How to Handle a Google Review Bombing Attack
A review bombing attack is a sudden wave of ratings or reviews driven by coordination rather than genuine customer experiences. Speed matters, but frantic mass reporting can bury the useful evidence.
Policy-based guidance, reviewed September 2026.
Quick answer
When a Google review bombing attack begins, capture the profile and review count, save every new review and account URL, build a timestamped incident log, preserve any organizing or ransom messages, and report the reviews through official tools. Separate genuine customers from coordinated accounts and do not buy counter-reviews.
How to recognize review bombing
Warning signs include an abrupt volume spike, many new accounts, repeated language, references to an unrelated controversy, reviewers located far outside the service area, or posts appearing immediately after an online call to action.
No single clue proves coordination. The value comes from the combined pattern and timeline.
The first hour: preserve, do not argue
Screenshot the Business Profile, rating, total review count, every suspect post, reviewer profiles, and timestamps. Save public posts or messages that appear to organize the activity.
Assign one person to maintain the incident file. Fifteen screenshots named “Screenshot_final_FINAL” are not an evidence system.
Evidence checklist
- Before-and-after rating and count screenshots
- Every review and reviewer-profile URL
- Timestamps in one timezone
- Repeated wording or account traits
- Off-platform organizing posts
- Ransom or extortion messages
- Customer-record checks
- Report status and appeal eligibility
Separate reviews into case types
Classify each post: no real experience, duplicate script, competitor connection, threat, advertising, or possible genuine customer. That keeps the reporting reason accurate for each review.
Do not treat every new one-star rating as part of the attack. A real customer can arrive during bad timing, which is rude of the calendar but still possible.
Report the pattern and individual reviews
Use the Business Profile or Reviews Management Tool for each contribution. Where a support channel allows context, summarize the volume, time window, shared wording, account pattern, and off-platform trigger.
If demands for money or services accompany the attack, follow Google’s dedicated extortion guidance and preserve the messages. See our review extortion response guide.
Keep public communication calm
Post short individualized replies only when useful. Avoid copying one angry response across every review, accusing named people without proof, or debating the organizer in public.
A brief statement that the business is investigating unusual review activity can give customers context without feeding the event.
What not to do during an attack
Do not buy positive reviews, ask friends to flood the profile, offer incentives, threaten reviewers, or create fake accounts to fight back. Those actions can violate the same policies you need Google to enforce.
Do not delete or radically alter the Business Profile in panic. Preserve ownership and verification access.
Recovery after the wave
Track each decision, appeal eligible denials with stronger pattern evidence, and continue requesting honest feedback from real customers without gating or incentives. Monitor for reposts.
Record the incident as a reusable case file. If another wave starts, you should not have to rediscover your own process while the rating counter does interpretive dance.
Frequently asked questions
There is no official number. Look for unusual volume and coordinated patterns rather than a fixed threshold.
No. Submit accurate policy reports and organized evidence instead of trying to win by volume.
Google uses automated spam detection and considers account and behavior signals, but businesses should still preserve and report clear evidence.
Not necessarily. Use replies when they help readers, and avoid feeding a coordinated confrontation.
Preserve the demand and use Google’s extortion reporting guidance. Do not pay for review removal.
Need a policy-based second look?
Send the review link and the evidence you already have. We will screen the case against Google policy and tell you whether it appears worth pursuing.
Related Google review guides
Sources
Primary sources: Google Maps prohibited and restricted content policy and Google review reporting and appeal instructions. Policy wording and workflows were reviewed September 2026.
Related next step
During a review attack, profile owners still do not receive a reviews-off switch. See whether Google reviews can be turned off.