Intelligence — Original Research — September 2026
This article presents evidence-based intelligence connecting three documented phenomena: the theft of lockboxes during fake locksmith callouts, the disproportionate use of vacant and between-tenancy addresses for fake Google Maps listings, and a specific documented case of a block of riverside flats accessed by persons with locksmith knowledge, all locks changed, and the properties fraudulently advertised to prospective tenants. These three things are almost certainly connected.
Editorial note
This article connects documented evidence with a hypothesis derived from operational knowledge of the locksmith trade in west London. The connections described have not been confirmed by law enforcement. They are presented as intelligence for investigation by the National Trading Standards eCrime Team, the National Crime Agency, and journalists covering organised crime. All factual claims are sourced from publicly available Trustpilot reviews, Google Maps data, and direct professional knowledge of the trade. If you have information that supports or contradicts this hypothesis — contact us at locksmithscams.co.uk/report.html.
Three separate things have been observed and documented independently. This article joins them up for the first time.
Lockbox theft during fake locksmith callouts — documented on Trustpilot
Locksmith 24/7 (lock-smith.net — 514 Trustpilot complaints, 1.1 stars — legal entity confirmed as Top Lock and Key Services Ltd, east London) has a specific documented case of attempted lockbox theft during a callout. A vulnerable consumer who was in the process of moving home called the company to change their lock. During the job the operative attempted to steal the consumer’s lockbox — a key safe attached to the property. They were only stopped because the consumer’s removals team was present and caught them before they could leave. The consumer paid over £1,000 under pressure and subsequently reported the attempted theft to police. The operative gave a false name throughout.
The same Trustpilot page also documents a pattern of: operatives not providing receipts, VAT added after the price was agreed without prior disclosure, operatives commenting on the wealth of property owners during jobs, and phone numbers that change daily to prevent consumers identifying the company after the callout. A reviewer specifically identified the legal entity as Top Lock and Key Services Ltd based in east London, describing a centralised call centre model that uses local operatives to carry out jobs while presenting as a local business in each area.
Primary source: uk.trustpilot.com/review/lock-smith.net — 514 reviews including lockbox theft, VAT fraud, no receipts, and phone number rotation. Also documented: Locksmith 24/7 profile page →
Fake listings disproportionately use vacant, between-tenancy, and temporarily empty addresses
The locksmithscams.co.uk database documents over 90 fake locksmith listings in west London alone. The addresses used are almost universally residential or between-use commercial premises. Indian restaurants. Residential flats. Empty shop fronts. Business parks between tenancies. In every case the genuine occupant of the address has no connection to any locksmith business and in many cases has never heard of the listing at their address. The selection of these addresses is not random — vacant and between-tenancy properties are specifically useful because mail sent to them is unlikely to be noticed, challenged, or reported.
Block of riverside flats in west London — locks changed — properties fraudulently advertised to tenants
A specific incident documented by a locksmith with operational knowledge of the west London area: a block of riverside flats in the Chiswick area was accessed by persons with locksmith knowledge whilst temporarily unoccupied. All locks on the individual flat doors were changed. The properties were then advertised to prospective tenants — photographs taken, viewings conducted, deposits collected. When the genuine property owners attempted to access the flats they found themselves locked out of their own properties. The prospective tenants who had paid deposits had been defrauded. This is a separate criminal matter from fake locksmith listings — but the method of initial entry and the lock-changing expertise required points to individuals with locksmith skills and tools.
Until Google weakened postcard verification for Google Business Profiles, the process required a physical postcard to be sent to the claimed business address. The postcard contained a PIN. Entering the PIN verified the listing. A verified listing carries more ranking weight than an unverified one.
For a fake locksmith operator based overseas or in a different part of the country, this created a specific problem — they needed to receive a postcard at a real local address in the area they wanted to dominate. Their own address would not work — it is not local. They needed access to a local address where they could intercept incoming mail.
The hypothesis — step by step
Fake locksmith operative attends a callout at a property with a lockbox — Airbnb, rental property between tenancies, care client, property undergoing work.
During the callout — while the consumer is distracted paying, dealing with the door, or in distress — the operative steals the lockbox. The lockbox contains a key to the property.
The operative identifies the property as vacant or between tenancies — and therefore a suitable address for a Google Maps listing.
