Citation Poisoning

What a citation is, and what poisoning it means

A citation, in local search, is any mention of a business's NAP — its Name, Address and Phone number — on a third-party site: a directory, a chamber of commerce page, an industry association listing, a review site, a data aggregator. Citation poisoning is the deliberate seeding of wrong NAP data across those sources: a transposed suite number, a phone number belonging to somebody else, a variant business name, an address the business moved out of three years ago, a closed flag on a directory listing.

These are directories — third-party websites that list businesses by category and location, most of which historically accepted unauthenticated submissions or public corrections, and several of which redistribute their data to others. Feed a bad phone number into one high-reach source and it can appear on a dozen sites that license from it. That is the whole premise of the attack.

Two entirely different theories of harm travel under this one name, and separating them is the single most useful thing this page can do:

1. The ranking theory. Inconsistent NAP across the web confuses search engines about which business is which, weakens their confidence, and costs local pack visibility. The local SEO industry has been making this claim for fifteen years. The evidence for it is weaker than the industry admits, and it is getting weaker.
2. The direct-harm theory. A customer finds the wrong phone number, calls it, and never reaches you. Or finds the old address and drives to an empty unit. This has nothing to do with algorithms and nobody disputes it. On the worst version — a competitor's number, or a premium-rate line, substituted on a listing real people actually use — it is a straightforward interception: your customer's call, answered by somebody who is not you.

The second is why this subject matters at all. The first is why it is oversold. A page that conflates them, and nearly every page on this subject does, is doing the reader a disservice.

Consistent with the rest of this reference, this page does not name which directories accept unauthenticated edits or describe how submissions are made. That is instruction for an attacker and adds nothing a defender needs — a defender audits their own data wherever it appears and corrects what they find.

In July 2025 Google deleted directories from its own definition

This is the most important dated fact on the page, and almost nobody has updated their advice for it.

Google's guidance on improving local ranking explains local results through relevance, distance and prominence. Its current definition of prominence reads: "Prominence means how well-known a business is. Prominent places are more likely to show up in search results. This factor's also based on info like how many websites link to your business and how many reviews you have."

Links and reviews. Directories are not mentioned.

They used to be. Barry Schwartz documented the rewrite on 15 July 2025: the earlier prominence language referenced "links, articles, and directories", and Google also deleted the sentence saying that a business's position in web results is a factor and that SEO best practices therefore apply. The current text narrows prominence to links and reviews.

Two pieces of discipline belong with that finding. First, it is not established whether the change reflects an algorithmic change or only a documentation simplification, and Schwartz says so explicitly; I will not claim more than he did. Second, the change is still consequential regardless of which it is, because it removes the foundation under a very large amount of published advice: anyone citing Google's documentation for the importance of citations is now citing text Google deleted.

What Google does still say on the same page is about your own Business Profile — the listing you control directly: "Businesses with complete and accurate info are more likely to show up in local search results. If your business info isn't accurate, your Business Profile might not show up for relevant searches in your area." That is a statement about the data inside your profile. It is not a statement about third-party directories, and it is regularly quoted as though it were.

Nobody has ever documented the ranking harm

I went looking for a single case in which deliberately seeded bad NAP data measurably cost a business its local rankings: a case study with a disclosed method, a controlled experiment, a court filing, a Google statement acknowledging it as an attack. I found none. Searching the term itself returns essentially one category of result — vendors selling citation management. That is the most important finding on this page and it deserves stating in plain words: nobody has publicly demonstrated that seeded bad citation data measurably harmed a business's search rankings.

The best structured evidence that citations matter at all is a survey, and it must be labeled as one every time. Whitespark's Local Search Ranking Factors report, 2026 edition, published 6 November 2025, polled 47 local SEO practitioners across 187 factors. For local pack results it ranks the signal groups in this order: Business Profile signals, review signals, behavioral signals, citation signals, link signals, on-page signals, personalization, social. Citations place fourth of eight — present, but below the profile and below reviews. And the direction of travel is downward: the report's own commentary notes surprise that citations lost about half a percentage point, "continuing the downward trend from previous editions".

That is opinion aggregation, not measurement. Forty-seven experts scoring 187 factors is a well-run survey of belief, and belief is what it measures. It is still the best structured data anyone has, which tells you how thin the evidence base is.

For contrast, Search Engine Journal's ranking-factors entry on local citations concluded in January 2022 that it was "all but confirmed officially by Google" that local citations are a ranking signal. Note the date. That conclusion rested partly on the Google documentation wording Google removed in July 2025, and partly on practitioner surveys from 2016 and 2020. It was a fair summary of what was believed in 2022. It is not a safe basis for spending money in 2026.

