Google Review Bombing: What It Is and How to Report It

A business with years of steady five-star reviews can watch its rating collapse in an afternoon: a dozen, fifty, sometimes hundreds of one-star reviews landing within hours, most from accounts that never set foot in the place. That's review bombing, and it behaves differently from a single fake or angry review in ways that change what you should actually do next. The right response depends on whether the wave comes with a demand for money, because Google now routes those two situations through separate reporting channels.

What review bombing actually is

Review bombing is a deliberate, short-window flood of negative reviews meant to crater a rating fast, usually posted by people with no real connection to the business. The reviews often share vague, interchangeable language, land within hours of each other, and come from accounts with little or no other review history. The trigger can be a viral social post, a controversy the business gets swept into by mistake, a personal grudge, or a straightforward extortion attempt.

Google itself has acknowledged the pattern. In a November 2025 fraud advisory, Google described a two-phase scheme where bad actors first flood a profile with fake one-star reviews, then a separate message arrives over a messaging app demanding payment to make them stop. Not every bombing has that second phase, but Google now treats the flood and the shakedown as one connected problem with two different responses.

How it's different from one angry customer

A single negative review, even a harsh or unfair one, is ordinary business, and the right move there is a calm, non-conceding reply, covered in full in our guide to responding to fake Google reviews. Review bombing is identified by pattern, not by any one review's content, so look at timing and volume together before deciding what you're actually dealing with.

• Timing: several to hundreds of reviews landing within hours or a couple of days, not spread across normal weeks.
• Reviewer history: many accounts posting their only review ever, or their only one-star review ever.
• Content: vague, generic wording that doesn't reference anything specific to the business, or comments about an unrelated controversy rather than a customer experience.
• Source: little visible connection to the actual customer base, sometimes obvious from reviewer names, profile photos, or a geographic pattern that doesn't match the service area.

Organic pile-on vs. extortion

Once it's clear this is a bombing and not one angry customer, there's a second question that actually changes what to do next: is anyone asking for anything? A viral pile-on and an extortion attempt can look identical inside the review feed but need different reporting paths.

An organic pile-on, say, a wave tied to a news story or a social post, usually has no ask attached; it's meant to punish or embarrass, not profit. An extortion attempt always has a payment demand somewhere, typically arriving separately from the reviews themselves: a message on WhatsApp, email, or another app offering to remove the reviews for money, gift cards, or free services.

Which Google reporting path to use

Google runs two separate systems here, and using the wrong one wastes the lever most likely to help. No payment demand means standard review reporting, run across every fake in the wave. Open each review, use the report option, and pick the violation it actually breaks, the same process covered in our review removal policy guide.

A payment demand changes the channel entirely. That goes through Google's Merchant Extortion Report form as well as standard flagging, because Google is trying to catch the person behind the demand, not just take down a review.

Inside Google's Merchant Extortion Report form

Google rolled out a dedicated reporting form for this exact scenario in November 2025, separate from the review-flagging tool most owners already know. A standard flag only asks Google to look at one review; the extortion form asks Google's trust and safety team to investigate the person making the demand.

• Your contact details and relationship to the affected Business Profile
• The business name, address, and a direct link to the profile
• Links to the specific reviews involved and when the spike started
• Screenshots of the extortion message itself: platform, date, sender, and what was demanded

What to actually do in the first week

Speed and order matter more than perfect wording here. Documentation and reporting come first, public replies second. A short, calm public reply is still worth posting so future visitors see it, but it doesn't stop the reviews from counting against the rating the way removal does.

• Day 1: screenshot everything, start standard flags on each fake review, submit the extortion form if there's a demand.
• Days 2 to 3: check whether the wave has stopped growing; new fakes matching the same pattern get added to existing reports rather than starting over.
• End of week 1: check Google's review management tool for removal status, and expect partial results rather than a clean sweep.

The math of rebuilding your average

Once the flood slows, the instinct is to fight back by asking every happy customer for a five-star review. That works, but the math is worse than most owners expect if the fake reviews don't come down first. A weighted average moves slowly once there's real review history behind it.

Say a business has 100 reviews averaging 4.9 stars, a total of 490 stars. A bombing adds 20 fake one-star reviews before any get removed: 120 reviews, 510 stars, average down to 4.25. Getting back to a 4.9 average by requesting new five-star reviews alone, with none of the fakes removed, would take roughly 780 additional five-star reviews. That's the arithmetic of a weighted average with a large denominator: new reviews dilute the damage, they don't erase it.

“New five-star reviews dilute a bombing. They don't erase it. Removal is still the faster lever.”

That's why reporting and removal are the priority, and fresh reviews are the recovery, not the fix. Once both report types are filed, keep asking every customer the normal way; our guide to getting more Google reviews covers scripts and timing that stay well clear of review gating.

Reducing the odds of a repeat attack

There's no way to fully bomb-proof a Google Business Profile, but two habits make the next wave easier to catch and survive. Catching it in hour one instead of day three is almost entirely about notifications, and most owners rely on a single alert channel that can silently fail; see our guide to fixing Google review notifications to make sure both channels are actually on.

The second habit is a steady base of real reviews. A business earning genuine reviews every week has a larger denominator, so the same size attack does proportionally less damage to the average, and a sudden spike of one-star reviews against a backdrop of steady, spread-out five-stars is also a more obvious anomaly for Google's own detection systems to catch.

Answering every review promptly, not just the bombed ones, is part of the defense too: a profile that's clearly maintained looks less like an easy target. Resparo drafts replies to everyday reviews automatically and holds anything hostile or suspicious, exactly the reviews in a bombing, for a one-tap check instead of auto-answering them blind. Plans start at $29.99 a month, or try a single reply free with the reply generator.