Google review extortion and review bombing: what to do

Review extortion is a demand for money, a refund or something else of value, backed by a threat to post bad reviews or a promise to remove them. The right response is the same in almost every case: do not pay, keep every message, and report it. Google tells business owners in its help page on negative review extortion scams not to engage with or pay the people making the demand.

The two kinds of review extortion

Owners use the word for two different situations. They need different responses, so work out which one you have first.

A customer who threatens a bad review unless you pay

A real customer says they will post a one-star review unless you refund them, waive a bill or give them something free. Some have already posted and offer to take the review down once they get what they want. This person usually did buy from you, so any review they post describes a real visit or job.

A scammer who posts a wave of one-star reviews, then asks for money

A stranger, or a group, posts a burst of one-star reviews from accounts that were never your customers. Then they contact you and offer to remove the reviews for a fee, or threaten more if you do not pay. Google described this pattern in its November 2025 fraud and scams advisory: the attackers flood a profile with fake one-star reviews, then contact the owner, often through third-party messaging apps, to demand payment.

Is it an attack or just a run of bad reviews?

Bad reviews often arrive close together, so two in a weekend is not proof of an attack. In TrustReviews data, 36% of new one- and two-star reviews landed within 48 hours of another one on the same profile. That figure comes from 1,304 reviews we saw within 3 days of posting, on 406 Google profiles we monitor, between March and October 2026. Busy profiles get more reviews, so some of their clusters are coincidence, and we have not measured how much of the 36% is coincidence alone.

An attack looks different in size. In the same data, 11% of new negative reviews arrived on a day when that profile got 3 or more, and the largest number on one profile in one day was 6. The median profile we monitor has 121 reviews and 5 one-star reviews in its whole history (306,017 reviews on 1,106 profiles, October 2026). So 20 one-star reviews overnight is four times what a typical profile collects in all its years on Google. These profiles belong to businesses that came to a removal company, so they are not a random sample of Google.

Look for these signs together. One on its own proves little.

• A burst on one profile: many one-star reviews in hours or a day, after weeks of normal activity.
• New or empty accounts: reviewers with no profile photo, no other reviews, or reviews only of businesses far from you.
• No text, or the same short complaint in different words. Only 13.8% of one-star reviews on the profiles we monitor have no text, so a burst of rating-only reviews stands out.
• No match in your records: you cannot find the names in your bookings, invoices or call log.
• A message that arrives after the reviews, from someone you do not know, offering to remove them.

Most negative reviewers have a link to the one business they review. Of 21,500 people who left a one- or two-star review on a profile we monitor, 12 left one on more than one of our clients’ businesses. A scam group that opens new accounts for each target would not show up in that count, so the account history on your own profile is the better evidence. For rating-only reviews, see one-star reviews with no text. If the pattern points to a rival business rather than a scammer, read what to do when a competitor leaves fake reviews.

What to save before you do anything else

Scammers delete messages and accounts once they are reported, and reviews can disappear before you capture them. Google’s form asks for most of the items below, and law enforcement asks for originals. Work through this checklist the day the attack starts.

• Screenshot every message with the demand: email, text, WhatsApp, Telegram or social media. Show the date, the time and the sender’s number, address or username.
• Save emails as files with their full headers, not only as screenshots. IC3 asks for email headers when you have them.
• Copy the direct link to each review in the attack. On Google, the share button on a review gives a link to that one review.
• Screenshot each review with the reviewer’s name, the star rating, the date and any text visible.
• Open each reviewer’s profile and screenshot their other reviews, or the fact that they have none.
• Write down when you first noticed the reviews and when the first demand arrived.
• Record your rating and review count before the attack, from a recent screenshot or your monitoring email.
• Keep any payment details the scammer sent: an account number, a payment link, a crypto wallet address or a gift card request. Do not send anything to them.
• For a customer threat, keep the invoice, the job record and every message about the refund.

How to report review extortion to Google

Google announced a dedicated report for this in November 2025. Its help page, “Report negative review extortion scams on your Business Profile”, links to the merchant extortion report form. Google says the form is for owners who are directly subjected to an extortion attempt demanding money or favors in exchange for removing reviews. The form asks for:

1. Your contact details and your relationship to the business.
2. The business name, address and a link to the Business Profile.
3. The reviews you believe are part of the extortion, with a direct link to each.
4. How the third party contacted you and what they demanded, with their names, usernames, email addresses, phone numbers or social media profiles.
5. The dates and times you first noticed the reviews and received the demands.
6. Screenshots of every message with the demand, as attachments.

Google says its team investigates each claim and tells you the result, but for privacy and security reasons it does not share details of the investigation. Send one complete report with all the evidence rather than several partial ones.

Also report each review in the attack through Google’s Reviews Management Tool. Google’s Maps user-generated content policy names the grounds that fit an attack: under Fake engagement, content not based on a real experience and content posted from multiple accounts by or at the request of one person; under Rating manipulation, unusual volumes or patterns of reviews that indicate an effort to manipulate a place’s rating. If Google’s answer on a review is “Report reviewed - no policy violation”, you get one appeal, and one appeal can cover up to 10 reviews. Our guide to Google review appeal statuses explains each status, and how to report fake Google reviews covers the report itself.

