Anatomy of an AI Scam: How I'm Fighting the Google Listing Voicemails (And How You Can, Too)

I’ve been in the tech world for a long time, and I’ve seen my fair share of scams. From phishing emails to elaborate social engineering schemes, you start to recognize the patterns. But lately, something has changed. A new wave of scams, supercharged by Artificial Intelligence, is hitting businesses with a level of sophistication and annoyance that's frankly infuriating.

One scam, in particular, has been flooding my own business lines and those of my clients: a ringless voicemail, delivered by a creepily realistic AI voice, warning that our Google Business Profiles are unverified and at risk.

Your phone doesn't ring. There's no chance to ignore the call. You just see a voicemail notification and, as a diligent business owner, you check it. That's when they have you.

This isn't just a nuisance; it's a direct attack on your time, your peace of mind, and potentially your wallet. In this article, I'm going to break down exactly how this scam works based on my analysis, how I've learned to identify it instantly, and most importantly, the exact methods I use to fight back—whether it's on my own complex VoIP system like Twilio, a client's third-party service, or just my personal mobile phone.

Part 0: The Quick Version - For Busy Readers

If you don't have time for the full deep-dive, here's everything you need to know to protect yourself right now.

The Scam in 60 Seconds: Scammers are using AI and "ringless voicemail" technology to drop a pre-recorded message directly into your voicemail box without your phone ever ringing. The message falsely claims your Google Business Profile is unverified or incorrect and urges you to act immediately to fix it.
What They Want: They want to scare you into calling a number and paying a fee for a worthless or non-existent service to "fix" a problem that doesn't exist. Your Google Business Profile is a free tool.
Known Scammer Numbers: Here is my running list of numbers identified in this campaign.
- +12767221530
- +14782662058
- +12125551234
- +13367293433
- +15058050139
What I Recommend You Do Immediately:
- Do NOT call back or press any keys.
- DELETE the voicemail.
- BLOCK the number on your device.
- NEVER pay anyone who contacts you unsolicitedly about your Google listing.
To check the real status of your profile, do what I do: manually log in to the Google Business Profile Manager.

Part 1: The Frustration is Real: A New Wave of AI-Powered Scams

The core problem with this new wave of attacks is the technology behind them. AI isn't just a buzzword; it’s a powerful tool that has made it cheaper and easier than ever for bad actors to run scams at a massive scale.

From what I've seen, they use AI to:

Write the scripts: Crafting language that creates a high sense of urgency and fear.
Generate the voice: Using AI voice synthesizers that are becoming increasingly difficult to distinguish from a real person.
Automate the delivery: Ringless voicemail technology allows them to bypass the traditional call-blocking apps I use and deliver their message with near-perfect efficiency.

This isn't about a person in a call center dialing numbers. This is a machine attacking my business's communication lines, and yours. It's impersonal, relentless, and designed to prey on the anxieties of every business owner who relies on their online presence.

Part 2: Anatomy of the "Google Business Listing" Ringless Voicemail Scam

After getting hit with these myself, I did a deep dive. Let's dissect this scam piece by piece based on what I've learned.

How it Works: The "Ringless Voicemail" Drop

Ringless voicemail isn't new, but it has been weaponized by scammers. Instead of connecting through the traditional mobile network (the "switch"), which would make your phone ring, the technology allows a server to connect directly to your mobile carrier's voicemail server and deposit an audio file.

You get a notification that you have a new voicemail, completely bypassing the chance for you to screen or ignore an unknown number. It's an insidious exploitation of a system designed for our convenience.

The Scripts They Use

The scripts are designed to be short, alarming, and just vague enough to apply to any business. I've personally received these two common versions, and I've heard the same from my clients:

Script A: "... To speak with an agent immediately and verify your Google listings again, your business is not showing correctly on Google and Google voice search. Press 0 to speak to an agent. Press 9 to opt out, or call 877-556-9255. Thank you."

Script B: "Your business is not verified. Press one now so we can verify your business with Google. If you’re the business owner, press one now. If your account is not verified, customers searching for your services on Google will not find your listing. Press one now to verify your listing. Press two to be removed from this list."

The psychology is simple: create a problem ("your business is invisible!") and offer an immediate, easy solution ("just press one!").

Part 3: Spotting the Red Flags: How to Identify This Scam in the Wild

This is where you move from being a target to being a defender. The good news is that once you know what to look for, these scams become obvious. Here are the concrete tells that immediately tip me off.

