Fake Review Extortion and Review Bombing

Why this matters

For a residential trade, the star rating is the storefront. A homeowner choosing between three plumbers at eleven at night reads the number and the last five reviews, and a sudden run of one-star reviews can cut calls inside a week. The extortion version of this attack is built on that: someone floods your profile with fake one-star reviews, then a "reputation service" contacts you offering to make them disappear for a fee. The owners who lose the most are the ones who pay, because paying does not end it.

The two shapes, and how to tell them apart

Review bombing is a burst of negative reviews in a short window from accounts that are not your customers. It can be driven by a competitor, by an angry person who recruited friends, by a viral social post that sent strangers to your page, or by the extortion operation below.

Review extortion is review bombing with a sales pitch attached. The pitch arrives after the reviews land, usually by email, text or a message through the review platform, and it offers removal for a payment, often by gift card, cryptocurrency or a payment app. Sometimes the pitch comes first as a threat: pay now or the reviews start.

The difference matters for what you report and to whom, but the first moves are identical. The tells that a wave is fake rather than a real service failure:

• Timing. Ten or more reviews inside one or two days on a profile that normally gets a few a month. Real complaints arrive one at a time, spread out, after jobs.
• No match to your records. The names do not match any customer, address or job in your system. This is the single strongest evidence you have, and it is evidence only you can produce.
• Reviewer profiles. New accounts, no photo, one or two reviews total, or a history of one-star reviews for businesses in other cities and unrelated trades on the same days.
• Content. Short and generic ("terrible, avoid", "scam"), no job detail, no tech name, no date, no mention of what was supposedly done. A real angry customer names the furnace, the tech and the price.
• The pitch. Any contact offering removal for money settles it.

A real negative review from a real customer is a different problem and gets a different response: you fix the job and reply properly. Do not lump a legitimate complaint into a fake wave because it arrived the same week. Check it against your records like the rest.

What the pitch looks like

From: Reputation Restore Team
Subject: Your business profile - 1 star alert

Hi, we noticed your rating dropped to 4.2 this
week. We work with the platform and can remove
negative reviews within 48 hours.

Our fee is per review removed. 50 percent up
front, balance after removal. Payment by gift
card or crypto only for fast processing.

If you do not respond by Friday we cannot
guarantee your rating will not drop further.

Every line of that is a tell. "We work with the platform" is false; review platforms do not sell removals through third parties. The deadline and the "drop further" line are the threat. Payment by gift card or cryptocurrency is chosen because it cannot be reversed. A legitimate reputation consultant may help you ask for reviews and write replies; none can sell you deletions.

Why you never pay

• It does not work reliably. Many operators have no way to remove anything. They take the up-front half and vanish. Some remove the reviews by deleting the fake accounts they control, which proves they posted them.
• It marks you as a payer. A shop that paid once is on a list. The next wave is cheaper to launch against a known payer than against a stranger.
• It can put you on the wrong side of the platform. Paying to manipulate reviews, in either direction, breaks most platforms' terms. A shop caught in a removal scheme can lose its profile's standing, which costs more than the fake reviews did.
• It can put you on the wrong side of the law. At the federal level, the FTC's rule on consumer reviews and testimonials (16 CFR Part 465, in force since late 2024) prohibits a business from buying fake reviews and from suppressing reviews through threats or false accusations, and it carries civil penalties. Paying an operator to remove reviews you have not shown to be fake, or answering the wave by buying fake positives, can land you inside that rule. States add their own consumer-protection and deceptive-practices laws on top.

The response, in order

1. Freeze and capture before you touch anything. Screenshot every review in the wave with the date, the reviewer's name and a link to the reviewer's profile. Screenshot the profile pages too. Save the pitch message with its headers or sender details. Reviews get edited and accounts get deleted, and a platform's support team asks for exactly this.

2. Run every review against your records. Search your customer list and job history for each reviewer name, and for any address or detail in the review. Build a simple list: reviewer, date, matched or not matched, notes. This is what turns "these look fake" into "none of these 19 people have ever been a customer."

3. Report through the platform, review by review and as a pattern. Most platforms have a flag on each review (choose the reason that fits: not a customer, conflict of interest, spam or fake engagement) and a separate business support channel or form for extortion and coordinated attacks. Use both. Attach your capture and your no-match list. Flagging reviews one at a time without telling the platform it is a coordinated attack is the slow path, because each reviewer sees one review in isolation.

4. Report the extortion itself. The pitch is an attempted crime. File with the FBI's Internet Crime Complaint Center (IC3), which handles online extortion, and with your local police for a report number. Neither will usually act quickly on your reviews, but the report number strengthens the platform case and any later legal step.

