Fake Google Reviews Attack: How One Business Fought Back Without Paying

The business in this story is a composite, not a single client, but every step in it follows the pattern Google itself now documents. A family-run driving school in Offaly has just taken on a second instructor. For the first time in years they have spare lesson slots to fill, and almost every new pupil finds them the same way: a parent types "driving lessons" into Google, sees the map, and picks whoever looks trustworthy.

On a Sunday morning the owner opens Google Maps and finds a run of one-star reviews that were not there the night before. No text on most of them. Accounts with no profile picture and no other review history. A rating built up over years of nervous seventeen-year-olds passing their tests has dropped in a single night.

On the Monday a WhatsApp message arrives from a number nobody recognises. The sender says they can make the reviews disappear. For a fee, naturally.

That is a negative review extortion scam, and it has become common enough that Google now runs a dedicated reporting form for it. I want to walk through what this owner did over the following week, because the order they did things in matters more than any single step.

The Problem: Years of Reputation, Dented Overnight

Why does a handful of fake reviews hurt so much? Because the star rating is often the first thing a customer sees, before your name, before your prices, before your website.

Think about who is searching. A parent comparing three local driving schools is not reading twenty reviews. They glance at the stars, glance at the most recent comment, and move on. If your rating suddenly sits below the school down the road, you are not losing an argument. You are simply never being considered.

And the timing is rarely random. Attacks like this tend to land when a business is visibly busy or growing, which is exactly when it can least afford a quiet week on the phone.

This Is Not a Fringe Problem

Google publishes the scale of it. In its 2025 Trust and Safety figures, released in April 2026, Google said its systems and analysts blocked or removed more than 292 million policy-violating reviews in a single year, while publishing over a billion genuine ones ^[1]. Rough maths says somewhere in the region of one review attempt in five was junk, though that ratio will vary enormously by sector and country, and Google does not break it down for Ireland.

The same announcement named the extortion pattern directly: "attempts to demand payment in exchange for removing fake one-star reviews" ^[1]. When a platform describes a scam in its own blog post, you can be fairly sure it is happening at volume.

The Decision: Do Not Pay, Do Not Argue, Do Not Fight Fake With Fake

Here is where most owners go wrong, and it is completely understandable. You are angry. Helpless, too. Someone is offering a quick fix.

The driving school owner made three decisions on the Monday, before doing anything else.

They did not pay. Google's own help page on extortion scams is blunt about this: do not engage with or pay the individuals, because it "can encourage further attempts and doesn't guarantee the removal of reviews" ^[2]. Think about who you would be paying. Someone who has already shown they will lie about your business for money. What stops them coming back next month?

They did not reply to the scammer. No negotiating, no threats, no angry voice notes. Every message you send is another opening for them.

They did not ask friends and family to post five-star reviews to balance things out. This is the one that catches decent people. It feels like self-defence. Legally, it is not. Posting or commissioning fake reviews is a banned commercial practice in Ireland, and we have covered what Irish consumer law says about reviews on your website in detail elsewhere. It also gives Google a reason to look sideways at your whole profile, at the exact moment you need it to take your side.

Once those three decisions were made, the rest was process.

The First 72 Hours, Step by Step

This is the sequence the owner followed. If it ever happens to you, it is the one I would follow too.

1. Capture the evidence. Screenshot every extortion message so the date, time and sender's number or email are visible, and copy the link to each suspicious review before anything changes.
2. Report the extortion. Use Google's merchant extortion report form, signed in to the account that manages your Business Profile, and attach the screenshots.
3. Flag each fake review. Report every one individually through your Business Profile or the Reviews Management Tool, choosing the reason that fits, such as spam.
4. Reply once, calmly. Leave a short public response on each fake review that a real customer can read without wincing.
5. Verify your own front door. Make sure your website is up, current, and shows the reputation you have actually earned.

Why the Evidence Comes First

Google's extortion help page asks for a lot: screenshots showing the demand, the date and time, the sender's contact details, links to each suspicious review, and the date you first noticed the spike ^[2]. Scammers delete messages. Reviews get removed or edited. If you start reporting before you have captured everything, you can lose the very proof the form asks for.