What Google changed in April 2026

On 16 April 2026, Google published New ways we’re protecting businesses on Maps. It says its systems now detect the scam patterns of demands for payment to remove fake one-star reviews, and stop suspicious posts before they go live. When a surge of spam hits a profile, Google says it removes the fake content, pauses new reviews on that profile, alerts the Business Profile owner, and shows customers a banner that explains why contributions are paused.

The same post gives Google’s 2025 numbers: more than 292 million policy-violating reviews blocked or removed, posting restrictions on more than 782,000 accounts, and more than 13 million fake Business Profiles removed.

A pause during an attack is a protection for your profile. It is not the same as a restriction for fake engagement. Google’s page on Business Profile restrictions describes penalties for a business that collects fake reviews: new reviews blocked for a set period, existing reviews unpublished, and a warning to customers that fake reviews were removed. Google says it emails the owner before it applies a restriction, and the owner can appeal. If you receive that email during an attack, appeal and include the extortion evidence.

Why you should not pay

• Payment does not make the reviews go away for good. The scammer controls the accounts, so they can delete the reviews and post new ones next month.
• Payment marks you as a business that pays. Google’s November 2025 advisory says the attackers threaten that the reviews will stay up, or the attack will escalate, if a business does not pay. A business that pays once gives them a reason to come back.
• Payment buys nothing from Google. Only Google removes a review that breaks its policy, and the scammer has no say in that decision.
• Paying a customer to remove a review breaks Google’s rules. The Maps user-generated content policy does not allow merchants to offer incentives, such as payment, discounts or free goods or services, in exchange for the revision or removal of a negative review.
• Paying a customer can also create risk with the FTC. In its Consumer Reviews and Testimonials Rule questions and answers, the FTC says the rule itself does not ban offering incentives to take down negative reviews, but such incentives could be an unfair practice in violation of the FTC Act.

A customer threatening a bad review unless you refund

Decide the refund on its merits, as you would if no review had been mentioned. If the customer is owed a refund under your terms, give it, and do not attach any condition about the review. If they are not owed one, say so in writing, once, politely. Do not offer a refund in exchange for removing or changing a review.

If the customer then posts a review, it describes a real experience, so it usually stays up unless it breaks a specific policy: personal information, threats, hate speech, or content that is off-topic. Reply to it briefly and factually; how to respond to negative reviews covers what to write and what not to write.

A demand like this is usually a civil dispute, not a crime. Whether it counts as extortion under criminal law depends on your state and the exact words used. If the customer threatens harm to you, your staff or your property, that is a matter for the police.

What the FTC Consumer Review Rule says about threats

The FTC Consumer Review Rule, 16 CFR Part 465, took effect on 21 October 2024. It regulates businesses, not the people who extort them. Section 465.7 bars a business from using an unfounded or groundless legal threat, a physical threat, intimidation, or a public false accusation to stop a review or get one removed. So a reply that calls a real customer a liar, or a letter that threatens a lawsuit you have no basis for, can itself break the rule. Violations can bring civil penalties of up to $53,088 per violation, the figure the FTC gave when it warned 10 companies in December 2025. Our guide on how to respond to negative reviews covers what the rule allows a reply to say.

With a scammer you have no reason to send a threat at all: report them and stop contact. With a customer, keep every message factual. This is general information, not legal advice. If you are thinking about a lawsuit, speak to a lawyer licensed in your state, and read can you sue for a fake review first.

When to involve the police or the FBI’s IC3

• If anyone threatens violence against you, your staff or your premises, call 911 or your local police first.
• If a stranger demands money to remove reviews, file a complaint with the Internet Crime Complaint Center (IC3). The FBI runs IC3 as its hub for reports of cyber-enabled crime, and anyone who believes they are affected by one can file.
• If you paid before you knew better, file with IC3 and include the payment details: account, date and amount. Tell your bank or card provider at once.
• If the scammer is local or you know who they are, file a report with your local police as well and keep the report number with your evidence.

Know what to expect from IC3. Its FAQ says it does not investigate complaints itself; its analysts review them and pass information to law enforcement and partner agencies. It does not accept attachments, so keep your originals in case an agency asks for them. It also says you will not hear from IC3 about the status of a complaint, and that IC3 will never contact you directly for information or money. A message that claims to be from IC3 and asks for payment is another scam.

How TrustReviews helps during an attack

An attack is easier to deal with when you see it on the first day. Our review monitoring reads each connected Google Business Profile about once a day and sends one daily email that lists new 1 and 2 star reviews across all your profiles. Your account manager sees each new low review at the same time. The Review Auto-filer goes further: it reads covered listings about every 6 to 7 hours and files every new review of 2 stars or below published in the last 14 days, within a monthly limit of 1 to 30 paid removals that you set.

You connect your profile in the TrustOS portal by searching its name or pasting a Google Maps link. You choose which reviews we file, and you see the price and accept the terms in the app before anything is filed. Our filing team files each review with Google under its own policy, and Google makes the final decision on each one. We file all your bad reviews. You pay for the ones that come down. If you have 10 or more bad reviews, the app offers a free 15-minute planning call with your account manager. If a removed review comes back, we file it again at no charge.

We never contact the reviewers, and we never post or buy reviews. A message from someone who posted the reviews and offers to remove them is extortion, whatever it calls itself. Our guide to review removal scams lists how to tell a legitimate service from a scam, and the Google review removal page explains our process in full.