There is one live counter-argument and it deserves to be stated rather than dismissed. The same Whitespark report argues that in AI search, mentions across the web are becoming what links used to be, with several of the top AI-visibility factors being citation-related. So the same source says citations matter less for the local pack and more for AI answer surfaces than they used to. That is a genuine unresolved tension, it comes from a single survey with no independent replication, and it may well turn out to be right. It is currently an assertion.

The half that is real: your phone line

Set the algorithm aside entirely and the picture is much clearer.

If a wrong phone number for your business is sitting on a source real customers use, you are losing calls today, and no debate about prominence changes that. The harm is proportional to that source's traffic, not to its "citation authority" — a metric invented by tools that sell citation cleanup. A wrong suite number on a dead directory costs nothing. A competitor's number on a listing that ranks for your brand costs you every lead that reaches it.

Three versions are worth distinguishing, because they escalate:

• Wrong data. A number that rings nowhere, or an address that leads to an empty unit. Lost customers, no beneficiary.
• Substituted data. A competitor's live number in place of yours. Your customer is answered, sold to, and never knows they called the wrong business. This is the version with a real legal theory attached.
• Regulated-sector data. A wrong address on a professional register or a licensing body's listing, where the consequences run well past search — into compliance, insurance and client trust.

This is where a business's money should go, and it is a much smaller job than the one that gets sold. Fix what a customer might plausibly use. That is usually a handful of sources, not the several dozen a scan tool will show you.

The attack's premise is weaker than its reputation

The mechanism this attack depends on — cheap, unverified, high-reach data injection — has been narrowing for years, and most writing on the subject describes an ecosystem that no longer exists.

• The aggregator layer consolidated. Foursquare and Factual merged in April 2020, folding two of the historic four US aggregators into one. Infogroup rebranded as Data Axle in September 2020. Acxiom's business directory closed at the end of 2019. Neustar Localeze now operates as TransUnion Digital Business Profile, a paid subscription. The "submit everywhere for free" model that made mass poisoning cheap has narrowed substantially, and at least one aggregator is described as conducting phone verification.
• Google's tolerance for unverified third-party business data has fallen sharply. It reports blocking or removing 70 million policy-violating edits in 2024 and 79 million inaccurate or unverified edits in 2025, and since April 2026 it says it emails verified owners about suggested edits before they go live. Those numbers cut directly against the mechanism this attack needs.
• Whether Google still ingests aggregator feeds at all is unconfirmed. The industry's own ecosystem maps describe the aggregator-to-engine relationships as "likely" and largely unverified, and the resource most often cited for it is substantially dated. Nobody outside Google knows.

None of that makes the attack impossible. It makes the premise much shakier than the marketing around it, and I could find no current demonstration in either direction.

Where it still bites

Narrow, specific, and mostly not about rankings:

• High-traffic destination listings, where wrong contact data costs real calls whatever the algorithm thinks.
• Unclaimed listings across the board. If a business has never claimed its profiles, nobody is notified of a change and nothing gets corrected.
• Businesses that genuinely moved or rebranded recently, where real legacy inconsistency already exists and false data blends into it. This is the condition under which corrupted data is most likely to be believed and hardest to untangle.
• The Business Profile feedback loop. The realistic path from a poisoned directory to actual damage runs through your Google listing: conflicting third-party data is one of the inputs that can prompt a suggested update, a status change, or — combined with other signals — a suspension. Sterling Sky lists data-aggregator conflict among the causes of an unwanted closure status. That is a practitioner observation and not a documented Google behavior, but it is the mechanism to watch, and it means citation poisoning is best understood as a supporting attack for the Business Profile attacks rather than as a standalone one.
• AI answer surfaces, where mentions across the web feed what a model says about a business and there is no owner-controlled profile to override them. This is the direction in which the risk is plausibly increasing, and it is also the least evidenced part of the whole subject.
• Regulated and license-verified sectors, as above.

Poisoning versus decay: the test that resolves most cases

Before anything else, apply this test, because it settles the majority of cases in a minute: poisoning invents data that was never true; decay preserves data that used to be true. If the wrong phone number was your number in 2019, nobody attacked you. You changed phone systems and the internet did not notice.

Ordinary citation decay is overwhelmingly the more likely explanation for NAP inconsistency, and it is not an attack at all: a business moved, changed carriers, rebranded, changed legal entity, or had an agency submit a call-tracking number years ago. Add to that listings the business created and forgot, duplicates from a franchise or a previous owner, aggregator records that predate the current tenant of the address, and scraped listings that copied one typo everywhere.

