01 · Two different problems, one panic
Review bombing and review extortion get used as one phrase, and they are two separate things that go to two separate places inside Google. Bombing is the attack. Extortion is the demand that sometimes follows it. A burst with no demand attached is still bombing, and a single demand with no burst behind it is still extortion.
Why it matters practically: the demand is the strongest evidence you will ever have, because it is the one part of this the attacker wrote in their own words. Sending it through the ordinary review report throws it into a queue that has nowhere to read it.
The bombing
A block of one-star reviews lands in a short window, usually overnight, usually with little or no text. The accounts are new or empty, and none of them describe a visit that could have happened.
Where it goes
The ordinary policy report, one per review, under fake engagement or conflict of interest.
The demand
A message arrives asking for money to make them stop. It rarely arrives on Google. It comes through a messaging app, an email address, or a review whose text points at a profile picture with a number written on it.
Where it goes
Google's merchant extortion report, which a dedicated team reads. It does not touch any review's appeal.
02 · What the pattern actually looks like
Google described the pattern itself in its November 2025 fraud and scams advisory: bad actors flood a profile with fake one-star reviews, then contact the owner directly, often through a third-party messaging app, and demand payment, threatening that the reviews stay or the attack escalates if the fee is not paid (blog.google).
The reported cases follow it closely. According to the Philadelphia Inquirer’s reporting on the wave that hit Philadelphia restaurants in November 2025, one restaurant went to bed rated 4.8 and woke to 3.9 after 39 one-star reviews landed overnight, with the fortieth carrying an offer to remove them; the person behind it told the paper his fee was $250 (inquirer.com). The same report notes Google removed 11 of the reviews at that listing the following weekend.
The tells, in the order they are usually noticed:
- The window. A block of ratings arriving inside a few hours, on a listing that normally collects a handful a month.
- The silence. Ratings with no text, or text that describes a service you do not sell. In the Philadelphia case one review complained about cold delivery at a restaurant that only serves a tasting menu in the room.
- The accounts. New profiles, no photo, one or two contributions, often rating several businesses in the same trade and the same city on the same night.
- The contact. A number, a handle or an email arriving somewhere off Google, sometimes written into a profile picture to get it past text filters.
03 · The first hour
Everything that decides this case is visible right now and some of it will not be visible next week. If Google actions the accounts, their profiles go with them, and the pattern you were going to point at goes too.
- CaptureScreenshot every review with its date visible, and every reviewer profile with their other contributions on screen. Then screenshot the demand, with the sender's number or address and the timestamps in frame.
- CountWrite down how many arrived and in what window, and what your rating and total review count were before it started. That before figure is the baseline and nobody else has it.
- Do not replyNot to the demand, and not yet to the reviews. Google's advisory is explicit that engaging encourages further attacks, and a reply under each fake review pins the whole burst to the top of your listing.
- Leave the listing aloneNo rename, no category change, no pausing it. The listing as it stood is the baseline the burst is measured against, and changing it mid-case costs you that.
- Tell your teamOne person handles the messages and nobody else answers them. Attacks like this often arrive alongside calls, and a well-meaning reply from a colleague becomes the negotiation you were avoiding.
“To protect your business from negative review extortion, never engage with the bad actors or pay the ransom, as this only encourages further attacks. Instead, immediately report the malicious activity using the official merchant extortion report form, and be sure to preserve all records (screenshots, emails, chat logs) of their demands as evidence for law enforcement.”
Google, November 2025 fraud and scams advisory (blog.google)
04 · Where each piece goes
Google runs a report built for this one, published as Report negative review extortion scams on your Business Profile. A dedicated team reads it and it does not consume any review’s appeal, which is exactly why it should not be fired at an ordinary fake review with no demand behind it.
| What you have | Where it goes | Clause to name |
|---|---|---|
| A one-star review from an account that was never a customer | Report the review | Fake engagement and no-visit reviews |
| A burst that arrived in one window from unconnected accounts | Report each one, then one appeal carrying the strongest of them | Fake engagement and no-visit reviews |
| A message demanding money or free work to take them down | Google's merchant extortion report, with the screenshot | Harassment and hate speech |
| Reviews naming a member of staff, or carrying slurs | Report the review, and report the account from the Maps app | Harassment and hate speech |
| A pile-on triggered by a news story or a social post | Report each one and point at the trigger and its date | Off-topic content |
| One account hitting you and several businesses like yours | Report the profile rather than the reviews, from a phone | Conflict of interest |
One limit shapes the whole plan. Google’s appeal screen says you get one appeal, it can carry up to ten reviews, and its decision is final. In a burst of forty that is not a small detail: it means reports on all of them, and the one appeal spent on the ten with the clearest evidence rather than the ten that hurt most.
