One unique method is working exclusively with a local plumber, electrician, etc and HAVING THEM get you the addresses while you retain control of the GBP entity and sell them the leads.
The pitch goes like "you've seen the success I've had getting other clients tons of leads right? Get me 3-4 addresses in the cities you want to target and I can get them ranked" The client then asks around, uses their own address, etc to find them for you.
Related: I submitted edits for some of the businesses (marking them "Doesn't exist") and Google rejected the edits. My Maps contribution history says "NOT APPLIED - Google couldn't verify your edit" for a long list of fake businesses. If that's how they process reports - about new businesses with obviously anomalous reviews - it's no wonder this continues.
Using volunteer reports for anti-spam doesn't work because the spammers play a numbers game, and perhaps only 10% will be reported by a good citizen like you.
(Google Maps PMs, if you're reading this: feel free to contact me to hear my experience. There are some seemingly simple, low-false-positive ways to improve reporting of fake businesses and accounts.)
That being said, it's very fragile. The above friend was very well reviewed (300+ >4.5 stars) and popular in his market. He told me recently Google suspended him and it destroyed his business for a bit. Not sure if he's back up but he seems to be doing better now.
- Google stopped doing postcard verification, or a loophole in the creation process lets savvy scammers avoid it (like an alternate verification method or providing a different address for the postcard).
- New business entries go live before the postcard verification, and that period is long and lucrative enough to be worth exploiting.
- They're paying local property owners to accept a postcard and read them the number - postcard mules. That seems hard to scale as big as some of these networks. Two of the "chains" had dozens of locations in one metro, all seemingly created in the same month or so. Also, some of the addresses seem like multi-unit commercial buildings where one person wouldn't receive a postcard.