A Google Business Profile listing is created for a fake locksmith business at that address. Google sends a verification postcard to that address.
The operative uses the stolen key to access the property when vacant. They intercept the verification postcard. They enter the PIN. The listing goes live as a verified local business.
The address appears on Google Maps as a genuine verified local locksmith. The property owner never knows their address has been used. The postcard may have been delivered and removed before they saw it — or the property may have been vacant throughout.
The verified listing ranks in Google Maps for locksmith searches in that area. Consumers call. They are overcharged. The listing continues operating from an address that has no locksmith business at it.
This hypothesis explains why so many fake listings use residential addresses — specifically addresses that are temporarily vacant, between tenancies, or accessible via lockboxes. It also explains the specific theft of lockboxes documented on Trustpilot. It is not opportunistic petty theft. It is targeted acquisition of property access credentials for a specific criminal purpose.
The Chiswick riverside flats case is important for a specific reason. It demonstrates that individuals with locksmith knowledge and skills are engaged in property crime that goes far beyond overcharging for callouts. The method — accessing a vacant property, changing all locks, then using the property for a secondary fraud against prospective tenants — requires exactly the toolkit and skillset of a mobile locksmith operative.
The same individuals who attend fake locksmith callouts and overcharge consumers may also be using their access and skills for property entry, lock manipulation, and fraud against property owners and prospective tenants. The callout operation and the property crime operation may share personnel, tools, and infrastructure.
The criminal offences this hypothesis connects
Burglary — Theft Act 1968
Entering a building as a trespasser with intent to steal. If operatives are accessing vacant properties using stolen lockbox keys to intercept mail — that is burglary regardless of whether anything else is taken.
Theft — Theft Act 1968
Stealing a lockbox and its key during a callout. Stealing mail from a property. Both are theft.
Fraud by false representation — Fraud Act 2006
Obtaining Google Business Profile verification by entering a PIN intercepted from a property accessed without authorisation. Creating a verified business listing at an address where no business operates.
Fraud by false representation — Fraud Act 2006 (property fraud)
Advertising properties to prospective tenants and collecting deposits when the advertiser has no right to let those properties. Up to 10 years imprisonment.
Handling stolen goods — Theft Act 1968
Possessing and using a stolen lockbox and key.
Conspiracy to defraud — Common Law
If multiple persons are involved in coordinating these activities — which the organised network evidence strongly suggests — conspiracy charges apply across the entire operation.
If this hypothesis is correct — and the evidence strongly supports it — then Google's postcard verification process was not just inadequate as consumer protection. It was actively exploited as a mechanism for burglary and property fraud. The verification postcard created a criminal incentive to gain access to local addresses. The addresses selected were not random — they were specifically targeted for their accessibility and vacancy.
Google has since weakened postcard verification — replacing it with video verification in some cases and removing the requirement in others. But the listing addresses created during the postcard era remain live on Google Maps. The addresses remain in the fake listing database. And the operatives who accessed properties to intercept postcards may still have access to those properties through stolen keys that were never reported as missing.
If you are a property owner and a fake locksmith listing uses your address
You should immediately:
✓ Change all locks on the property. If a fake locksmith listing uses your address there is a possibility that an operative has or had a key to your property obtained through lockbox theft or unauthorised access.
✓ Check for signs of unauthorised entry. Look for evidence that someone has been in the property when it was vacant — disturbed mail, moved items, evidence of access.
✓ Report to your local police station. Give them the Google Maps listing URL and the Place ID. A locksmith operation using your address without your consent is fraud — and may be evidence of prior unauthorised access to your property.
✓ Report to Trading Standards — 0808 223 1133. Give them the listing details. Trading Standards can refer the property address issue to the NTS eCrime Team.
✓ Report the listing to Google Maps. Open the listing. Three dots. Report a Problem. False business address. Include that you are the property owner and have not consented to your address being used.
The addresses used by fake locksmith listings are not chosen randomly. Direct investigation — including physical visits to documented listing addresses and conversations with genuine occupants — has identified five specific categories of address being systematically targeted. Each category defeats a specific Google verification or spam detection mechanism.
