Review Bombing Protection Guide

"Pay $500 or I will post 20 one-star reviews on your Google page."

This message is not hypothetical. It landed in a Chicago restaurant owner's inbox in March 2026.

Review extortion is rising. Google blocked or removed 292 million reviews in 2025 (see how much fake content platforms catch), but their enforcement engine catches individual fakes -- not coordinated attacks. A single bad review is manageable. Twenty in one day can drop your rating by half a star and push you off the Local 3-Pack overnight. In January 2026, Google launched a dedicated merchant extortion reporting tool. This guide covers what review bombing looks like, how extortion works, and the hour-by-hour playbook to protect your business when it happens.

Review bombing vs fake reviews: why it is different

A fake review is a single fabricated opinion -- one person, one lie. Review bombing is a coordinated assault: multiple accounts posting multiple negative reviews in a short window, designed to crater your rating through sheer volume.

Dimension	Fake review	Review bombing
Scale	1-3 reviews	10-50+ reviews in 24-72 hours
Intent	Competitor sabotage or personal grudge	Destroy rating fast enough to cause financial damage
Pattern	Random timing, varied accounts	Clustered timing, new/low-activity accounts
Google response	Report, then appeal each rejected review (Google says evaluation typically takes several days)	Escalated case possible with pattern evidence
Recovery time	Days	Weeks to months without intervention

The reporting process is different because the threat is different. Individual fake reviews get reported one by one. Bombing requires pattern evidence, timestamps, and often a police report to trigger Google's escalated review process.

The 3 types of review bombing attacks

Competitor-driven bombing

A rival business (or a service they hired) posts coordinated 1-star reviews to drop your rating below theirs. The reviews often describe real-sounding but fabricated experiences. Common in competitive local markets where a 0.2-star difference determines who shows up in the Local 3-Pack.

Detection signal: Multiple reviews within 48 hours from accounts that have also reviewed your direct competitors positively.

Extortion (pay-or-bomb)

Someone contacts you (via email, DM, or even a Google review itself) demanding payment in exchange for removing or not posting negative reviews. The amounts range from $200 to $5,000. Some extortionists follow through. Others bluff. The threat itself is a crime in most jurisdictions.

Detection signal: Written demand linking payment to review removal. This is your strongest evidence -- screenshot and preserve it immediately.

Viral mob (social media pile-on)

A negative incident goes viral on TikTok, Reddit, or X. Thousands of people who have never visited your restaurant flood your Google profile with 1-star reviews. The reviewers are real people with real accounts, but they have never been customers. This is the hardest type to fight because Google's systems see real accounts, not bots.

Detection signal: Sudden review spike correlated with a social media post. Reviews reference the viral content rather than personal dining experience.

Google's 2026 extortion reporting tool

In January 2026, Google quietly launched a dedicated form for merchants reporting review-related extortion. This is separate from the standard "Report review" button and goes to a different form.

1
Navigate to Google Business Profile Manager
Sign in to the Google account that manages your Business Profile.
2
Open "Support" → "Contact us"
Select "Reviews and photos" → "Manage reviews" → "Review extortion or blackmail."
3
Submit evidence
Upload screenshots of the extortion message (email, DM, text, or review containing the demand). Include timestamps.
4
Provide timeline
List the dates and times of the bombing reviews. Google correlates these with the extortion message timestamp.
5
Submit the form
Give the details the form asks for, such as your contact info, the affected Business Profile and how the extortion was made, and attach your evidence. Do not pay or engage with the extortionist.

Google says to gather all evidence immediately: the sooner you collect proof, the better. It calls extortion scams a serious policy violation.

Google will not tell you who the extortionist is, even if they identify them. They will remove the reviews and may ban the associated accounts, but they will not share account details with you. For identification, you need law enforcement involvement.

72-hour defense playbook

When you discover a bombing attack, the first 72 hours determine how much damage sticks. Here is the hour-by-hour response:

Hour 0-1: Document everything

Screenshot every suspicious review (full review + reviewer profile)
Screenshot any extortion messages (email, DM, text, review)
Note the exact timestamps of each review
Export your current Google review history (GBP Manager → Reviews → Download)
Save a copy of your current star rating

Hour 1-4: Respond publicly

Reply to every bombing review with a calm, professional response
Template: "We have no record of your visit on [date]. We take all feedback seriously. If you did visit us, please contact us at [email] so we can address your experience."
Do NOT accuse reviewers of being fake in the reply (this looks defensive to other readers)
Do NOT mention extortion publicly (this can tip off the attacker and complicate legal proceedings)

Hour 4-12: File reports

Report each review individually via the standard "Report review" button (flags content for Google)
File an extortion report via Google's dedicated merchant tool (if applicable)
File a police report if extortion is involved (review extortion is criminal in the US, 18 USC § 873; UK, Theft Act 1968 § 21; EU, and most other jurisdictions)
If a report is rejected, appeal that review once with the evidence attached; if the appeal is refused, ask on the Google Business Profile Community Forum or use Google's legal form