Reporting Reviews Properly

The extortion form and the ordinary "report review" route are separate, and you should use both. Google's help page on inappropriate reviews explains that flagged reviews go through an evaluation that "typically takes several days", and that you can track each one in the Reviews Management Tool ^[3]. Statuses include "Decision pending" and "Report reviewed - no policy violation". If a review is not removed, you get a one-time appeal, and you can select up to ten reviews in a single appeal ^[3].

One-time. That is worth knowing before you click anything. Make the appeal count, with the extortion context included, rather than firing it off in frustration on day one.

The Public Reply

The owner's reply on each fake review was two sentences. Roughly: we have no record of this person as a pupil, and we have reported the review to Google as part of a scam targeting local businesses. No sarcasm, no essays.

Who is that reply actually for? Not the scammer. It is for the parent in six months who scrolls past it and decides whether you seem like a reasonable person to put their teenager in a car with.

Google's Automatic Shield, and Its Limits

Google has also built something that works without you. In the same April 2026 announcement, it said that when it sees a sudden spike in spam reviews it will "quickly remove the fake content, pause new reviews on the profile, alert the Business Profile owner and display a notification banner" explaining why contributions are paused ^[1].

Business owners have since shared the alert email. As reported by Search Engine Roundtable, it tells the owner that new ratings and reviews have been temporarily paused and that the pause typically lifts "within a few days" ^[4].

That is genuinely good news. But it is worth being honest about what it cannot do.

• The pause is total. While new reviews are frozen, your genuine customers cannot leave one either. If you run a busy week, the happy reviews that would have rebuilt your rating simply do not land.
• The filter makes mistakes. In the same Search Engine Roundtable report, a local search consultant described a client with a new location and a steady flow of genuine reviews who appeared to be caught by the filter anyway ^[4]. A legitimate surge can look like an attack.
• It will not touch reviews that are merely unfair. Google's help page states plainly that you should not report a review just because you disagree with it, and that Google "doesn't get involved in conflict between businesses and customers" ^[3].

That last point is the real limitation. A genuine customer who had a bad experience and wrote something harsh is not a scam, and no form will remove them. The extortion route is only for cases where someone has actually demanded money or favours ^[2].

Why the Website Carried the Week

The reviews took several days to come down. During those days, what did a cautious parent see when they searched the school by name, saw a strange rating, and wanted a second opinion?

They clicked through to the website. And this is the part of the story most owners never think about until it is too late.

Ask yourself: if your Google rating were wrong for a week, where would a customer go to check you out? If the answer is "a Facebook page I have not updated since 2023" or "nowhere", the fake reviews are the only story anyone hears.

What a Proper Fallback Looks Like

A website that does this job well has a few things in common:

• It is yours. No moderation queue, no automatic pause, no platform deciding what visitors see this week.
• It shows earned reputation in context. Testimonials with a first name or initial, the month, and what the customer actually came for, collected with permission, not a wall of anonymous five-star quotes.
• It loads instantly on a phone. The parent checking you out is standing in a kitchen on mobile data, already a little suspicious.
• It is current. Your prices, your instructors, your areas, updated this season. A stale site during a reputation wobble confirms the doubt rather than answering it.
• You can edit it yourself, today. Not after a developer gets back from holidays.

The driving school had all of that, more or less by accident. They had built the site themselves with an AI builder a year earlier, added a short testimonials page with pupils' permission, and kept it current because changing it took minutes rather than an invoice.

Web60 meets those criteria by design. The site is full WordPress, so a testimonials page or a "how we handle reviews" note can be added in minutes. It runs on a hosting stack with Nginx, Redis object caching and FastCGI page caching, which in plain terms means the page appears almost instantly on a phone instead of giving a suspicious visitor a reason to back out. Nightly backups and automatic security scanning sit underneath, so the one channel you fully control is not the next thing to fail. And Web60's €60/year all-inclusive plan covers the whole lot, with nothing to renew separately when you need it most.

Without that, the week looks very different. The rating drops, the phone goes quiet, and there is nowhere to send people except a listing you do not control and cannot fix until Google gets round to it.

A fair concession, though. If you already run a site on another builder or host, it loads well, and you keep it current, you do not need to move anything to handle this. The platform matters far less than having a page you control and actually maintain. What I would push back on is the idea that a Business Profile alone is enough. This scam is precisely the moment it is not.