1. Indian restaurants — confirmed by direct investigation
Indian restaurants are disproportionately represented as address anchors for fake locksmith listings in west London. ABS Locksmith Twickenham uses the address of an Indian restaurant on Heath Road TW1 — the restaurant owner was contacted directly and confirmed he has never heard of any locksmith company, has never authorised use of his address, and had no knowledge the listing existed. BobAckerman / Right Guy Locksmith Teddington uses 51C High Street Teddington — Prema Indian Restaurant. The pattern is consistent and deliberate.
Why this works: Restaurant addresses are stable, long-term, have active business presence visible on Street View, and restaurant owners running busy businesses are unlikely to notice or challenge a separate listing appearing at their address. The genuine restaurant listing gives the address credibility that a residential or virtual office address would not have.
2. Industrial park and business park rental units
Serviced office units and business park addresses are specifically designed to house multiple different companies simultaneously. A Google Maps listing at a business park unit does not trigger spam detection — it looks like a small business operating from a legitimate commercial address. The unit may be genuinely rented at a low monthly cost, or simply be an address harvested from business directory listings of available commercial space.
Why this works: Defeats the residential address check. A commercial unit address passes Google's basic legitimacy threshold. Multiple units at the same park allow multiple listings at distinct addresses from the same location.
3. Buildings undergoing extensive refurbishment — closed for extended periods
A building with scaffolding, boarded windows, and planning notices has no current occupant to notice, challenge, or report a fake listing at its address. The Street View imagery — often months or years old — may show the pre-refurbishment shopfront looking like a normal active premises. The building is physically empty throughout the listing's operation. By the time the refurbishment completes and new occupants move in — the listing has served its purpose, generated income, and possibly already been dissolved and replaced.
Why this works: Defeats the occupant complaint mechanism entirely. No one is there to report it. Google Street View shows an apparently active address. The listing operates without challenge for the full duration of the refurbishment.
4. Hijacked listings of closed or relocated businesses
When a genuine business closes or moves out of a unit its Google Maps listing becomes orphaned — no active owner managing it. Rogue operators identify these orphaned listings and claim or edit them, converting an established legitimate business listing into a fake locksmith listing. The hijacked listing inherits everything the original business built — verified address, listing age, existing reviews, photo history, and category signals. The new tenant who subsequently moves into the unit has no idea a fake locksmith listing is running at their address.
Why this works: Defeats new listing spam detection entirely. Google sees an established listing changing its service offering — not a new fake listing being created. The inherited verification history and review profile give immediate ranking credibility that a new listing cannot have.
5. Virtual office addresses — Companies House registration
Monomark House at 27 Old Gloucester Street London WC1N 3AX, Cavendish Square W1G, and similar premium London addresses are used by hundreds of shell companies for Companies House registration at £10 to £30 per month. No business operates physically from these addresses. They exist specifically to provide a credible London registration address for companies with no UK physical presence. UK Top Notch Services Ltd — documented on this site with a £1,602 invoice — is registered at Monomark House.
Why this works: Defeats the Companies House address check. A W1 or WC1 address with a prestigious postcode passes basic legitimacy checks that a residential address or obvious virtual office might not. Google accepts the Companies House number as a legitimacy signal without checking whether the registered address is a virtual office.
The address research layer — India-based listing management
Direct investigation has identified evidence that fake locksmith listing content — including photo uploads — is being managed remotely from India. A single India-based Google account was identified uploading photos to two different fake locksmith listings approximately three miles apart in west London simultaneously. This confirms a dedicated listing management layer operating remotely — researching suitable addresses, creating listings, uploading photos, responding to reviews, and refreshing content to maintain ranking signals. The Indian SEO management layer, the overseas call centre layer, and the UK-based operative layer are three distinct components of the same coordinated operation.
The lockbox theft model requires an actual callout — a consumer, a specific property, an opportunistic theft during a job. It is dependent on the right circumstances presenting themselves. A second postcard interception hypothesis is more scalable and requires no prior consumer contact at all.
Every operative in this network has lock picking skills. Opening a basic communal mailbox lock or a standard letter box takes under thirty seconds for someone with that training. A block of flats with a communal mailbox gives access to multiple addresses simultaneously — one visit, one picked lock, multiple verification postcards potentially interceptable.
The financial incentive — why the risk is worth taking
A single Google Maps fake locksmith listing — once verified and ranking — generates between £300 and £800 per successful callout. A busy listing may generate two to four callouts per day. At £500 average per job, four jobs per day, five days per week — one verified listing generates approximately £10,000 per week. Over a month — £40,000. Over a year — nearly £500,000 from a single listing.