The Medium is the Message: The biggest red flag for me is the ringless voicemail itself. In all my years of experience, I know that Google's primary methods for official communication are email to the account holder or notifications inside the Google Business Profile dashboard. They do not use unsolicited, intrusive methods like this for critical account warnings.
Google's Actual Process: I manage several Google Business Profiles. The verification process is formal and is always initiated by me. This has been a postcard mailed to a physical address, a phone call/text that I requested, or a video verification. Crucially, Google has officially stated they do not make unsolicited automated calls threatening to remove your profile or demanding payment for your free listing. I trust their official process, not a random voicemail.
Linguistic "Tells" of the AI: When I listen to the message, a few things stand out:
Vague Salutations: The message never uses my name or my business's name. It's always a generic "business owner" or "your listing."
False Urgency: The script always contains a threat (your business won't be found) and an urgent command (Press 1 NOW). The FTC warns that this creation of artificial pressure is a hallmark of nearly every scam.
The Opt-Out Trap: Offering an opt-out (Press 9 or 2) is a classic robocall trick. It’s not a courtesy; it’s a tactic to confirm my number is active. I never press it, as it just tells them they've found a live one.
The Money Lie: This is the most important rule I operate by. My Google Business Profile is a free tool. Any unsolicited call that demands payment to "verify," "fix," "optimize," or "guarantee placement" for my basic listing is, without exception, a scam.

Part 4: The Blacklist: A Publicly Sourced List of Scammer Phone Numbers

Knowledge is power, and I believe in sharing it. Here are the numbers I've personally blocked and have been reported by clients and colleagues. I recommend you block these immediately across all your systems.

+12767221530
+14782662058
+12125551234 (Note: This is a classic "placeholder" number, but it was reported as being used.)
+13367293433 (Note: started receiving from this one only after I blocked the earlier 3)
+17025556789 (Note: I think this one was part of the demo code in Twillio, I left it in there 'just because')
+15058050139 (Added June 20th, 2025)

Become Part of the Solution

This is where I need your help. If you have received this scam from a number not on this list, please leave a comment below with the number. I will verify it and add it to this public blacklist to help protect our entire community of business owners.

Part 5: Your Defense Strategy: Actionable Steps for Every Setup

My first rule is always Verify, Don't Trust. Before I do anything else, I log in to my official Google Business Profile dashboard to check for any real notifications. 99.9% of the time, I find nothing is wrong.

Now, let's get to my blocking strategy.

Situation 1: You Use a Programmable Voice Service (like Twilio)

Create a Service: In your Twilio Console, go to Functions and Assets > Services and create a new Service. Let's call it call-blocker.
Set Up Environment Variables: Inside your new service, go to Settings > Environment Variables. We need to add two:
- BLOCKLIST: A comma-separated list of the phone numbers to block (e.g., +12767221530,+14782662058).
- MY_PHONE_NUMBER: Your real phone number where you want to receive legitimate calls (e.g., +12223334444).
Create the Function: Go to Functions and Assets > Functions inside your service and add a new Function. Let's name the path /blocker.
Deploy: Click "Deploy All" to save and activate your function.
Configure Your Twilio Number: Navigate to Phone Numbers > Active Numbers and click on the number you want to protect. Under the Voice & Fax section, configure "A CALL COMES IN" to use your new call-blocker Service, UI Editor environment, and /blocker function path. Save the configuration.

Add the Code: Replace the default code with this Node.js script. This code checks if the caller is on the blocklist. If so, it rejects the call. If not, it forwards the call to your real number.

exports.handler = function(context, event, callback) {
  // List all blocked phone numbers in quotes and E.164 formatting, separated by a comma
  let numberBlock = event.block || [ "+12767221530", "+14782662058", "+12125551234", "+13367293433", "+17025556789" ];

  // Setup some variable so we can do logic
  let twiml = new Twilio.twiml.VoiceResponse();
  let blocked = true;

  // Check if the number coming is is within the block lis
  if (numberBlock.length > 0) {
    if (numberBlock.indexOf(event.From) === -1) {
      blocked = false;
    }
  }

  // Thus if blocked, reject it
  if (blocked) {
    twiml.reject();
  } else {
    // Redirect to your existing TwiML bin if not blocked
    twiml.redirect("https://handler.twilio.com/twiml/EH889f06bdf3b0de05ad5db688118204c2");

    // OR USE THE FOLLOWING, NOT BOTH
    // Get my real phone number from the environment variables.
    // To simply redirect to your number, uncomment the two lines below
    // const myPhoneNumber = context.MY_PHONE_NUMBER;
    // twiml.dial(myPhoneNumber);
  }

  return callback(null, twiml);
};

Now your Twilio number is protected. When you identify a new scam number, you just have to add it to your BLOCKLIST environment variable and redeploy.