In the middle of one right now
Free audit: we read the burst and rank it before anything is filed
Paste your listing and we read the reviews against Google’s published policies, name the clause each one could be filed under, and say which ten are worth the single appeal. If Google keeps the review up, you owe nothing for it.
Run a free audit05 · Bombing with no demand attached
Plenty of bursts arrive with nobody asking for anything. A news story names you. A post about you travels further than expected. A local row, a political association, a decision a crowd disliked. The reviews that follow are written by people who have never been through your door, and that is precisely what makes them reportable: the rule they break is not that they are unfair, it is that they are not accounts of a visit.
The evidence here is unusually good, because the trigger is public. The post, the article, the thread and their timestamps are things Google can check without taking your word for anything, and the burst sitting in the window right after them is the argument. Put that in the appeal: the trigger, its date, and the count that arrived inside the hours that followed.
A pile-on also stops. A demand-driven attack usually escalates while it is ignored, a crowd-driven one decays, and the calculator on this site is a fair way to see whether the remaining damage is worth filing over at all once it has.
06 · What to say publicly
The instinct is to answer all forty. Do not: a reply under each one pushes the whole burst to the top of the listing, keeps it fresh, and tells whoever sent it that the hit is landing.
One short reply, on the most visible review, is usually enough. Keep it to what you can stand behind: that these ratings arrived in a single night from accounts with no record of a visit, that they have been reported, and that the business is open and running. Do not name a competitor, do not accuse anyone by name, and do not describe the attack in a way you would struggle to evidence later.
In regulated trades the confidentiality rules do not pause for an attack. A dental or medical practice replying publicly still cannot confirm that anyone was a patient, and during a bombing there is no one to confirm anyway. Our guide on replying covers the wording for both cases.
07 · What not to do
- Do not pay. Google’s advisory says it plainly, and the practical reason is worse than the money: a listing that pays is a listing worth attacking twice.
- Do not buy reviews to dilute it. The FTC’s consumer review rule covers buying and posting fake reviews, and it began issuing warning letters in December 2025 (ftc.gov). It is also the same signal Google is already hunting on your listing this week.
- Do not organise mass reporting. Volume is not the mechanism, and a wave of reports from unconnected accounts looks to Google’s abuse systems exactly like the manipulation they exist to catch. Google’s misuse policy also lets it stop reading requests from an account that files many weak ones, and that follows your account rather than the listing.
- Do not threaten the reviewer. Beyond what it does to the thread, the FTC rule reaches the use of intimidation and unfounded legal threats to get a review taken down.
- Do not spend the appeal on day one. Reports are uncapped and the appeal is not. File the reports, gather what the accounts do over the next few days, then spend it.
FAQ
Should I just pay to make it stop?
Google's own advisory answers this in its words: never engage with the bad actors or pay the ransom, as this only encourages further attacks. The practical version is that paying marks the listing as one that pays, and the second wave is aimed at a business that has already proved it will.
The demand came by WhatsApp, not on Google. Does the extortion report still apply?
Yes, and the message is the evidence. Google's advisory tells owners to preserve all records of the demands, naming screenshots, emails and chat logs, as evidence for law enforcement. Capture the thread with its dates and the sender's details visible before anything gets deleted.
Should I ask my regulars for five-star reviews to balance it out?
Asking customers for honest reviews is allowed, and offering anything in return for them is not. Worth knowing about the timing though: a sudden burst of positives during a wave of fake negatives is the same shape as the thing Google's systems are filtering for. Steady, ordinary requests do more good here than a rescue campaign.
Will my rating go back to where it was once Google removes them?
The average recalculates as reviews come off, and the displayed figure follows, though rounding decides whether the movement is visible. Our rating calculator runs that arithmetic on your own numbers before you spend anything on the problem.
Should I report it to the police as well?
Demanding money under threat is a crime in most places, and Google's own advisory tells owners to keep the records as evidence for law enforcement, which is a clear enough hint about where it expects them to go. What a case is worth in your jurisdiction is a question for a lawyer, not for us.
Can I threaten the reviewer with a lawsuit to get it taken down?
Be careful here. The FTC's consumer review rule covers the use of intimidation and unfounded legal threats to get a negative review taken down, and it carries civil penalties. A real defamation case is a lawyer's decision. A threatening message sent in the heat of a bad week is a separate problem you do not need.
They came back a week later. Is that normal?
It happens, and usually it is a new review from the same account rather than the old one returning. The difference decides what you file, because a new review gets its own report while a returning one does not get a second appeal.