“Lead theft” gets thrown around loosely in home services. Sometimes it means a competitor literally rerouting your phone calls. Sometimes it means a lead company you signed up with reselling the same lead to four of your competitors — which is annoying but legal, and which you agreed to. The first step to fighting back is telling the two apart, because the playbook is completely different. Let’s separate the legal-but-annoying from the deceptive from the outright illegal — then go fix the real theft.
What’s legal (even if it feels like theft)
Pay-per-call and shared-lead companies — the eLocals, Service Directs, and the lead side of Angi/HomeAdvisor — buy clicks, run their own ads, and resell the resulting calls and form fills, often to several contractors at once. You feel robbed when a “your area, exclusive” pitch turns into a lead three competitors also bought. That’s not theft; it’s the business model, and it’s usually spelled out in the terms you accepted.
There’s a real line, though. In 2023 the FTC ordered HomeAdvisor to pay up to $7.2 million for deceptively marketing the quality and source of the leads it sold. So lead resale itself is legal; lying about what those leads are can cross into deceptive practice. The lesson for owners is narrower than “lead companies are crooks”: read the exclusivity terms, track close rates by source, and drop the resellers that don’t pay back. The fix for legal-but-bad leads is economics — knowing your cost per booked job by channel — not a lawyer. Wiring up that visibility is exactly what conversion tracking is for.
What’s deceptive: clone sites and brand-jacked ads
This is where it tips from competition into theft.
Clone websites. Someone copies your site — text, photos, layout, sometimes your name with one letter changed — swaps in their phone number, and runs ads to it. Homeowners think they called you. Copying your actual content is copyright infringement; copying your registered name or logo is trademark infringement.
Brand-jacked Google Ads. A competitor bids on your business name so their ad shows when someone searches for you. Here’s the honest nuance most “they’re stealing my brand!” posts get wrong: bidding on your name as a keyword is allowed under Google’s policy. What’s not allowed is using your trademarked name in the ad text in a way that implies they are you. The first is fair game; the second is a policy violation you can act on — but cleanly only if you actually own the mark.
Fake/hijacked listings. A bogus Google Business Profile at a fake address in your city, or — worse — an attacker who claims or edits your listing and points the phone number at themselves. This is the highest-leverage theft because it intercepts calls at the exact moment of intent.
What’s illegal: call hijacking and number swaps
The crudest version is physical and local. A competitor slaps a sticker with their number over your yard sign, truck wrap, or sticker on a serviced unit — so a homeowner reading your branding dials them. Or a fake listing reroutes your calls. When someone covers your identity so a caller who means to reach you reaches an impostor, that’s deceptive and can rise to impersonation.
Since April 1, 2024, the FTC’s Impersonation Rule (16 CFR Part 461) has been in effect, reaching a party who materially and falsely poses as your business or implies they are you. The maximum civil penalty is adjusted annually for inflation — $53,088 per violation as of 2025 (it was $51,744 when the rule first took effect). Two honest caveats: the FTC enforces this rule itself — there’s no private right of action, so you can’t sue under it, and it builds cases from patterns, not single complaints. So filing matters, but treat it as one input, not your remedy. Your faster levers are a cease-and-desist letter, a police report (sticker tampering can be vandalism or theft), and tight documentation.
A note owners hate to hear: call hijacking is often an inside job — a departing tech who still has your phone-system login forwarding calls to himself, or a subcontractor swapping a sticker. Who controls your call forwarding, GBP login, and number-routing is a security question, not just a marketing one. Revoke access the day someone leaves.
Detection: you can’t fight what you can’t see
Most owners discover theft months late because they had no instrumentation. Build the smoke detectors first.
- Run call tracking, but mind your NAP. Tag every call and form by source so a sudden drop stands out, and watch your Google Business Profile call history for the listing’s own call volume. One caution: swapping in dynamic tracking numbers can clash with NAP consistency and disrupt GBP’s native call data — set it up the supported way so you don’t hurt your own local SEO while hunting for thieves. Our call-tracking approach is built around that tradeoff.
- Search yourself weekly. Google your business name and look at Maps. A second profile at your address, a clone site, or a competitor’s ad in your brand result is theft you can see in thirty seconds.
- Watch the money, not the vibe. A real drop shows up as leads-per-dollar falling with no ad or seasonal cause. That’s the difference between a slow week and an active leak — and you only see it if your numbers are wired up.
The takedown playbook (mostly free)
Match the remedy to the channel:
| Theft type | Where to report | What you need |
|---|---|---|
| Fake/hijacked Google listing | Maps “Suggest an edit” → “Remove this place”; Business Redressal Complaint Form | Screenshots, your verified profile, evidence |
| Clone website (your content) | DMCA takedown to the web host (registrar only if same company) | Proof you own the original |
| Your name in a competitor’s ad text | Google Ads trademark complaint form | Registered USPTO trademark |
| Brand name in their domain | UDRP or ACPA (court) | A trademark the domain copies |
| Sticker / call hijacking | Cease-and-desist; police report; ReportFraud.ftc.gov | Photos, dates, witnesses |
A few specifics that trip people up:
- Listings: report from a position of strength — claim and verify your own Google Business Profile first. An unverified or unclaimed profile is the single easiest thing for an attacker to hijack or silently edit, so “who controls the verified profile” is the whole game. Use Maps → Suggest an edit → Remove this place on the fake one, then file the Business Redressal Complaint Form with evidence.
- Clone sites: the DMCA goes to the web host, where the page actually lives — a registrar that isn’t also the host generally can’t remove a page, so it’s a fallback (and only worth it when host and registrar are the same company, e.g., GoDaddy or Namecheap). Find both via WHOIS/RDAP — note that since GDPR and the 2025 shift from WHOIS to RDAP, the owner’s name is usually redacted, but the registrar and host you need for an abuse report are still visible.
- Domains using your name: UDRP requires you to own a trademark (registered, or a strong common-law one) that the domain copies — it isn’t a standalone option for an unregistered business name. The US statutory route, the Anticybersquatting Consumer Protection Act, can award damages (UDRP only transfers the domain) but means court.
The single best prevention: register your mark
Almost every strong remedy above — the Google Ads trademark complaint, UDRP, the cleanest infringement claims — is far stronger, or only available, with a registered USPTO trademark on your name and logo. It’s the highest-leverage proactive step in this whole article, and most contractors skip it. Pair it with the basics: claim and verify your GBP, lock down who has login and call-routing access, keep your local SEO and citations consistent so your real listing outranks impostors, and don’t forget Yelp — its Request-a-Quote resells leads and parks competitor ads on your page, and a hijacked Yelp listing is the same problem in a different parking lot.
And know your local escalation path. The FTC is slow on individual cases, but state UDAP/deceptive-practices laws and your state Attorney General are often far more responsive for a single small business getting actively ripped off.
The bottom line
Most “lead theft” is legal lead resale you can fix with better economics — track cost per booked job by channel and drop what doesn’t pay. The real theft — clone sites, brand-jacked ad text, hijacked listings, number-swap stickers — is detectable and, mostly for free, beatable: verify your profile, register your mark, instrument your calls, and report with evidence to the host, Google, or your state AG.
If your calls are dropping and you can’t tell theft from a slow month, that’s exactly what a growth audit surfaces — see our conversion tracking and local SEO work.