Hour 12-72: Protect and rebuild

Post a brief statement on your social media: "We are aware of a coordinated review attack and are working with Google to resolve it"
Encourage genuine recent guests to share their experience (not "leave a review to counter the fakes" -- that violates policy)
Monitor for new bombing reviews -- attackers sometimes send waves over multiple days
If you have legal counsel, send a cease-and-desist to any identified extortionist

Detection: how to spot a bombing early

The difference between catching a bombing at 5 reviews and catching it at 25 reviews is the difference between a minor dip and a rating crisis. Early detection requires monitoring three signals:

Velocity anomaly

Your baseline is 3 reviews per week. Suddenly you receive 8 in one day. Any spike above 3x your weekly average within 48 hours warrants investigation.

Reviewer profile patterns

Bombing accounts tend to share characteristics: created recently, few or no other reviews, no profile photo, generic display names. A cluster of these profiles reviewing you in the same window is a red flag.

Content analysis

Bombing reviews are often vague ("terrible experience," "worst restaurant ever") or describe experiences that do not match your business (wrong cuisine, wrong location details). They rarely mention specific dishes or staff interactions.

ReviewTactic monitors your review velocity in real time. When new reviews arrive at abnormal rates, you get an alert before the damage compounds. The system also flags reviews from accounts with no review history -- the signature pattern of both bombing and extortion attacks.

Legal options that actually work

Action	When to use	Why it works	Cost
Police report	Extortion demand exists (written or verbal)	Review extortion is criminal. A police report number strengthens your Google appeal and opens the door to law enforcement subpoenaing Google for account information.	Free
Cease-and-desist letter	Extortionist identity is known or suspected	Creates a paper trail and often stops the attack. Most extortionists are opportunistic -- legal pushback scares them off.	$200-500 from a business attorney
Small claims court	Demonstrable financial damage from fake reviews	No attorney needed. File in your jurisdiction. The cost of defending discourages most attackers.	$30-100 filing fee
FTC complaint (US)	Organized fake review service involved	The FTC Consumer Review Rule (Oct 2024) allows penalties up to $53,088 per violation. Complaints build the enforcement pipeline.	Free

Do NOT try to fight bombing by posting your own fake positive reviews. This violates Google's policy, and Google's detection systems will catch both the bombing reviews AND your defensive fakes. Two wrongs make your situation significantly worse.

What Google will and will not do

Google will

Remove reviews that violate content policies (spam, conflict of interest, off-topic)
Investigate extortion reports filed through the dedicated merchant tool
Ban accounts associated with coordinated review manipulation
Expedite cases with police report numbers attached

Google will not

Reveal the identity of reviewers or extortionists to you
Guarantee removal timelines
Remove reviews that are critical but technically policy-compliant
Proactively detect bombing -- you must report it; their systems catch patterns but not intent
Compensate you for lost business during the attack

Clearly coordinated bombing reviews with evidence have the best chance of coming down, but don't expect all of them to. Some may survive if the individual reviews do not violate policies on their own, even if the pattern is suspicious. No one publishes removal success rates, so treat any percentage you see quoted with caution. This is why early detection and rapid reporting matter -- each hour of delay means more reviews that may become harder to remove.

Prevention checklist

Monitor review velocity daily

Any spike above your weekly baseline deserves a look. Automated monitoring catches what manual checking misses.

Respond to every review within 24 hours

Active profiles recover faster from bombing. Owner responses also reduce false-positive removals of legitimate reviews by 73.7%.

Secure your Google Business Profile

Enable 2-factor authentication. Verify your business ownership. Remove any ex-employees from profile management access.

Maintain a review response cadence

Profiles with consistent response histories are treated more favorably by Google's trust algorithms during disputes.

Keep records of all customer communication

If an extortion attempt arrives, your documentation of legitimate customer interactions helps Google distinguish real from fake reviews.

ReviewTactic automates the monitoring and response parts of this checklist. Every new review triggers a notification. AI-generated response drafts in your brand voice ensure no review goes unanswered, even during a crisis.

Detect review attacks before they damage your rating

ReviewTactic monitors your reviews in real time and alerts you to velocity anomalies. Respond faster than the attacker can post. If reviews violate Google's policies, our removal service handles the report and the appeal ($99 per removed review).

Get a free removal audit

Review bombing is not about reviews. It is about protecting your business from people who exploit the trust system that Google reviews represent. The merchants who recover fastest are those who detect early, document everything, and use every available channel -- Google's tools, law enforcement, and legal options -- simultaneously.

Once the coordinated and policy-breaking reviews are dealt with, the honest negatives that remain will stay up, and a measured public reply does more for future customers than another report. Our guide on how to respond to bad Google reviews shows what to write.