Fake Google Review Blackmail: What Businesses Should Do

Fake Google review blackmail occurs when someone posts, or threatens to post, false negative reviews and then demands money, goods or another benefit in exchange for stopping the attack or removing the content.

The scheme can place immediate pressure on restaurants, professional firms, retailers, tradespeople and other businesses that rely heavily on their Google rating.

Google describes review-extortion scams as incidents involving a sudden increase in one-star or two-star reviews followed by a demand for money, goods or services in return for their removal. The company treats this activity as a serious policy violation and provides a dedicated reporting process for affected businesses.

The most important initial steps are to preserve the evidence, restrict communication to an authorised person, report the reviews and extortion demand through the appropriate channels, and avoid making promises or payments under pressure.

How fake review blackmail may begin

A review-extortion incident may start with:

• A sudden cluster of one-star reviews within a short period.
• Reviews from accounts with no apparent connection to the business.
• Identical or similar wording across several reviews.
• Comments about products or services the business does not provide.
• Reviews posted from unrelated locations.
• A message demanding payment after the reviews appear.
• A threat to continue posting unless the business complies.
• An offer to remove the reviews in return for money, goods or services.
• A demand through WhatsApp, Telegram, email or social media.
• Requests for payment by cryptocurrency, gift cards or money transfer.

A single inaccurate or hostile customer review does not necessarily indicate blackmail.

The defining issue is usually the connection between the negative reviews and a demand supported by a threat of further harm.

Why businesses may feel pressured to pay

Online ratings can influence whether a prospective customer calls, visits or makes a booking.

A small business with relatively few reviews may see its displayed rating change more noticeably after a concentrated burst of one-star submissions.

The person making the demand may exploit:

• Reliance on local search visibility.
• Concern about lost bookings or enquiries.
• Fear that the platform will respond slowly.
• Limited access to legal or technical support.
• A busy trading period.
• Pressure from staff, partners or franchise owners.
• Worry that responding publicly may worsen the situation.

The requested sum may initially appear lower than the expected commercial loss.

That does not mean payment will resolve the problem.

Should a business pay?

Payment does not guarantee that the reviews will be removed or that further attacks will stop.

The person may:

• Demand a larger payment.
• Post additional reviews through new accounts.
• Target another business location.
• Return several weeks or months later.
• Claim that another person also requires payment.
• Remove some reviews while leaving others online.
• Continue making threats after receiving money.

Every situation differs, and a business facing threats should consider police, legal and specialist advice before making decisions about payment or communication.

Do not assume that paying once purchases control over accounts or content that remain in another person’s hands.

Preserve the evidence

Before reporting or responding, preserve the available evidence.

Record:

• The full text of each suspicious review.
• Reviewer names and profile links.
• Star ratings.
• Dates and times of publication.
• Screenshots showing the review within the Business Profile.
• The business rating before and after the attack, where known.
• Emails, messages or calls containing the demand.
• Telephone numbers, email addresses and usernames.
• Payment instructions.
• Bank details or cryptocurrency wallet addresses.
• Deadlines and threats of further reviews.
• Google report and case-reference numbers.
• A chronology of the incident.

Take screenshots that show the surrounding page and account details, not only the review text.

Where possible, preserve the original messages rather than copying their wording into a separate document.

Report the extortion to Google

Google provides a specific form for reporting negative-review extortion scams.

Its guidance recommends gathering evidence immediately and avoiding direct engagement with the person making the demand. The report can include screenshots, review links and communications demonstrating the connection between the reviews and the extortion attempt.

You should also report the individual reviews that violate Google’s policies through the Business Profile review-management process. Google allows businesses to flag inappropriate reviews and review the status of submitted removal requests.

When submitting reports:

1. Identify each review clearly.
2. Explain why it appears unrelated or fabricated.
3. Include the extortion message where the reporting route permits it.
4. Show the timing between the review activity and demand.
5. Retain every case or reference number.
6. Keep a record of Google’s response.
7. Escalate through the available review-management process where appropriate.

Reporting does not guarantee immediate removal.

The business should continue preserving evidence and managing the wider operational and reputational effects while the platform considers the reports.

Should the business respond publicly to the reviews?

A calm public response may reassure genuine customers, but businesses should avoid accusing named individuals of criminal conduct without evidence.

A suitable response may state that:

• The business cannot identify a corresponding customer or transaction.
• The matter has been reported to the platform.
• The business takes genuine customer feedback seriously.
• Customers with a legitimate concern can contact the business directly.

