Criminals are flooding small businesses with fake one-star reviews and demanding payment to stop. Restaurant owners across the US report waves of negative reviews appearing within hours from accounts with no connection to the business. The attacks damage search rankings, scare away customers, and tank revenue overnight. The attackers then make contact and make demands. Review bombing is effective because 81% of consumers use Google to evaluate local businesses and 94% say a bad review has caused them to avoid a business. Attackers know that destroying a rating creates panic. Fake reviews are followed by direct demands for payment with criminals promising to stop the attack or remove reviews in exchange for money.
This affects any business relying on online reviews, restaurants, cafés, hotels, salons, gyms, car rentals, and other local services. The tactic is coordinated, repetitive, and designed to damage reputation as fast as possible. A wave of one-star ratings pushes businesses down in search results, lowers overall ratings, and drives away customers before owners understand what's happening. Attacks appear on Google Reviews, Yelp, Trustpilot, Facebook, Amazon, Steam, and Metacritic. While review bombing can stem from online backlash, competitor sabotage, or trolling, the most damaging scenario is financial extortion. Fake reviews create pressure, then demands for payment follow.
Once attackers see a business is stressed or unsure how to react, review bombing becomes the first step in a broader campaign. Common follow-up attacks include account takeovers on review platforms, social media, email, or booking systems. Gaining access allows attackers to post more damaging content, lock owners out, or demand further payment to restore control. Phishing attacks follow review bombing. Criminals send emails or messages that look like they come from Google, Yelp, or a review support team, tricking employees into sharing login details or clicking malicious links. Some attackers pose as marketing agencies or reputation specialists offering to clean up reviews for a fee while being part of the same scam or running a new one. Attackers impersonate businesses to contact customers, share fake warnings, or redirect people to fraudulent websites. Once a business is flagged as vulnerable, it gets targeted again by the same group or others using similar tactics.
If someone demands money to stop reviews or fix your rating, don't pay. There's no guarantee the reviews will stop. Paying marks your business as an easy target for repeat attacks or new scams. Document everything before responding publicly or privately. Take screenshots of suspicious reviews, profiles, timestamps, and messages. Save any emails, messages, or calls asking for payment. Note sudden spikes in reviews or patterns that don't match real customer activity. This evidence matters for platforms.
Most platforms prohibit fake reviews and extortion. Reports have the best chance of working when they're detailed and timely. Report suspicious reviews directly through the platform. Escalate to customer support if your profile is being overwhelmed. Clearly explain why the reviews are fraudulent, timing, location mismatches, non-customers, repeated wording. Google introduced dedicated merchant extortion reporting tools and uses AI to detect coordinated abuse. In 2025 alone, Google removed more than 240 million reviews that violated its policies. Yelp and Metacritic have rules against fake or coordinated reviews and allow businesses to flag violations. Reporting makes a difference even if it takes time. The Federal Trade Commission now bans fake reviews outright and allows civil penalties. Violators can face fines of up to $50,000 per fake review. Enforcement becomes complicated when attackers operate overseas or use anonymous accounts.
Avoid engaging emotionally or accusing reviewers publicly. A short neutral response or no response at all is often better while platforms investigate. Attackers want attention and reaction. Calm limits their leverage. Review bombing tied to extortion often doesn't stop at reviews. Lock down all business accounts. Use strong unique passwords for review platforms, email, social media, booking tools, and payment services to stop attackers moving from reviews to account takeovers. Turn on two-factor authentication wherever available, especially for email and review platforms. Brief employees that fake support messages may follow a review attack. No legitimate platform will ask for passwords, codes, or urgent action via email or DMs. Be skeptical of quick fixes. Agencies or individuals offering to clean up reviews fast, especially if they contact you right after an attack, may be part of the scam or a separate one.
Detection is often slow and removal can take weeks. Google brags about removing 240 million reviews but attacks still persist because there's a delay between bombing and platform response. Businesses lose customers and revenue during that window. The damage is done before fake reviews get removed. Attackers use this gap. They know platforms won't act immediately. They know small businesses panic when ratings tank overnight. They know most businesses don't understand how to report effectively or what evidence platforms need. This creates the perfect extortion opportunity.
Blackout VPN exists because privacy is a right. Your first name is too much information for us.
Keep learning
FAQ
What is review bombing?
Review bombing is when a business receives a sudden surge of coordinated fake negative reviews in a short period from accounts with no real connection to the business. When used for extortion, criminals demand payment after flooding a business with one-star ratings.
Should you pay if someone demands money to stop fake reviews?
No. There is no guarantee the reviews will stop and paying marks your business as an easy target for repeat attacks or new scams. Document everything and report to the platform and law enforcement instead.
How do you report fake reviews?
Report suspicious reviews directly through the platform with specific details including timing, location mismatches, non-customer evidence, and repeated wording. Google has dedicated merchant extortion reporting tools. Escalate to customer support if your profile is being overwhelmed.
What follow-up attacks come after review bombing?
Account takeovers on review platforms, social media, email, and booking systems. Phishing emails disguised as messages from Google or Yelp. Fake reputation repair agencies that are part of the same scam. Businesses flagged as vulnerable get targeted repeatedly.
Are fake reviews illegal?
The Federal Trade Commission bans fake reviews outright and allows civil penalties of up to $50,000 per fake review. Enforcement becomes complicated when attackers operate overseas or use anonymous accounts to coordinate attacks.