Why Is Google Asking Your Medical Practice for an EIN?

An office manager at a family practice messaged us on a Tuesday, clearly rattled. She had gone into Google to fix a wrong holiday hour, and instead of letting her save it, Google demanded she verify the business and typed out a field asking for the practice's EIN. "I did not sign up for anything," she wrote. "Why does Google need my tax ID? Is this one of those scams going around?" Fair question. The honest answer is that it is probably real, it is probably fine, and the reason it feels sketchy is that scammers have spent years making fake versions of exactly this moment.

So let us separate the two. There is a real shift happening in how Google verifies businesses, and there is a swarm of fraud riding on top of it. If you can tell them apart, this is a ten minute task. If you cannot, you either hand your login to a thief or you ignore a genuine request and watch your listing go dark. Both are expensive. Let us make sure you do neither.

What actually changed in late 2026

Fake and duplicate listings became a real problem for Google, and healthcare is one of the worst hit categories, because a fake "clinic" listing can skim calls and ad clicks from legitimate practices. So Google tightened verification. According to the November 2026 Google webmaster report, Business Profiles are now being asked for Employer Identification Numbers, and government ID verification is being rolled out, both aimed squarely at combating fraudulent listings.

Two specific things are showing up in practice owners' accounts right now:

• EIN requests. Google asks for your business EIN as extra proof the business is a real, registered entity. Search Engine Roundtable reported that an EIN, along with a public privacy policy link, is now required when you turn on or update the messaging button on a Business Profile. You submit the EIN, a Google partner reviews it, and only then does the feature go live.
• Government ID verification. In October 2026, Search Engine Roundtable also noted Google testing a new verification option: uploading a photo of a government issued ID, alongside the existing methods of phone or text, email, live video call, and mail. You do not get to pick which method you are offered. Google decides based on how risky your profile looks to its systems.

Notice the pattern. Google is moving from "mail you a postcard with a code" toward "prove you are a real business run by a real person." For an honest practice that is annoying but survivable. For a spammer running fifty fake listings, an EIN and a face on video are very hard to fake at scale. That is the whole point.

Is this a scam? How to tell in thirty seconds

Here is the rule that keeps you safe. A real Google verification request lives inside your own account. You see it when you log in to your Business Profile, or in an email from an official google.com address that sends you back to a Google page to finish. You type your EIN into a Google form. Nobody is on the phone with you.

A scam looks like help arriving a little too eagerly. The giveaways are consistent:

• Someone calls or texts "from Google" saying your listing will be removed unless you verify right now. Google does not cold call your front desk to collect your EIN or your password. That urgency is the hook.
• They ask you to read your EIN, your ID, or a verification code out loud, or to send a photo of your license to a personal Gmail or a random email address. Real verification is uploaded on a Google page, never read to a stranger.
• There is a fee. Verifying a Business Profile is free. Anyone charging you to "keep your listing verified" or "rank you higher with Google" is not Google.
• They want your Google login. No legitimate process asks you to hand over your password or a two factor code. That is the entire ballgame for a thief, because whoever controls the login controls your listing, your reviews, and where your calls go.

No EIN? Here is the fix

A lot of solo providers, a single dentist, a therapist in private practice, a chiropractor, never bothered to get an EIN and have been using a Social Security number for everything. If that is you and Google asks for an EIN, you can get one for free in a single sitting on the IRS website. The number is issued immediately at the end of the application. Honestly, most practices should have one anyway, so your tax ID is not your personal Social Security number floating around on vendor forms.

One warning. Search "get an EIN" and you will find companies that charge forty or fifty dollars to file the form for you. Skip them. The IRS issues an EIN at no cost, and the official application takes about ten minutes. Paying a middleman for a free government number is its own small scam.

Why this matters more for a medical practice than a pizza shop

When a restaurant's listing goes down for a week, people find another place to eat and life goes on. When a medical practice disappears from Google, the damage is less obvious and a lot bigger. A patient in pain searches your name, finds nothing, assumes you closed, and books the clinic down the road. A new mover looking for a pediatrician never sees you at all. Your reviews, your hours, your phone number, your directions, the whole front door to your practice, all of it hangs on that profile staying verified and live.

That is why you cannot treat a verification request as spam to deal with later. If Google is asking and you ignore it, a suspended profile can drop out of Search and Maps within days, and getting reinstated is a slow, frustrating process. The practices that stay visible are the ones that treat the Google Business Profile as critical infrastructure, not a chore, because for patient acquisition it genuinely is. It feeds your local search ranking directly, and local search is how most patients find a provider near them today.

There is also the privacy policy piece, which trips people up. To switch on messaging, Google now wants a public privacy policy link. If your practice website does not have a real privacy policy page, that feature simply will not turn on, and you lose an easy way for patients to reach you. It is a small thing that blocks a useful feature, with no warning, until someone fixes it.

Where EtherealMinds comes in

Most practice owners we talk to are not scared of the EIN itself. They are scared because they cannot tell, in the moment, whether the thing in front of them is Google or a thief, and the cost of guessing wrong is their visibility or their login. That uncertainty is the real problem, and it is the part we take off your plate.

When we manage a practice's local presence inside our patient acquisition system, we own the Business Profile the right way: verification handled, requests answered the day they appear, a clean privacy policy live on your site, and a watch on the listing so a suspicious edit or a suspension does not sit undiscovered for a week. You get a straight answer when something looks off, instead of forwarding a scary email to your team and hoping someone knows. The profile stays live, stays accurate, and keeps sending you patients, which is the only reason it exists.

The family practice office manager? We checked her account with her. The request was real, the EIN was already on file in her tax records, and the whole thing took under ten minutes once she knew it was safe. Then we locked down her login with two factor and set up monitoring so the next odd message is our problem, not her Tuesday afternoon panic. If you just got one of these requests and you are not sure, that is exactly the moment to ask someone who does this all day.