Google Review Extortion: The Anti-Blackmail Protocol

September 7, 2026 Pierre MADI 10 min read

Summarize this article with AI:

ChatGPTPerplexityClaudeGrok

How the scam works, step by step

The scenario is always the same. And it has been documented since late 2025 in France, Switzerland, the United States, and a dozen European countries.

Step 1 - The wave. Within hours, sometimes minutes, your Google profile receives 5, 10, 20 one-star reviews. The profiles are empty, created the same day, often geolocated on the other side of the world. The texts are generic or written in broken language, increasingly generated by AI.

Step 2 - The contact. Within 24 to 72 hours, you receive a WhatsApp message, a text, or an anonymous email. The tone is polite, almost commercial: "Your rating has dropped. We can remove everything for $200." Some offer a per-review rate, around $50 each.

Step 3 - The pressure. If you don't respond, the follow-ups keep coming. New waves of reviews, threats to escalate, countdowns. This is targeted digital terrorism, and it aims at one precise point: your panic.

According to French media investigations (Le Journal du Net, February 2026) and Swiss public broadcaster RTS (December 2025), the victims are mainly tradespeople, independent professionals, and local businesses: plumbers, electricians, dentists, restaurant owners. Government cybercrime assistance platforms confirm a significant rise in reports since 2025. RTS traced one extortion network back to Pakistan, operating simultaneously across six countries.

Why does it work? Because your Google rating has become a critical asset. A rating that drops from 4.8 to 3.9 in 48 hours means calls that stop and customers who defect to the competitor. The attackers know this. They also know Google often takes two weeks to a month to process a report. That slowness is what they monetize.

7 signals that prove it's extortion

Before acting, confirm the attack. One signal alone isn't enough - it's the combination of indicators that matters.

1. The timing. Reviews arrive in a burst: 5 to 20 negative reviews in under 24 hours, on a profile that used to receive 2 reviews a month.
2. The profiles. Accounts with no photo, no history, recently created, with generic names or foreign names inconsistent with your customer base.
3. The texts. Vague, with zero concrete detail about your service, your products, or your premises. Often machine-translated.
4. The geolocation. The reviewers are based in countries where you've never had a customer.
5. The message. A demand for money, bitcoin, or a "cleanup service" arrives within days.
6. The explicit threat. "Pay or we continue": as soon as this sentence appears, you're facing textbook extortion.
7. The impossibility to verify. None of these "customers" appear in your sales history, bookings, or quotes.

If you check 3 signals or more, this isn't a rough patch. It's an organized attack. To go deeper on detection, read our complete guide to detect and report fake Google reviews.

Why you must never pay

It's the most natural reflex and the worst possible decision. Here's why.

Paying removes nothing. Nothing forces the scammer to remove the reviews once paid. In most documented cases, the reviews stay online - or reappear a few days later.

Paying marks you as a profitable target. Your number enters a list of "payers" resold to other networks. The same attack returns, at a higher price.

Paying funds the system. Every ransom paid finances the next campaign against another business owner. This is a business model - don't feed it.

Paying complicates the legal aftermath. A payment can be interpreted as tacit acknowledgment and weakens your case if you file a complaint afterward.

Google is unequivocal on this point: never interact with blackmailers, never send money. Cybercrime assistance platforms say the same. The only response to extortion is procedure. Not your wallet.

The 5-step response protocol

Here is exactly what to do, in order, from the first hours of the attack.

Step 1 - Document everything, immediately

Before any report, build your evidence file:

• Timestamped screenshots of each suspicious review (date, time, visible username)
• Screenshots of each reviewer's profile (empty history, creation date)
• Complete captures of the blackmail messages (WhatsApp, SMS, email) with the number or address visible
• A written timeline: date of the first review, date of the first message, amounts demanded

This evidence will serve three times: for Google, for the police complaint, and for your insurer if you have one.

Step 2 - Don't reply and block

Block the WhatsApp number or email address immediately after capturing the evidence. No negotiation, no response, no provocation. Silence is your best posture: it feeds neither the scammer's hope nor their file against you.

