Google Review Extortion Scams

A business owner wakes up to find 15 new one-star reviews on their Google Business Profile, all posted within the same 24-hour window, all from accounts with no profile photos and no review history. Within hours, they receive a message (usually through email, social media, or their website contact form) offering to remove the reviews in exchange for payment, typically between $500 and $5,000 in cryptocurrency or wire transfer.

This is review extortion, and Google created a dedicated reporting process for it in 2026 because the volume of these attacks increased enough to warrant a separate enforcement channel. The scam works because the reviews are real in the sense that they exist on the profile and affect the star rating, even though the "reviewers" never interacted with the business in any way.

How the scam works

The attackers create batches of Google accounts in advance (or purchase them from account farms) and post coordinated one-star reviews across multiple targets simultaneously. The reviews typically contain vague language about bad service, overcharging, or rude staff, written generically enough to apply to any business without revealing that the reviewer has never been a customer.

Attackers time the posts deliberately, spacing 10 to 20 reviews within hours to create an immediate, visible impact on the star rating that the business owner notices quickly. The extortion demand arrives while the owner is panicking about the rating drop, which is when they're most likely to consider paying.

Some operations are more sophisticated and space their reviews over several days to avoid triggering Google's automated burst-detection systems, or they use accounts with some existing legitimate activity to make the reviews appear more credible. But the pattern is consistent across variations; a sudden cluster of negative reviews from accounts with no connection to the business, followed by a demand for money.

Why paying doesn't solve it

Paying the extortion demand fails for two reasons. The first is that extortionists who receive payment almost certainly come back for more, because a business that paid once has demonstrated willingness to pay. The second is that paying doesn't guarantee removal, since the attacker may not control all the accounts that posted reviews (particularly if they purchased reviews from a third-party service), and even if they do remove the reviews, they can simply repeat the attack from different accounts days later.

The FTC's final rule on fake reviews (effective October 2024) also means that the business could face legal complications if it participates in arrangements to manipulate its review profile, even defensively. The cleanest legal and practical path is to report the attack to Google and let their enforcement process handle it.

Reporting extortion to Google

Google provides a dedicated merchant extortion form that is separate from the standard review reporting process. The extortion report is handled by a different team and follows a different timeline than individual review reports because the investigation involves identifying and removing a coordinated network of accounts rather than evaluating a single review against content policies.

When filing the report, include everything you have. Screenshots of the extortion demand (the message asking for payment), the approximate timestamp when the reviews appeared, any communication channels the attacker used to contact you, and if possible, links to the specific reviews you believe are part of the attack. The more documentation you provide upfront, the faster the team can verify the pattern and act on it.

Google's investigation timeline for extortion reports varies but generally moves faster than standard review reports because the pattern evidence (burst of reviews from new accounts + explicit extortion demand) is easier to verify than individual content policy violations. Resolution typically means removal of the coordinated reviews and suspension of the accounts that posted them.

Responding to the fake reviews while you wait

Google's investigation takes time, and the fake reviews sit on your profile affecting your rating while you wait. You have two choices during this period, and the better one is to respond to each fake review with a brief, professional reply rather than leaving them unanswered.

A response like, "We have no record of this reviewer as a customer and have reported this review to Google for investigation," is factual, measured, and tells every prospective customer reading the profile that the business is aware of the situation and handling it through proper channels. Don't accuse the reviewer of extortion in your public response, don't mention the payment demand, and don't write anything that sounds angry or defensive because the audience for your response is future customers, not the attacker.

Respond to every review in the cluster with a similar (but not identical) message. Prospective customers who see 15 one-star reviews all posted on the same day, all with vague language, all receiving the same calm "no record of this customer" response from the owner, will draw conclusions about what happened. The pattern is obvious to anyone paying attention, and your measured response reinforces that the reviews lack credibility.

Preventing future attacks

You can't completely prevent review extortion because the attack requires nothing from you (no data breach, no security failure, no action on your part). But you can reduce your vulnerability and speed up recovery.

Maintaining a strong baseline of legitimate reviews is the most effective defense because it dilutes the impact of any attack. A business with 300 reviews and a 4.5 rating that receives 15 fake one-star reviews drops to roughly 4.3, which is noticeable but survivable. A business with 30 reviews and the same rating drops to 3.1, which is devastating. Review volume is a buffer against manipulation.

Responding to reviews consistently (including positive ones) also signals to Google's systems that your profile is actively managed, which can accelerate the detection of anomalous patterns because the system has a stronger baseline of normal activity to compare against.

Keep screenshots and documentation of any extortion contacts you receive, because Google's enforcement team uses these as evidence and because you may want to file a report with local law enforcement or the FBI's Internet Crime Complaint Center (IC3) if the amounts involved are significant or if the attacks recur.