Google Places API checks business presence for lender and merchant risk teams

Google Places API fields show available business checks

This week, you may be weighing an application whose bureau and registry checks leave one practical question: does the business appear at the address it declared? Text Search (New) takes the business name and declared address, then returns matching places.

Put the fields you need in the request’s field mask. The result adds a place record to the application, not a company record: it does not tie the place to a registration number, director or accounts, so the registry and bureau stay in the flow.

The fields fall into four Text Search billing tiers. The table lists each field and the information it holds:

A request is billed at its highest applicable SKU, so the selected fields determine the tier for that request.

SME lending checks whether a business is trading

For an SME application, compare the declared business name and address with a Google place to assess whether the business is trading at the stated address. In Google’s data, OPERATIONAL means the business is trading there, though it may not be open at that moment. CLOSED_PERMANENTLY raises a question about whether the business is still at the application address. When movedPlaceId is present, look up the place with that ID. Use these observations alongside the registry and bureau checks.

Compare the declared industry with primaryType and types when assessing whether the place description fits the application. A declared restaurant matched to a restaurant type is consistent. A declared wholesaler matched to a clothing-store type, or a place with no primary type, warrants human review. The comparison informs a referral, not an automatic conclusion about the business.

For declared retail trade, compare regularOpeningHours with the hours you would expect of a retailer. No listed hours, or hours a retailer would not keep, leave a point for review. A place open 24 hours appears as one period from day 0, hour 0. For public activity, userRatingCount is the review count, and rating is reviewers’ assessment of the place on a scale from 1.0 to 5.0. With three reviews, a lender has little public evidence to weigh. With eight hundred, the lender has a much larger body of public opinion to consider, whatever the rating.

BNPL onboarding checks a merchant before launch

Before you switch BNPL on at a merchant’s store, use its place status to distinguish a trading store from one that has not opened or has paused. Each status supports a different onboarding decision:

If consumerAlert is set, Google has detected suspicious review activity at the business or a policy violation. Read the store’s rating in that context.

Compare the store’s websiteUri and nationalPhoneNumber with the details the merchant entered during onboarding. Use the comparison to assess whether the submitted information matches and how much weight to give the reviews.

Fraud and KYB checks distinguish business address types

When an address returns only address types such as street_address, premise or subpremise, with no establishment, Google’s place data shows no business trading there unless the business serves customers at their own addresses. For a declared shop, coworking_space, business_center or shipping_service may indicate a virtual office or mailbox service. A claimed storefront at an apartment_building or housing_complex is a residential address, a different mismatch. Use the place record in the fraud review. Company registration and ownership remain questions for the registry and other checks.

A cleaning service or plumber may serve customers at their addresses and have no physical location on Google Maps. For the KYB rule, treat a business with pureServiceAreaBusiness set as a service-area business. Read the flag before referring an address with no establishment, so a service-area business is not treated as a shop expected to have a storefront.

Put these checks into a decision flow

Create rules for credit, fraud or collections, then run them on live decisions.

Start free See pricing

Collections checks guide visits and portfolio monitoring

For portfolio monitoring, keep the place ID from onboarding and use it to re-check the business’s current status and whether it has moved. Batch processing supports this portfolio pass and is used for pre-scoring customer portfolios. The result is a current observation, not a rating trend: a trend would require storing past ratings, which the terms do not permit.

Before a field visit to a business in arrears, check whether it is still trading at the address and whether it has moved. businessStatus informs whether the visit is still relevant, movedPlaceId points to the place to check next, and currentOpeningHours helps plan for when someone may be there over the next seven days. If the Places rule cannot settle the case, the referral can continue as case work with human review or external data tasks.

The following invented decision table is not a Places response. Its outcomes are examples a lender might set, not recommendations. The table uses first-match order:

The missing-value row sits above the numeric review-count row because a missing field can mean it was not requested, Google had no value, or the call timed out. A separate decision-table engine test on 2026-10-03 showed the risk: a row approving debt-to-income values between 0 and 35 also approved an applicant who had supplied no debt-to-income value, so a numeric comparison can read a missing count as zero and send the application down a rule intended for a low count. Row 3 comes before rows 4 to 7 so a plumber with no shop and no reviews is not referred for having neither.

