Is My SEO Company Ripping Me Off? 

Plenty of business owners can't say what last month's SEO invoice actually bought. Google publishes its own checklist for hiring an SEO, and it's six questions long.

Small Business MarketingFor small businesses
Direct answer

How do I know if my SEO company is legitimate?

Use Google's own published checklist. Google states plainly that "no one can guarantee a #1 ranking on Google," so a guaranteed ranking or a claimed special relationship with Google settles the question on its own. Google also says to be wary of firms that email you out of the blue, to be careful if a company is secretive about what it intends to do, and never to accept a deal where you have to link to an SEO. Then ask the six questions Google lists: examples of previous work, whether they follow Google Search Essentials (its published rules for what's allowed), what results to expect and in what timeframe, experience in your industry and city, years in business, and how you'll communicate. If those answers are evasive, that's your answer, and Google's guidance directs fraud complaints in the United States to the Federal Trade Commission.

Google publishes a page about hiring an SEO. The version live now, last updated in June 2026, includes a line about where to complain if the one you hired turns out to be a fraud: “In the United States, the Federal Trade Commission (FTC) handles complaints about deceptive or unfair business practices.” For companies outside the US it points to econsumer.gov.

Hiring guides don’t usually need a complaints address.

Pure fraud occurs only rarely. Most scams progress more slowly. Nobody can say what the money bought, a payment comes on the first day of the month, and the person signing the check has no way to check. This is how you can spot which type you hold. The list comes from Google.

The one claim that settles it

If someone promises you a ranking, you’re finished evaluating them.

Google’s official advice states plainly: “No one can guarantee a #1 ranking on Google.” The same resource cautions companies: “beware of SEOs that claim to guarantee rankings,” and ties that caution to any claim of a “special relationship” with Google. Search results have no paid tier and no reserved positions.

There are two more items on that page you should keep in mind. Google advises, “be wary of SEO firms and web consultants or agencies that email you out of the blue,” and likens those messages to the other mail that ends up in your spam folder. It also cautions, “be careful if a company is secretive or won’t clearly explain what they intend to do.” A technique that no one explains to you is a technique you cannot verify.

One more is about your money. “You should never have to link to an SEO.”

The questions Google says to ask before you hire

Google’s page lists what to put to an SEO before you sign anything. Lightly paraphrased, they are:

  • Can you show me examples of your previous work and share some success stories?
  • Do you follow Google Search Essentials, Google’s published rules for what’s allowed?
  • What kind of results do you expect to see, and in what timeframe?
  • What experience do you have in my industry, and in my city?
  • How long have you been in business?
  • How can I expect to communicate with you?

Each of those items asks about how we work together. You can ask who will email you and what must change by March without understanding what a canonical tag means.

Many overlook this. The task isn’t to review the work; it’s to see if a clear question gets a clear reply.

Put all six to us as well. The one we’d have to think about is the second, because “do you follow Search Essentials” has a boring answer and no proof attached to it.

Is that call from Google real?

The FTC complaint contains a version of the script. Compare that version with whatever you actually heard.

In 2018 the FTC filed a lawsuit against Pointbreak Media, accusing the company of running a telemarketing scheme that targeted small-business owners. The commission alleged the callers introduced themselves as “data service providers” for Google or as “authorized Google My Business agencies” while having “no relationship with Google,” and told owners their listing would be labeled “permanently closed” unless they paid, at fees the FTC put at $300 to $700. The agency said the operation placed robocalls to more than 74 million consumers, dialed over 14 million numbers listed on the Do Not Call Registry, and wrote itself unauthorized $100 checks from the accounts of more than 250 businesses. In May 2019 the FTC announced that a federal court had ordered the two principal defendants to pay $3,367,666.30.

The habit that protects you is shorter than the script. Never act on an incoming call. Put the phone down and open your own Google Business Profile. Anything real will be waiting for you in there. Caller ID is not evidence, because it can be set to say whatever its owner wants.

When a phone call of that sort unsettles you, the real issue it raises is often a more useful way to spend the rest of the day: checking if the domain and the website are actually in your name and figuring out what you could walk away with.

When the fake listing is the competition

A number of the listings you contend with in local search might not represent an actual business.

In May 2026 the FTC and the state of Illinois filed a lawsuit against B.E.S.T. GDR LLC, which operates as Premium Home Service. The complaint says the company produced thousands of fraudulent online listings for home-repair businesses. These listings appeared under dozens of invented company names starting at least in 2018 and were tied to searches such as “electrical services,” “plumbing,” “heating and cooling” and “garage door repair.”