Situation 2: You Use a Third-Party SaaS VoIP System

For my clients using systems like RingCentral, Dialpad, or Ooma, the process is more straightforward. Here's what we do:

We log in to the VoIP system's admin dashboard.
We go straight to the "Call Logs," "Call History," or "Recent Calls" section.
We find the scammer's number in the log.
There's always an option next to the call record to "Block Number" or "Add to Blacklist." We click it, and we're done.

Situation 3: You Use a Standard Mobile Phone (iOS/Android)

For my own cell phone, it's a simple, reflexive action now.

On my iPhone: I open the Phone app, go to Voicemail. I tap the (i) info icon next to the scam number, scroll down, and tap Block this Caller. It takes five seconds.
On Android: The process is similar. Open the Phone app, go to call history, tap the number, and look for an option to Block or Report as Spam.

Part 6: The Tech Toolbox: Automating Your Spam Defense

Manual blocking is my first action, but proactive, automated tools are my long-term strategy. Here are the tools I've found to be most effective.

For My Mobile Phone: I've tested several apps, and my current recommendations are RoboKiller and Nomorobo. They use huge, constantly updated blocklists and clever call screening to stop these calls before they ever bother me.
Carrier-Level Tools: I also make sure to have the free tools from my mobile provider enabled. AT&T ActiveArmor, T-Mobile Scam Shield, and Verizon Call Filter are surprisingly effective and serve as a great first line of defense.
For Business VoIP: When setting up a client's VoIP, I always check the provider’s marketplace for integrations. Many systems can integrate with services like Nomorobo or Marchex Clean Call, and I've found these add a powerful, enterprise-grade layer of filtering.

Part 7: What to Watch Out For: The Unfiltered Truth About Spam Blocking

As we build our defenses, I think it's crucial to be realistic. Here are some hard truths I've learned from experience.

There is No Silver Bullet: No filter is 100% perfect. I still get the occasional one that slips through. Scammers are constantly cycling numbers ("spoofing"). Our best defense is a combination of good tools and personal vigilance.
The Human Element: The ultimate target isn't the technology; it's you or your employees. I've trained my team—and I advise all my clients—to never act on an unsolicited, urgent request over the phone without independent verification.
Platform-Specific Quirks: I've learned not to be confused by certain limitations. For example, on my iPhone, even if RoboKiller successfully blocks a call, iOS security policies may still cause it to appear in my "Recents" call log. This is expected behavior and doesn't mean the app failed.
The Risk of False Positives: I've also seen aggressive spam filters block legitimate calls. About once a month, I take 60 seconds to review the blocked calls log in my app to make sure a new client or important contact wasn't accidentally caught in the net.

Part 8: The Business Impact: Why Every Second Fighting Scams Costs You Money

As a business owner, I don't see these calls as a simple annoyance. I see them as a direct hit to my bottom line.

Lost Productivity: Every minute I or an employee spends dealing with a scam voicemail is a minute we aren't being productive.
Opportunity Cost: While a line is occupied or our focus is diverted, a real customer might be trying to reach us.
Risk of Reputation Damage: The biggest risk I see is the potential for catastrophic damage to a business's reputation if an employee is tricked into giving away information.

For me, fighting spam isn't just for peace of mind; it's a necessary business security function.

Part 9: Reporting the Scammers: Where to Go & What to Say

I make it my policy to not just block and delete, but to report. Every report is a piece of data that helps the authorities and carriers build better tools.

File a report with the Federal Trade Commission (FTC): ReportFraud.ftc.gov
File a report with the Federal Communications Commission (FCC): fcc.gov/complaints

When I file, I keep it concise. I state the facts: "Received an unsolicited, fraudulent ringless voicemail on [Date] from [+1-XXX-XXX-XXXX]. The automated message was a scam about my Google Business Listing."

Conclusion: Staying Ahead in the AI Arms Race

This AI-powered scam is a perfect example of the new reality we face. The tools available to bad actors are more powerful than ever. But our tools for defense, and our ability to share information as a community, are powerful, too.

My personal strategy is simple:

Be Skeptical: I question every unsolicited call, especially those that create pressure.
Verify Independently: I never trust, I always verify through official channels I control.
Block Aggressively: I use the tools at my disposal to build a strong defense.
Report Everything: I make sure to be an active participant in the solution.

By working together, sharing information, and staying vigilant, we can make these scams unprofitable for the criminals who run them. Stay safe out there.