Avoid:

• Publishing the extortionist’s telephone number or personal details.
• Threatening the reviewer.
• Arguing across multiple comments.
• Claiming the person has been identified without evidence.
• Offering payment publicly.
• Asking genuine customers to post coordinated positive reviews.
• Publishing confidential customer or employee information.

A short, consistent response is generally more useful than a prolonged public dispute.

Report the matter to the appropriate authorities

Where a demand for money or another benefit is supported by threats, the conduct may amount to blackmail or another criminal offence depending on the circumstances.

Businesses in England, Wales and Northern Ireland can report fraud and financially motivated cybercrime through Report Fraud. Immediate danger or threats of physical harm should be reported through 999.

Provide:

• The chronology of the reviews and demand.
• Copies of all messages.
• Reviewer and account links.
• Payment instructions.
• Google report references.
• Details of any payment already made.
• Information about other business locations affected.
• Any threats directed at staff or owners.

A report does not guarantee that the person will be identified or prosecuted. It creates an official record and allows the available evidence to be assessed.

Protect the Business Profile and connected accounts

The attacker may be limited to posting external reviews, but the business should still check whether any internal account has been compromised.

Review:

• Business Profile owners and managers.
• Google account passwords.
• Multi-factor authentication.
• Active account sessions.
• Recovery email addresses and telephone numbers.
• Access held by former staff or agencies.
• Connected advertising and analytics accounts.
• Website administrator access.
• Social-media accounts receiving related threats.

Remove access that is no longer required and preserve relevant login information before making substantial changes where compromise is suspected.

A review attack does not by itself prove that the Business Profile has been hacked.

Communicating with customers and staff

The business may need a short internal and external communication plan.

Staff should know:

• Who is authorised to respond.
• Where threatening messages should be forwarded.
• Not to negotiate independently.
• Not to delete evidence.
• How to handle customer questions.
• When to escalate threats involving safety or personal information.

Customers do not necessarily need every detail of an ongoing extortion attempt.

Where a public statement is required, it should be factual, restrained and consistent with any legal or police advice.

Fake reviews and UK consumer law

Fake reviews can mislead consumers and undermine trust in legitimate businesses.

UK consumer-protection changes that took effect in April 2025 introduced more explicit rules relating to fake consumer reviews. The Competition and Markets Authority has published guidance for businesses that publish or present reviews and continues enforcement work in this area.

These rules do not mean that an affected business can compel immediate removal of every disputed Google review.

Platform reporting, evidence preservation and any legal or police response remain separate parts of the process.

Can the person behind the reviews be identified?

Investigative enquiries may examine:

• Reviewer names and profile histories.
• Repeated language across accounts.
• Associated email addresses or telephone numbers.
• Websites and social-media profiles.
• Payment details and cryptocurrency addresses.
• Links between attacks on different businesses.
• Public corporate or professional information.

However, an account name, telephone number or wallet address does not automatically identify the person controlling it.

The individual may use false identities, virtual numbers, stolen accounts, intermediaries or services based outside the UK.

Private investigators cannot compel Google, banks, telecommunications providers or payment services to disclose confidential subscriber information. Police powers or formal legal disclosure may be required.

How specialist support may assist

A structured response may include:

• Reviewing the reviews, messages and demands.
• Organising the evidence and chronology.
• Assessing links between reviewer accounts and communication channels.
• Reviewing payment instructions and public identifiers.
• Supporting a controlled communication strategy.
• Coordinating with solicitors and cyber-security specialists.
• Preparing information for Google, police or legal advisers.
• Monitoring for further reviews or threats.
• Reviewing connected account and access risks.

No adviser can guarantee that Google will remove every review, that the person responsible will be identified or that the attack will permanently stop.

For broader guidance on threatened reputational harm and payment demands, read What to Do If You Are Being Blackmailed in the UK.

Conflict International’s Blackmail and Extortion Resolution Services support businesses facing review extortion, online threats and coercive payment demands.

Take the next step

The immediate priorities are:

1. Preserving every review, message and payment demand.
2. Reporting the extortion through Google’s dedicated process.
3. Flagging each policy-violating review.
4. Restricting communication to an authorised person.
5. Checking Business Profile and connected-account security.
6. Reporting suspected criminal conduct.
7. Managing customer and staff communications carefully.

If your business is receiving fake reviews followed by demands for money, goods or services, contact Conflict International in confidence to discuss the evidence, immediate commercial risks and appropriate next steps.