The complaint says tens of thousands of people looking for a local repair company were diverted to those profiles; that calls to the listed local numbers were routed to representatives elsewhere, including the Philippines; that callers often couldn’t get confirmation a technician was coming; that in many cases nobody came; and that in others the company sent technicians “who are not licensed or qualified to perform the job.” It also alleges fabricated five-star reviews used to dilute genuine one-star ones, a claim under the FTC’s Reviews and Testimonials Rule. The case was referred to the Department of Justice, and none of it has been decided in court.

You can’t address any of this from within your own website. Your pages may be correct and your phone might pick up on the second ring, yet the call can still end up at a place that, if the complaint is valid, was never an actual company. If the complaint is valid, the contractors who ought to have taken those calls never even knew they existed.

What about “AEO” and “GEO”?

AEO and GEO are the names used now for the attempt to have your pages cited in AI replies. Ask whoever is quoting you a monthly figure for either one which Google documentation they’re working from.

There is some, though not much: one page on Google’s generative AI features. That scarcity makes the question reasonable and explains why answers often remain vague. Google’s hiring site now advises you to verify that any guidance on “AEO” or “GEO” services matches the official documentation for generative AI features. The same page also states that Google “doesn’t evaluate or endorse third-party SEO tools” and warns against any tool that claims the company’s approval.

Actual techniques do exist. No one possesses a secret route to those answers, and everything publicly available comes from Google’s documentation.

The question we asked earlier still holds. Choose a period, ninety days, for instance. During that span, what will change inside it, and how will I notice the difference?

Get your own Google Search Console login this week, whoever does the work. A traffic drop is checkable once you have one.

Reporting it is worth the few minutes

Most of the FTC’s data on impersonation isn’t related to SEO. The bulk of it involves bogus tax-call schemes and counterfeit bank-fraud hotlines. In a public-comment request that launched on September 24, 2026, the agency said it logged more than a million imposter scam reports in 2025, with nearly $3.5 billion in reported losses.

Submit it regardless. The Pointbreak judgments started as complaints from business owners who had been called.

Apply that checklist again to the next person you consult. The response you need about the money issue should be a single sentence; you shouldn’t have to request it a second time.

Frequently Asked Questions

FAQ

No, and Google says so in those words on its own hiring page: "No one can guarantee a #1 ranking on Google." The same page tells businesses to beware of SEOs who claim to guarantee rankings, and lists that alongside anyone claiming a special relationship with Google. Nothing in search is for sale at any price, so a guarantee has nothing to be made out of. If a guarantee is in a proposal you're holding, you can stop reading it.

Treat it as not real until you've checked from your own account, which takes a minute and costs nothing. The FTC's case against Pointbreak Media lays out one version of the script, in which the agency alleged that callers presented themselves as "authorized Google My Business agencies" with no relationship with Google, and warned owners their listing would be marked "permanently closed" without payment. That is one enforcement matter rather than a measure of how common the practice is.

There isn't a single number, and anyone naming one without seeing your site is guessing. The more useful question is what the money buys this month, in a sentence you could repeat to someone else. Reporting that shows rankings climbing while calls and form submissions stay flat is a report about rankings. Pick a window, and ninety days is a reasonable one. If nobody can tell you what will be different inside it, or how you'll see the difference, start there, before the price.

No. The acronym tells you nothing either way. Getting your pages quoted inside AI answers is real work with real methods behind it, and no one has a private channel into those answers, so Google's hiring page tells you to check any AEO or GEO claim against its own documentation on generative AI features. The same page says Google "doesn't evaluate or endorse third-party SEO tools." The warning sign is a vendor who can't name what they'll change on your site, or who implies they have an inside track.

In Google Search Console, which holds Google's own record of your performance in search. Compare impressions and clicks, meaning how often you came up and how often somebody clicked, for the four weeks either side of when you noticed. Then open the Manual actions report, which is where Google tells you if someone there has penalized your site by hand. Google publishes a guide to debugging traffic drops that sorts the causes by the shape of the graph, so "an algorithm update" is a claim you can test. You should have your own Search Console access regardless of who does the work.

Google's hiring page points to the Federal Trade Commission, saying that "in the United States, the Federal Trade Commission (FTC) handles complaints about deceptive or unfair business practices," and to econsumer.gov for companies outside the US. Reporting is free and takes a few minutes. The FTC logged more than a million imposter scam reports in 2025, a figure covering impersonation of every kind, SEO included, and its cases get built out of reports like yours.

Sources

Let's Talk Learn more