When It Is More Than Spam: The Legal Route

Most owners will never need this section. But it is worth knowing the options exist.

Extortion is a crime. Report the demand to your local Garda station as well as to Google, and keep a copy of everything you send. Google's form is a platform process. It is not a substitute for a criminal complaint.

If the reviews are defamatory and the person behind them is anonymous, Irish law changed this year. The Defamation (Amendment) Act 2026, which the Law Society Gazette reports was signed on 19 February 2026 with most provisions commenced from 1 March 2026, gives the Circuit Court statutory power to order online platforms to identify anonymous posters of defamatory material ^[5]. Until now that kind of order, known as a Norwich Pharmacal order, generally meant a trip to the High Court.

Two caveats before anyone reaches for a solicitor. First, the Gazette notes the court can order the applicant to pay the platform's costs of the application and of complying with it ^[5], so this is not free. Second, the same Act introduces a "serious harm" test for companies bringing defamation claims ^[5], so a limited company would need to show real damage, not just irritation. Talk to your solicitor about whether either route is proportionate for your situation. For most fake-review attacks, Google's process resolves things long before a court would.

How the Week Ended

In this composite case, most of the fake reviews were removed within the week, the review pause lifted, and the rating drifted back towards where it had been as genuine pupils continued to leave feedback. The WhatsApp number went silent once it was clear nobody was paying. Every screenshot stayed in a folder on the owner's laptop, just in case.

Nothing about the outcome was dramatic. That is the point. The owner who stays calm, gathers evidence, follows the process and points customers to something they control usually comes out of this with their reputation intact. Anyone who pays, argues, or posts fake praise in return tends to make a short problem much longer.

What to Have Ready Before It Ever Happens

You cannot stop someone targeting your listing. You can decide now how ready you will be.

Bookmark the extortion report form and the Reviews Management Tool. Make sure you know which Google account manages your Business Profile and that you can actually sign in to it. Turn on review notifications so a spike reaches you on the Sunday, not the Thursday. Our roundup of the September 2026 Business Profile changes makes a related point: your website is increasingly the evidence Google uses to settle disputes about your listing.

If you do not have that page yet, you can describe your business and have a WordPress site built in under a minute, then spend the time you save collecting a few honest testimonials.

Then look at your site through the eyes of a customer who has just seen a strange rating and wants a second opinion. If what they find is current, quick and clearly yours, a fake review attack becomes an annoying week rather than a lost season.

Frequently Asked Questions

Can I get fake Google reviews removed?

Yes, if they break Google's policies. Report each one through your Business Profile or the Reviews Management Tool and pick the reason that fits, such as spam. Evaluation typically takes several days. If a review stays up, you get a one-time appeal covering up to ten reviews. Reviews that are simply negative or unfair, but written by real customers, are not eligible for removal.

What should I do if someone demands money to remove bad reviews?

Do not pay and do not reply. Screenshot every message with the date, time and sender visible, copy the links to the suspicious reviews, and submit Google's merchant extortion report form while signed in to the account that manages your Business Profile. Report the demand to the Gardaí as well, because extortion is a criminal matter, not just a platform one.

Why have new reviews been paused on my Google Business Profile?

Google pauses new reviews when its systems detect a sudden spike in spam reviews. It removes the fake content, emails the owner and shows a banner explaining the pause. The pause usually lifts within a few days. If you believe genuine reviews were removed by mistake, the alert email explains how to request a review of that decision.

Should I ask friends to leave positive reviews to balance out fake ones?

No. Posting or arranging fake reviews is a banned commercial practice under Irish consumer law, and it can make Google treat your whole profile as suspicious at the moment you need its help. Ask genuine recent customers for honest feedback instead, and never offer an incentive for a positive review.

Can I find out who posted an anonymous fake review in Ireland?

Possibly, if the review is defamatory. Since March 2026 the Circuit Court has statutory power to order online platforms to identify anonymous posters of defamatory material. You may be ordered to cover the platform's costs, and companies must meet a serious harm test, so take advice from a solicitor before starting down that route.

Should I reply publicly to a fake review?

Yes, once and briefly. State calmly that you have no record of the reviewer as a customer and that you have reported the review. Avoid accusations or sarcasm. The reply is for future customers reading the page, not for the person who posted it.

Sources