Step 3 - Report to Google via the dedicated form

Since November 2025, Google has operated an official extortion reporting form for merchants - a specific channel, separate from the standard review flag. For proven blackmail cases, this is the one to use:

1. Log into the account associated with your Google Business Profile
2. Access the extortion reporting form from Google Business Profile Help ("Report a review scam")
3. Describe the situation: review wave, money demand, timeline
4. Attach your screenshots
5. In parallel, flag each review individually from your dashboard (three dots > "Report review" > "Fake review / spam")

Announced processing time: 3 to 7 business days for individual flags, variable for the extortion form. A well-documented file significantly speeds up processing.

Step 4 - File a police complaint

Extortion is a serious crime in virtually every jurisdiction. In France, it carries up to 7 years imprisonment and a €100,000 fine (article 312-1 of the Penal Code). In the US, report to the FBI via IC3.gov and to the FTC at ReportFraud.ftc.gov. In the UK, contact Action Fraud. Most countries now operate an online cybercrime reporting portal.

Even when the perpetrators are abroad (Pakistan, Bangladesh, India in most documented cases), the complaint matters: it feeds international files and is essential if you later take legal action against Google for inaction.

Step 5 - Respond publicly, once

Your rating suffers during processing. Neutralize the impact with a single factual public response, posted under one of the fraudulent reviews:

"Our business is currently the target of a coordinated fake review campaign with extortion intent, reported to Google and to the relevant authorities. We invite our customers to contact us directly with any questions."

This message is really addressed to your genuine prospects: it turns an attack into a demonstration of professionalism. For the other reviews in the wave, follow our method to respond to a negative Google review without mentioning the blackmail in each individual reply - one public response is enough.

Your legal arsenal

Beyond extortion itself, the law gives you several levers.

Hosting provider liability. In the EU, Google as a hosting provider must remove "expeditiously" any manifestly illegal content once it has knowledge of it (e-Commerce Directive, now strengthened by the DSA since 2024). Your documented report acts as official notification. If Google delays unreasonably, its liability can be engaged: on May 22, 2025, the Chambéry Court of Appeal ordered Google to pay €10,000 in damages to a dentist whose profile, created without her consent, had been targeted by negative reviews.

Defamation and unfair competition. Fake reviews qualify as defamation or, when the author is a competitor, unfair competition. Watch the statute of limitations: it is very short for defamation in several countries (3 months in France). Document fast.

Emergency injunctions. If the damage is imminent - measurable drop in activity - you can seek an emergency injunction ordering content removal in about a month. This is the fastest route when Google doesn't react.

The DSA regulation. Since 2024, the EU Digital Services Act imposes strengthened reporting obligations on major platforms. One more pressure lever to mention in your letters.

For the French framework specifically, see our article on French online review legislation.

Prevention: the statistical shield

Field truth, after supporting hundreds of cases: an extortion attack hurts in proportion to how thin your review base is.

A business with 30 reviews that absorbs 15 one-star reviews watches its rating collapse from 4.7 to 3.4. A business with 400 reviews absorbs the same wave by moving from 4.7 to 4.6. The volume of authentic reviews is a statistical shield: it mechanically dilutes every attack.

Prevention runs on four workstreams:

1. Collect continuously. A steady flow of authentic reviews (5 to 15 per month minimum) makes your rating robust. Our review collection service automates exactly that.
2. Monitor 24/7. An attack detected at H+2 is manageable; discovered at D+15, it has already cost you customers. Real-time alerts are at the core of our reputation management and protection offering.
3. Secure your access. Two-factor authentication on your Google Business Profile account, and regularly review which users have access to your profile.
4. Measure your exposure. Our express reputation audit assesses in 2 minutes your rating, your review volume, and your vulnerability to an attack.

And if you welcome customers in person, Saphek NFC cards remain the fastest way to turn satisfied customers into authentic reviews - every additional genuine review is another layer of armor.

On your own: you endure the wave, hunt for the right form, draft your reports, wait weeks, and your rating drops in the meantime.

With Saphek: instant detection of the wave, evidence file built for you, reports and the extortion form handled by our experts, public responses drafted, and a flow of authentic reviews that rebuilds your rating. Discover management & protection.

Quiz: are you vulnerable to an attack?

FAQ - Google review extortion

Pierre MADI

Founder & Online Reputation Expert, Saphek

Pierre MADI is the founder of Saphek, an online reputation agency for SMBs. He has spent over 5 years helping hundreds of businesses protect their online reputation against attacks and fake reviews.

Discuss my protection with Pierre