"Pay $500 or I will post 20 one-star reviews on your Google page."
This message is not hypothetical. It landed in a Chicago restaurant owner's inbox in March 2026.
Review extortion is rising. Google removed 292 million reviews in 2025, but their enforcement engine catches individual fakes -- not coordinated attacks. A single bad review is manageable. Twenty in one day can drop your rating by half a star and push you off the Local 3-Pack overnight. In January 2026, Google launched a dedicated merchant extortion reporting tool. This guide covers what review bombing looks like, how extortion works, and the hour-by-hour playbook to protect your business when it happens.
Review bombing vs fake reviews: why it is different
A fake review is a single fabricated opinion -- one person, one lie. Review bombing is a coordinated assault: multiple accounts posting multiple negative reviews in a short window, designed to crater your rating through sheer volume.
| Dimension | Fake review | Review bombing |
|---|---|---|
| Scale | 1-3 reviews | 10-50+ reviews in 24-72 hours |
| Intent | Competitor sabotage or personal grudge | Destroy rating fast enough to cause financial damage |
| Pattern | Random timing, varied accounts | Clustered timing, new/low-activity accounts |
| Google response | Individual appeal (3-7 day review) | Escalated case possible with pattern evidence |
| Recovery time | Days | Weeks to months without intervention |
The reporting process is different because the threat is different. Individual fake reviews get reported one by one. Bombing requires pattern evidence, timestamps, and often a police report to trigger Google's escalated review process.
The 3 types of review bombing attacks
Competitor-driven bombing
A rival business -- or a service they hired -- posts coordinated 1-star reviews to drop your rating below theirs. The reviews often describe real-sounding but fabricated experiences. Common in competitive local markets where a 0.2-star difference determines who shows up in the Local 3-Pack.
Detection signal: Multiple reviews within 48 hours from accounts that have also reviewed your direct competitors positively.
Extortion (pay-or-bomb)
Someone contacts you -- via email, DM, or even a Google review itself -- demanding payment in exchange for removing or not posting negative reviews. The amounts range from $200 to $5,000. Some extortionists follow through. Others bluff. The threat itself is a crime in most jurisdictions.
Detection signal: Written demand linking payment to review removal. This is your strongest evidence -- screenshot and preserve it immediately.
Viral mob (social media pile-on)
A negative incident goes viral on TikTok, Reddit, or X. Thousands of people who have never visited your restaurant flood your Google profile with 1-star reviews. The reviewers are real people with real accounts -- but they have never been customers. This is the hardest type to fight because Google's systems see real accounts, not bots.
Detection signal: Sudden review spike correlated with a social media post. Reviews reference the viral content rather than personal dining experience.
Google's 2026 extortion reporting tool
In January 2026, Google quietly launched a dedicated form for merchants reporting review-related extortion. This is separate from the standard "Report review" button and triggers a different -- faster -- review process.
- 1
Navigate to Google Business Profile Manager
Sign in to the Google account that manages your Business Profile.
- 2
Open "Support" → "Contact us"
Select "Reviews and photos" → "Manage reviews" → "Review extortion or blackmail."
- 3
Submit evidence
Upload screenshots of the extortion message (email, DM, text, or review containing the demand). Include timestamps.
- 4
Provide timeline
List the dates and times of the bombing reviews. Google correlates these with the extortion message timestamp.
- 5
Request callback
Select the phone callback option. Extortion cases handled via callback are resolved 3x faster than email-only submissions (based on merchant reports in Google Business Profile forums).
Typical resolution: 5-10 business days for extortion cases with clear evidence. Standard fake review appeals take 14-21 days. The extortion pathway is faster because Google treats it as a terms-of-service violation by the reviewer, not a content dispute.
Google will not tell you who the extortionist is, even if they identify them. They will remove the reviews and may ban the associated accounts, but they will not share account details with you. For identification, you need law enforcement involvement.
72-hour defense playbook
When you discover a bombing attack, the first 72 hours determine how much damage sticks. Here is the hour-by-hour response:
Hour 0-1: Document everything
- Screenshot every suspicious review (full review + reviewer profile)
- Screenshot any extortion messages (email, DM, text, review)
- Note the exact timestamps of each review
- Export your current Google review history (GBP Manager → Reviews → Download)
- Save a copy of your current star rating
Hour 1-4: Respond publicly
- Reply to every bombing review with a calm, professional response
- Template: "We have no record of your visit on [date]. We take all feedback seriously. If you did visit us, please contact us at [email] so we can address your experience."