Google Places API key for Places API (New)

A Google Places API key is a unique alphanumeric string that associates each request with a Google Cloud project and its billing account. Before using it, enable billing for the project and switch on Places API (New).

1. Use a Google Cloud project with billing enabled.
2. Enable Places API (New) for the project in the Google Cloud console, or run gcloud services enable "places.googleapis.com". Allow a few minutes before your first request.
3. On the Google Maps Platform Keys & Credentials page, choose Create credentials, then API key. In API restrictions, keep Places API (New) selected and clear the others. Choosing an API here does not enable it.
4. Add an application restriction, such as the IP addresses of the servers that call the key. An unrestricted key can call any Google Maps Platform service, and its account owner pays for abuse.
5. Send the key over HTTPS in the X-Goog-Api-Key header, and name the fields to return in X-Goog-FieldMask, as in the request below.

curl -X POST -d '{
  "textQuery" : "Bar Italia, 22 Frith Street, London"
}' \
-H 'Content-Type: application/json' \
-H 'X-Goog-Api-Key: API_KEY' \
-H 'X-Goog-FieldMask: places.id,places.displayName,places.businessStatus,places.primaryType' \
'https://places.googleapis.com/v1/places:searchText'

On 30 October 2026, a call without a key returned HTTP 403, status PERMISSION_DENIED: “Method doesn't allow unregistered callers (callers without established identity). Please use API Key or other form of API consumer identity to call this API.” Add the key header. An expired key returned HTTP 400, status INVALID_ARGUMENT, reason API_KEY_INVALID: “API key expired. Please renew the API key.”

Places API (New) is separate from Places API (Legacy), so enable it for the project and add it to the key. Google recommends a separate key for each when an app uses both. Places API (New) returns JSON only, and Text Search (New) requires a field mask.

Google terms shape Places API setup

Google’s Maps Platform terms set a general limit on storing place information. They state:

“Customer will not cache Google Maps Content except as expressly permitted under the Maps Service Specific Terms.”

The service-specific terms permit keeping the place ID and temporarily caching latitude and longitude for up to 30 consecutive calendar days, after which the coordinates must be deleted. They also restrict using Google Maps Content to improve machine-learning or artificial-intelligence models, and using Places API content with a non-Google map. Use without a map is allowed.

A separate credit restriction applies to decisions about individuals involving the Places Aggregate API, a different product. Your counsel can assess how that clause applies to your use of the Places API. The terms say:

“directly or indirectly results in any decisions, scoring, or assessments” about an individual relating to credit.

In Decisimo, keep the Places key in Credentials and have the data source refer to it. Configure Text Search (New) as a JSON POST data source with a field mask. A first call using Pro fields can handle the initial fraud and existence checks. For applications that pass, a second call can request Enterprise fields, using the first call’s place ID to look up the details. Caching starts off. If you enable it for a decision step, its destination must be customer-owned. Sources in the same step run in parallel, and a source that takes more than 15 seconds times out while the engine carries on.

The AI Assistant can propose a data-source configuration from an API description and request the key for Credentials. A person applies the proposal to fill the form, and that action does not save it. The field choices and caching still need to follow the terms.

What should lenders know about Places API checks?

What accuracy does Google Places publish for business status, types and opening hours?

Google publishes no country-level accuracy or coverage figures for business status, types or opening hours, and does not document how quickly a closure reaches businessStatus. The evidence here does not show that ratings, review counts or nearby competitors predict repayment or losses.

Should a type mismatch decline an application?

No. Treat a mismatch as a reason for a person to review the case, not as a verdict on the business.

What if Google returns no primary type?

Treat the missing type as a question for review. A place may lack a supported primary type, so its absence alone does not settle the application.

What does the review count add to a rating?

It shows how much public activity the rating rests on: a 5.0 on three reviews and a 4.2 on eight hundred reflect very different amounts of public activity.

Put these checks into a decision flow

Create rules for credit, fraud or collections, then run them on live decisions.

Start free See pricing