prohibits fake engagement, including reviews that aren't based on genuine experiences.

Be particularly cautious if:

• The spa claims to operate 24 hours a day but you can't independently verify it.
• Nobody answers the listed phone number and communication immediately switches to text.
• The phone number has an unexpected area code.
• You're pressured to send a deposit before you've verified the business.

“That should be a red flag right there when someone is asking for an odd form of payment and the business that we’re talking about today (24-hour spas) — the phone numbers that I pulled up, they’re all out-of-state numbers,” John O’Hara, CEO of the Better Business Bureau of Mississippi said.

• The payment recipient doesn't appear to match the business.
• Different websites or profiles show conflicting phone numbers or business information.
• The address appears to belong to another company.

You can also copy suspicious messages, links or offers into Bitdefender Scamio for a second opinion or check suspicious URLs with Bitdefender Link Checker.

What should you do if you’re a customer who paid for a fake spa?

If you realize you've paid a fake spa, act quickly. Contact your bank, credit card provider, or the payment service you used, explain that you've been scammed, and ask whether the transaction can be stopped, reversed, or disputed.

Save as much evidence as you can. Take screenshots of the listing before it disappears and keep copies of text messages, phone numbers, payment requests, receipts, profile URLs, and any other details connected to the scam. Then report the fraudulent listing to the platform where you found it.

And don't forget about the real business whose information may have been misused.

If you notice something suspicious about the listing of a local spa or another business you know, consider contacting the owner through a verified phone number, website, or social media account. They may have no idea that scammers are using their address, name, photos, or other information to target people.

A quick heads-up could help the owner report the fake listing, warn other customers, and prevent more people from losing money.

Most importantly, don't direct your frustration at the legitimate business located at the address. The owner and employees may be victims of the scam too. Reporting suspicious listings and alerting affected businesses are simply ways to help protect both other consumers and the local businesses in your community.

The real spa or business may have no idea its address is being abused

The legitimate businesses whose addresses appeared in these listings didn't need to be hacked for the scam to work. Scammers could simply take information available online and attach it to a fraudulent listing.

One spa owner told WLBT that people were showing up at her location expecting appointments. She became concerned about her safety when visitors continued arriving, including around 9 p.m., despite the business being closed and displaying a different name.

“One or two people showing up wasn’t so bad but when you have an influx of people coming up and your Ring camera is going off at 9 o’clock at night and they pull on your door, they see it says closed, they see it says a different name but they still pull on the door,” the business owner said.

Imagine being a small business owner and suddenly having strangers trying your door at night because a scammer you've never spoken to has been taking their money.

There are reputational consequences too.

A victim may assume the legitimate business stole their deposit. They could complain online, leave a negative review or warn others about the company without realizing that the real business was never involved.

Are only spas at risk?

No, the addresses of local spa businesses are used as the lure in this particular scheme. However, the same tactic can be adapted to many businesses, where customers often search online and contact a provider before visiting. This includes beauty salons, barbers, nail salons, cleaners, photographers, pet groomers, repair services, contractors, locksmiths, plumbers or other appointment-based and local service businesses.

In fact, Google specifically prohibits using Maps to impersonate a person, group or organization and prohibits misleading information intended to scam users.

If your business has a physical address that customers can find online, it could be misused by someone else.

What should small businesses do if scammers use their address?

Finding a fraudulent business listing connected to your address can be alarming, but documenting what's happening should be the first step.

Take screenshots of the listing and save the URL, advertised phone number, reviews, photos, services, and any other details. If customers have received payment instructions or messages from the scammers, ask whether they're willing to share screenshots.

Then report the fraudulent listing to the platform.

Google's policies prohibit impersonation and the use of misleading business information, and suspicious profiles can be reported.

Business owners should also:

Search their address periodically. Don't search only for your company name. Search your street address and see what businesses appear there.

Check Google Maps and other popular directories. Look for unfamiliar companies claiming to operate from your location.

Keep your real profiles accurate. Make sure your official website, phone number, opening hours and business information are consistent across your online presence.

Watch your reviews. Complaints about appointments, payments or services you don't recognize could indicate that someone is impersonating your business.

Tell customers how you accept payments. If you don't collect deposits through Zelle, PayPal or other payment apps, make that clear on your website and booking pages.

Prepare employees. If scam victims start calling or arriving at your location, staff should know what's happening and how to respond without escalating an already stressful situation.

Warn your customers and local community. If you discover that scammers are using your business name, address, photos, or other information, don't wait for every customer to discover the fraud individually. Post a notice on your website and official social media accounts that explains what's happening and clearly identifies your legitimate phone number, website, booking process, and accepted payment methods. If appropriate, place a notice at your physical location as well, particularly if scam victims are showing up there. Encourage customers to share the warning and report the fraudulent listing. This can help prevent additional victims while making it clear that your business isn't responsible for the scam.

Consider physical safety. If people are arriving outside business hours or behaving aggressively because they believe they've been scammed, document the incidents and contact local authorities when appropriate.

Businesses should also protect the accounts controlling their email, website, social media and business profiles with unique passwords and multi-factor authentication. That's important because impersonation can sometimes be paired with phishing or attempts to compromise the legitimate company's accounts.

If you're looking for an easy way to strengthen your business security before something goes wrong, Bitdefender Ultimate Small Business Security brings device protection, phishing and scam protection, ransomware defense, and account security together in a single solution built specifically for small businesses.

While security software can't prevent scammers from copying publicly available information or creating a fake listing, it can help protect your business against phishing, malicious links, malware, ransomware, and other threats that could put your accounts, devices, and business data at risk.

You can try Bitdefender Ultimate Small Business Security free for 30 days.