Review extortion and review bombing: what to do in the first 48 hours

It usually starts on a quiet morning. Your Google rating, steady for years, has dropped. There are eleven new 1-star reviews, all from the last few hours, most with no text. By the afternoon there is a message on WhatsApp or by email: the reviews can be removed, for a fee.

That is review extortion, and Google now treats it as a category of its own. A review bomb looks similar at first, but the cause and the endgame are different. This guide covers both, with the official forms and a plan for the first two days.

What review extortion looks like

Google’s help page describes the pattern in one sentence: “a sudden increase in 1-star and 2-star reviews on your Google Business Profile, followed by someone demanding money, goods, or services in exchange for removing the negative reviews.”

The details vary. Some attackers post first and write later. Some write first and threaten. Some pose as a “reputation agency” that happened to notice your problem and can fix it. The common thread is a link between the reviews and a payment.

How a review bomb differs

A review bomb is a burst of negative reviews from many people at once, usually reacting to something they read or watched rather than something they experienced: a viral post, a news story, a political statement, sometimes a case of mistaken identity with a business of the same name.

There is no demand, and the reviewers are often real people, just not customers. That changes the endgame. With extortion you are dealing with a criminal; with a bomb you are dealing with an audience. But the first hours look the same, and the first steps are the same too.

Hours 0-2: stop, do not reply

The instinct is to answer every review, publicly and fast. Resist it. Google’s advice for extortion is “Do not engage with or pay the malicious individuals” and “Do not try to resolve it yourself by offering money or services”. For a bomb, an angry reply is exactly what gets screenshotted and shared.

1. Tell your team. Whoever reads the business inbox or WhatsApp should not answer demands or argue with reviewers.
2. Do not pay, even a small amount. Paying confirms that you pay. There is no guarantee the reviews go, and every reason to expect the next demand.
3. Do not post positive reviews to compensate. That breaks Google’s policy and, in the US and UK, the law on fake reviews. It also muddies your report.

Hours 2-12: collect the evidence

Google’s extortion form asks for specific things, so gather them before you start filling it in:

• a link to your Business Profile;
• direct links to each suspected review, with screenshots showing the date and the reviewer name;
• screenshots of every message that contains a demand, with the sender visible;
• whatever you know about the sender: names, usernames, email addresses, phone numbers, social media profiles;
• when you first noticed the spike and when the first demand arrived, with dates and times.

Keep everything in one folder. If the reviews vanish and reappear, or if you go to the police, you will need the originals.

Hours 12-24: report through the right door

1. Use the extortion form. It is linked from Google’s help page “Report negative review extortion scams on your Business Profile”. Attach the demands; they are what turns a pile of bad reviews into a clear case.
2. Report each review as well. In the Reviews Management Tool, report every suspected review with the reason that fits. The tool shows the status of each report; evaluation “typically takes several days”.
3. Report to the police if money was demanded. In the US, the FBI’s Internet Crime Complaint Center (IC3) takes reports of cyber-enabled crime. Elsewhere, start with your local police.
4. Check the other review sites. Attackers sometimes hit Yelp, Trustpilot or Facebook at the same time. Each site has its own report process.

Hours 24-48: talk to real customers

Once the reports are in, you can say something in public. Keep it short and the same everywhere. A pinned reply or a single post works better than fifty answers:

For a review bomb, the reply is about the story, not the reviews: what happened, what you are doing about it, how to reach you. Do not threaten reviewers with legal action. In the US, the FTC rule on consumer reviews treats review suppression through “unfounded or groundless legal threat[s]” or intimidation as a violation in itself.

What Google does on its side

In April 2026 Google described what happens when fake reviews spike on a profile: it will “quickly remove the fake content, pause new reviews on the profile, alert the Business Profile owner and display a notification banner to let consumers know why contributions are temporarily paused.” By its count, in 2025 it blocked or removed over 292 million policy-violating reviews.

A pause can feel like a punishment, especially if your real customers cannot leave reviews for a while. It also stops the wave from growing and tells buyers that the sudden drop is not the whole story.

Notice it on day one

Everything above works better the earlier it starts. A wave you find on day four, through a customer asking “what happened?”, has already been seen by everyone who searched you that week.

• Turn on Google Business Profile notifications for customer activity, which include new reviews.
• Watch your ratings on the other sites that show up when people search your name, not only Google.
• Watch your search suggestions: a review attack sometimes comes with searches for “your name scam”.

WhatsMyRep checks the ratings Google shows for your name every day and flags a fall of 0.2 or more from one day to the next; a fall of 0.5 or more sends an alert at the default level. See review monitoring for what it covers and what it does not.