- Do NOT accuse reviewers of being fake in the reply -- this looks defensive to other readers
- Do NOT mention extortion publicly -- this can tip off the attacker and complicate legal proceedings
Hour 4-12: File reports
- Report each review individually via the standard "Report review" button (flags content for Google)
- File an extortion report via Google's dedicated merchant tool (if applicable)
- File a police report if extortion is involved -- review extortion is criminal in the US (18 USC § 873), UK (Theft Act 1968 § 21), EU, and most other jurisdictions
- Contact Google Business Profile support via phone callback for escalated handling
Hour 12-72: Protect and rebuild
- Post a brief statement on your social media: "We are aware of a coordinated review attack and are working with Google to resolve it"
- Encourage genuine recent guests to share their experience (not "leave a review to counter the fakes" -- that violates policy)
- Monitor for new bombing reviews -- attackers sometimes send waves over multiple days
- If you have legal counsel, send a cease-and-desist to any identified extortionist
Detection: how to spot a bombing early
The difference between catching a bombing at 5 reviews and catching it at 25 reviews is the difference between a minor dip and a rating crisis. Early detection requires monitoring three signals:
Velocity anomaly
Your baseline is 3 reviews per week. Suddenly you receive 8 in one day. Any spike above 3x your weekly average within 48 hours warrants investigation.
Reviewer profile patterns
Bombing accounts tend to share characteristics: created recently, few or no other reviews, no profile photo, generic display names. A cluster of these profiles reviewing you in the same window is a red flag.
Content analysis
Bombing reviews are often vague ("terrible experience," "worst restaurant ever") or describe experiences that do not match your business (wrong cuisine, wrong location details). They rarely mention specific dishes or staff interactions.
ReviewTactic monitors your review velocity in real time. When new reviews arrive at abnormal rates, you get an alert before the damage compounds. The system also flags reviews from accounts with no review history -- the signature pattern of both bombing and extortion attacks.
Legal options that actually work
| Action | When to use | Why it works | Cost |
|---|---|---|---|
| Police report | Extortion demand exists (written or verbal) | Review extortion is criminal. A police report number strengthens your Google appeal and opens the door to law enforcement subpoenaing Google for account information. | Free |
| Cease-and-desist letter | Extortionist identity is known or suspected | Creates a paper trail and often stops the attack. Most extortionists are opportunistic -- legal pushback scares them off. | $200-500 from a business attorney |
| Small claims court | Demonstrable financial damage from fake reviews | No attorney needed. File in your jurisdiction. The cost of defending discourages most attackers. | $30-100 filing fee |
| FTC complaint (US) | Organized fake review service involved | The FTC Consumer Review Rule (Oct 2024) allows penalties up to $53,088 per violation. Complaints build the enforcement pipeline. | Free |
Do NOT try to fight bombing by posting your own fake positive reviews. This violates Google's policy, and Google's detection systems will catch both the bombing reviews AND your defensive fakes. Two wrongs make your situation significantly worse.
What Google will and will not do
Google will
- Remove reviews that violate content policies (spam, conflict of interest, off-topic)
- Investigate extortion reports filed through the dedicated merchant tool
- Ban accounts associated with coordinated review manipulation
- Expedite cases with police report numbers attached
Google will not
- Reveal the identity of reviewers or extortionists to you
- Guarantee removal timelines (even escalated cases take 5-10 business days)
- Remove reviews that are critical but technically policy-compliant
- Proactively detect bombing -- you must report it; their systems catch patterns but not intent
- Compensate you for lost business during the attack
Expect 60-70% removal rates for clearly coordinated bombing reviews with evidence. The remaining 30-40% may survive if the individual reviews do not violate policies on their own, even if the pattern is suspicious. This is why early detection and rapid reporting matter -- each hour of delay means more reviews that may become harder to remove.
Prevention checklist
Monitor review velocity daily
Any spike above your weekly baseline deserves a look. Automated monitoring catches what manual checking misses.
Respond to every review within 24 hours
Active profiles recover faster from bombing. Owner responses also reduce false-positive removals of legitimate reviews by 73.7%.
Secure your Google Business Profile
Enable 2-factor authentication. Verify your business ownership. Remove any ex-employees from profile management access.
Maintain a review response cadence
Profiles with consistent response histories are treated more favorably by Google's trust algorithms during disputes.
Keep records of all customer communication
If an extortion attempt arrives, your documentation of legitimate customer interactions helps Google distinguish real from fake reviews.
ReviewTactic automates the monitoring and response parts of this checklist. Every new review triggers a notification. AI-generated response drafts in your brand voice ensure no review goes unanswered, even during a crisis.
Detect review attacks before they damage your rating
ReviewTactic monitors your reviews in real time and alerts you to velocity anomalies. Respond faster than the attacker can post.
Start monitoring freeReview bombing is not about reviews. It is about protecting your business from people who exploit the trust system that Google reviews represent. The merchants who recover fastest are those who detect early, document everything, and use every available channel -- Google's tools, law enforcement, and legal options -- simultaneously.
Related reading
Fake Google reviews: 8 ways to remove them
The violation categories Google acts on and the appeal format that works.
Google review purge 2026: 292M removed
What changed in Google's enforcement and how to stay compliant.
Negative reviews: triage and response guide
The 4-step framework for turning bad reviews into recovery moments.
Review velocity and ranking impact
Why fresh reviews outrank old ones and monthly benchmarks to target.