Google review extortion: what to do when someone bombs your rating and demands payment

It usually starts on a quiet afternoon. Four one-star reviews land inside an hour, from accounts you've never seen, describing things that never happened. Sometimes the complaints don't even match your industry.

Then a message arrives. WhatsApp, Telegram, or a plain email. The sender explains that the reviews were paid for, and that they can be removed — for a price. Often a few hundred pounds or dollars. Sometimes a hundred per review.

This is review extortion, and over the past two years it has gone from a rare curiosity to one of the most common attacks on small local businesses. Dog trainers, dentists, pharmacies, landscapers, moving companies, car showrooms. The scammers aren't targeting you because of anything you did. They're targeting you because your rating is worth money to you and costs them nothing to damage.

Here is exactly what to do.

How the scam works

The pattern is consistent enough to be a checklist:

• A cluster of 1-star and 2-star ratings arrives in a short window, typically 24 to 72 hours.
• The reviewing accounts have thin or empty histories. Frequently their only contribution to Google Maps is the review they just left on you.
• The complaints are generic, or oddly specific about things you don't sell. A pharmacy receiving complaints about overpriced vehicles in poor condition is a real reported case.
• Shortly afterwards, contact arrives — usually an overseas number, a brand-new social account, or an anonymous email.
• The demand is framed as a service. They aren't extorting you; they're "offering removal." Some will post a sample review first to prove they can.
• If you refuse or ignore them, a second wave often follows.

If you recognise this shape, you are not dealing with a customer service problem. You are dealing with a security incident, and it should be handled like one: preserve evidence, don't engage, escalate through official channels.

Why this is happening now

Three things converged.

Fake Google accounts are cheap and quick to create, so the cost of launching an attack is close to zero. Your rating, meanwhile, is worth more than it has ever been — star averages feed Google Maps ranking, local pack placement, and increasingly the answers AI assistants give when someone asks for a recommendation near them.

And small businesses are the ideal target. They depend heavily on reviews, they can't absorb a drop from 4.8 to 4.2, they can't wait three weeks for an investigation, they're easy to pressure emotionally, and most owners have no idea what the correct response is. The scammers are not guessing at that vulnerability. They're pricing it.

Why you must never pay

Every instinct will tell you to make it stop. Resist it.

Paying does not end the attack. It identifies you as a business that pays. The people running these operations work from lists, and a confirmed payer is worth far more to them than a fresh target — you will very often be hit again, sometimes within weeks, sometimes by a different crew who bought your details.

Paying also weakens your position with Google. The demand itself is the clearest evidence you have, because extortion is an unambiguous policy violation in a way that "this review seems fake" is not. Reviews that Google might otherwise leave in place become removable the moment you can show they were part of a ransom attempt. Negotiating muddies that record.

And there is nothing to enforce. There is no contract, no recourse, no reason for someone already committing fraud to keep their word.

Do not pay. Do not counter-offer. Do not ask whether a smaller amount would work. Do not reply at all beyond what you need to capture as evidence.

What to do, step by step

1. Preserve everything before you touch anything

Screenshot each review with its timestamp and the reviewer's profile. Screenshot the entire message thread, including the sender's number, handle or address, and the timestamps that show the demand arrived after the reviews. Save it somewhere outside the platform it arrived on — accounts get deleted, and Telegram messages can vanish.

The pairing of timing and demand is your case. Assemble it as a single document.

2. Report the extortion, not just the reviews

This is the step most owners miss. Google introduced a dedicated merchant extortion report form in late 2025 precisely because the ordinary review-flagging flow wasn't built for this. Use it. It routes your case to people who handle exactly this pattern, and it accepts the context the standard dropdown has no room for.

Google's own guidance is blunt on this point: do not engage with or pay the people demanding money.

3. Flag each review individually as well

There is no bulk flag, and each report creates its own record. Where the option fits, categorise them as fake engagement rather than defaulting to spam. Reference the extortion case in your documentation.

4. File a police report

Whether or not local police can act, the report is a dated official record that this happened. It costs you an hour and it materially strengthens every escalation that follows.

5. Block and stop responding

Once you've captured the evidence, block the contact. Continued engagement gives them information and gives you nothing.

If you run more than one location

Attacks on multi-location businesses are harder to spot, and that delay is the real damage. When reviews arrive constantly across a dozen sites, a coordinated 1-star spike at one branch looks like noise until the average has already moved.

Two things matter here. First, monitoring that surfaces an anomalous drop at a single location quickly, rather than a monthly average across the estate. Second, one central playbook rather than each manager improvising — because the branch that panics and pays creates a target for every other branch you run.

What to say publicly while you wait

Removal takes days at best. Your prospective customers are reading right now.

Reply once, briefly, beneath the reviews. Something close to: "We have no record of this person as a customer, and we've reported these reviews to Google for verification." Calm, factual, no accusations, no detail about the extortion attempt.

That does two jobs. It tells the next reader the reviews are disputed, and it shows anyone scrolling that a real person runs this business and is paying attention. A measured reply under an obviously baseless review is often more persuasive than the removal would have been, because removal is invisible and a good response is not.

Do not argue with the reviewers. Do not publish anyone's phone number or personal details, which is a policy violation on your side.

The defence that works before the attack

Everything above is damage control. The variable that actually decides how much an attack hurts is settled long before it happens.

Twenty fake one-star reviews land on a business with fifteen genuine reviews and the rating collapses. The same twenty land on a business with three hundred genuine reviews, eleven of them from the past month, and the average barely twitches — the fakes are buried by real ones within days, and anyone who reads them sees them surrounded by hundreds of contradicting accounts.

Same attack. Completely different outcome. The only difference is how much genuine review volume was already there.

That is the part you control. You can't stop someone from deciding to target you, and you can't guarantee Google removes anything. You can make sure that when it happens, the arithmetic is on your side.