Individual jobs documented on this site range from £238 to £2,802. The Maureen and Eric Reynolds case — both aged 85 — resulted in a single invoice of £2,802. UK Top Notch Services Ltd charged £1,602 for 45 minutes work on one job. A single verified listing capable of generating those amounts makes the risk of picking a mailbox lock or accessing a property to intercept a verification postcard — a risk carrying at most a minor criminal damage charge if caught — a commercially rational decision within the criminal calculus of this operation.
An operative willing to pick a lock to intercept a £2 postcard that enables a listing worth £500,000 per year is not acting irrationally. They are making a calculated risk assessment in which the upside vastly outweighs the downside. This is why the verification postcard model — and any verification system that relies on interceptable physical mail — is inadequate as a security mechanism for high-value local business listing verification.
Blocks of flats with communal mailboxes — west London concentration
TW1, TW2, TW7, TW8 have a high proportion of converted Victorian properties with communal hallways and multiple letter boxes accessible from inside the building. The fake listing concentration in exactly these postcodes — documented across the locksmithscams.co.uk database — is consistent with systematic targeting of communal mailbox addresses. One visit to a communal hallway gives access to ten or twenty individual letter boxes. Multiple verification postcards can be intercepted in one visit.
Timing intelligence — Royal Mail delivery patterns
Royal Mail delivery times are broadly consistent by route and publicly predictable. An operative who has identified a target address can establish the delivery pattern in one or two observation visits. Return on delivery day before residents collect mail. Open the mailbox. Remove the Google verification postcard. Replace any other mail. Leave. The resident never knows anything was taken because everything else is there. The Google postcard — a plain envelope indistinguishable from junk mail to most recipients — would not be missed even if the theft were discovered.
Connection to door sticker intelligence
Operatives placing fake locksmith stickers on communal entrance doors of blocks of flats — documented in the fake locksmith door stickers article on this site — are already inside communal areas. They already know the building layout, the mailbox locations, and the access patterns. A sticker placement visit and a mailbox assessment visit may be the same visit. The sticker identifies the building as a target property. The mailbox assessment identifies whether postcard interception is viable. Both activities require the same physical access to the same communal area.
Empty commercial units and buildings under refurbishment
Mail continues to arrive at empty commercial units and buildings under refurbishment even when no occupant is present to collect it. A verification postcard sent to an empty unit accumulates uncollected. An operative who picks the letter box lock — or simply removes a loose letter flap — retrieves the postcard with no risk of confronting an occupant. The postcard may sit there for days before collection becomes necessary. The risk window is extremely low.
The intelligence in this article is presented for investigation. The specific connections — lockbox theft, vacant property address selection, Google postcard interception, and the Chiswick riverside flats case — have not been confirmed by law enforcement as a connected operation. They are presented as a hypothesis that fits the available evidence and warrants investigation by agencies with the powers to obtain call records, postcard delivery records, and property access logs.
The locksmithscams.co.uk database contains Place IDs, phone numbers, and addresses for over 90 documented fake listings in west London. Cross-referencing those addresses against records of locksmith callouts in the same postcodes — available through call centre records obtained under legal process — could confirm or refute the postcard interception hypothesis.
If you are a journalist, investigator, or law enforcement officer and want to discuss the specific intelligence behind this article — contact us at locksmithscams.co.uk/report.html. All contacts are treated as confidential.
locksmithscams.co.uk — independent public interest resource. Published September 2026. The lockbox theft evidence is drawn from Trustpilot reviews of Locksmith 24/7 (lock-smith.net). The riverside flats case is drawn from direct professional knowledge of the locksmith trade in west London. The Google verification postcard hypothesis is original analysis. This article has been submitted to the National Trading Standards eCrime Team and the Competition and Markets Authority as supporting intelligence. Full database → Google’s role →
🔒 Need a genuine locksmith? Find an MLA approved operator near you.
✓ Find MLA Approved Locksmith →Related article
Romanian directors and UK fake locksmith shell companies — the documented pattern →Six confirmed Romanian directors. Fifteen shell companies. Tudor Gabriel Cerneanu: seven companies in five months. All sourced from Companies House public records.