The detection work, in the order I would actually do it:

• Call every number listed for you anywhere. This is the single most useful diagnostic on the page and the one nobody does. Note what answers.
• Search the phone number on its own. If it returns other businesses, or if a different number returns your business name, that is the finding.
• Search your NAP variants — the exact business name in quotation marks alongside the current number, then alongside any old number and any old address. Free, ten minutes, finds most of what matters.
• Write down a canonical record first. Exact legal and trading name, address with suite formatting, primary phone, canonical URL, hours. You cannot detect drift without a baseline, and inconsistent corrections are how a cleanup creates new inconsistency.
• Prioritize by traffic, not by count. Check which listings actually send referral traffic in your analytics and fix those. A tool's "consistency score" is a sales instrument, not a diagnosis.
• Watch for reversion. A correction that undoes itself within weeks means the bad data is still upstream. That reversion pattern is the difference between ordinary decay and something actively maintained.

Fixing it, and doing considerably less of it than you are sold

1. Fix the Google Business Profile first, and make sure it is claimed and verified. It is the highest-traffic surface, you control it directly, and it is the one place Google actually says the data must be accurate. Everything else is secondary.
2. Establish the canonical NAP in writing before correcting anything, so every correction is identical.
3. Correct upstream before downstream. Aggregators first, then the consumer-facing directories that license from them. Downstream-only fixes revert, and then you pay again in three months.
4. Claim the listings rather than only editing them. A claimed listing resists third-party edits. An anonymous correction to an unclaimed listing can be overwritten by the next anonymous correction.
5. Triage the rest by traffic, and stop early. Fix the sources a customer might plausibly use. Ignore the long tail. This is the step where most money is wasted, and doing less is correct.
6. Retire a poisoned phone number rather than merely correcting it. Keep the old line answered and forwarded instead of abandoning it, so intercepted calls still reach you while corrections propagate.
7. Re-check at 30 and 90 days. Propagation is slow, and reversion is the signal that matters.
8. For most of what a scan reports, do nothing. The honest advice on this subject is subtractive. Google resolves business identity from many signals including the profile data you control, and a wrong suite number on a directory nobody visits is not costing you anything measurable.

What does not help: buying a bulk cleanup subscription because a free scan produced an alarming score; mass-submitting to hundreds of low-quality directories to drown out the bad data, which multiplies the surfaces you must maintain and creates fresh copies of every error; changing your actual phone number or address in response to an attack, which invalidates every correct citation you already had; and disavow files or Search Console reconsideration requests, neither of which has any connection to citations.

Why this is the most oversold product in local SEO

Put the pieces together. Google removed directories from its published definition of prominence in July 2025. Practitioner surveys have ranked citation signals fourth of eight and declining for several editions running. The aggregator layer has consolidated and partly moved behind paywalls. Google blocks tens of millions of unverified business-data edits a year. And in searching for evidence of the ranking harm, everything I found asserting it had been published by somebody selling the remedy.

So here is the plain version. Fix wrong data because customers use it, not because a scan tool found 47 inconsistencies and quoted you a price. The free scan is the marketing. Before paying for a cleanup, ask which of the flagged sources send you traffic; the answer is very often none. A consistency percentage is not a diagnosis, and a business that has never moved, never rebranded and claimed its profile usually has nothing here worth buying.

The recourse picture reinforces the same conclusion, and it is weak enough that manufacturing optimism about it would be dishonest. There is no central authority over business listing data — every directory is a separate negotiation and most have no appeal. Google's Business Redressal Complaint Form accepts complaints about misleading information relating to a business name, phone number or URL, and Google states on the form itself that it cannot guarantee any action will be taken. The Lanham Act, 15 U.S.C. 1125(a), is the strongest theory where a competitor has substituted their own number for yours, because that is a false designation of origin diverting your customers; substituting a merely wrong number is a much weaker case. State-law tortious interference fits where the perpetrator is identifiable and lost business can be shown. Where a premium-rate or misdirected line is involved, carrier and regulator complaints may reach the number faster than any directory will.

But identifying who did it is usually impossible. Directory edits are typically anonymous, logged inconsistently, and spread across dozens of independent operators with no obligation to retain or disclose anything. Unlike Google, which can at least be subpoenaed and has been shown to hold edit attribution, the long tail of directories generally cannot produce a thing. That is the main reason this is almost never litigated, and it should temper any advice to pursue it legally. One final note on scope: the FTC's Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, governs reviews and testimonials and does not reach business listing data at all — and it carries no private right of action in any event.

Frequently asked questions