5. Reply publicly, briefly, and the same way each time. Readers judge you by the reply more than by the review. A reply to a fake review should be calm, factual and short: you have no record of this person as a customer, you have reported the review, and anyone with a real concern can call the office. No accusations, no sarcasm, no mention of extortion in the reply, and no customer details ever.

We have no record of a job or customer under this name, and we have reported this review to the platform. If we did work for you and something went wrong, please call the office and ask for the owner; we will make it right.

6. Do not counter-flood. Asking every friend and relative to post five-star reviews this week is the instinct, and it is the mistake. It is itself fake engagement under the platform's rules and, at the federal level, under the FTC rule above. What is fine is the normal habit sped up: ask recent real customers for an honest review, the way you always should.

7. Decide whether a lawyer is worth it, at the fork. If the platform declines to remove reviews you can prove are fake, or if you can identify a competitor behind them, the next step is legal, and this is where you stop acting on an article. Walk in with your capture, your no-match list, the pitch, the platform's responses and your call-volume numbers before and after. Know before you go that suing over a review that turns out to be a real customer's opinion can cost you: many states, including California and Texas, have anti-SLAPP laws that let a defendant get a speech-related case dismissed early and recover their legal fees from you. The federal Consumer Review Fairness Act also voids contract clauses that forbid customers from posting honest reviews, so a "no negative reviews" term in your service agreement is not a tool. This is not legal advice; the attorney decides whether you have a case worth bringing.

Worked example: an HVAC shop takes 22 one-star reviews in 36 hours

A six-truck HVAC shop has 140 reviews at a 4.8 average. Across a Tuesday night and Wednesday, 22 one-star reviews land. Thursday morning, an email arrives offering removal at a per-review fee, half up front by gift card.

The rating math. 140 reviews averaging 4.8 is a star total of 672. Adding 22 one-star reviews makes 694 stars over 162 reviews, an average of about 4.28, which the platform displays as 4.3. For a shop whose competitors sit at 4.6 to 4.9, that moves it from the top of the list to the bottom of the visible page.

Capture and records check. The office manager screenshots all 22 reviews and the reviewer profiles Wednesday afternoon. Running names against the customer list: 21 have no match at all. One, a woman whose name matches a customer from two months earlier, describes a real job, names the tech and complains the shop was three hours late for a no-heat call. That one is real, and the shop pulls it out of the wave.

Report. Thursday, the owner flags the 21 unmatched reviews individually as "not a customer," then opens the platform's business support form for a coordinated attack, attaching the no-match list and the extortion email. He files an IC3 complaint the same day and gets a local police report number Friday.

Reply. All 21 fake reviews get the short no-record reply above. The real one gets a separate, specific reply: an apology for the late arrival, what happened (two emergency calls stacked that morning), and an invitation to call the owner. He calls her himself that afternoon.

Outcome. Over eleven days, the platform removes 18 of the 21. Three stay up; the platform's response says they did not violate policy. Remaining: 140 original reviews plus 3 surviving fakes plus the 1 real complaint, 144 reviews. The star total is 672 plus 3 plus 1, 676 stars over 144 reviews, an average of about 4.69, displayed as 4.7. The real complaint's customer later updates her review to three stars after the call, which does not move the displayed figure.

Why each call was right. Pulling the real review out of the wave protected the shop's credibility with the platform: a report that called a genuine customer fake would have undermined the other 21. Calling her personally was the one action in the whole episode that turned a review around. Reporting as a pattern instead of one at a time is what got 18 removals in under two weeks.

What would have changed the answer. If the records check had matched half the names to real customers, this would not have been an attack, it would have been a service problem with a bad week attached, and the work would be in the jobs, not the reports. And if the owner had paid the up-front half, he would have spent a fraction of a month's marketing budget to learn the same thing the platform told him for free, and put his shop on the list for the next wave.

The ongoing defense

The best protection against a wave is a steady flow of real reviews, because a profile with 600 reviews barely moves when 20 fakes land. On 600 reviews at 4.8, twenty one-star reviews pull the average to about 4.68, still displayed as 4.7, against the 4.3 the 140-review shop saw. Ask every satisfied customer, every time, through the normal post-job text or email. Turn on the platform's new-review notifications, sent to two people, so a wave is caught in hours, not after a week of lost calls. See related: The Business Profile Was Hijacked, for the case where the attack is on the profile itself rather than on its reviews.

References

• FTC, Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465
• Consumer Review Fairness Act of 2016 (15 U.S.C. 45b)
• FBI Internet Crime Complaint Center (ic3.gov), for reporting online extortion
• See related: The Business Profile Was Hijacked
• See related: Recovering a Hacked Business Social Account