Someone demands money to remove negative Google reviews: what should your business do?

How to recognize review extortion

A harsh review from a real customer and a review-extortion scam require different responses. Google describes a pattern in which several one- or two-star reviews suddenly appear and someone then demands money, goods or services in exchange for removing them. The demand may arrive by email, WhatsApp, Telegram, phone or even within a review.

Look for verifiable connections: accounts posting within a short window, repeated language, experiences that match no order, profiles attacking businesses across different countries and a message explicitly tying payment to removal. Do not turn suspicion into a public accusation. Preserve the indicators and let Google—and authorities where appropriate—assess them.

One negative review without a demand may be genuine, fake or in breach of another policy, but it is not necessarily extortion. If a real customer dispute also exists, separate it from the potential coordinated abuse. Accurate classification prevents an ordinary review case from being sent through the wrong channel.

• Sudden wave of low ratings
• Demand for money, goods or services
• Threat to publish more reviews
• Coordinated accounts, wording or timing
• Communication linking payment to removal

First response: do not pay and preserve evidence

Google recommends that merchants neither engage with malicious actors nor pay them. Payment does not guarantee that reviews will disappear and may invite further demands. Do not offer a refund, discount or service solely to buy removal: besides weakening your position, incentives for changing or removing reviews conflict with Maps policy.

Before blocking a contact, preserve the complete conversation with its date, time, identifier, number or username. Capture each review, but also save its link, author profile and date. Record when the attack began, how many posts appeared, which locations were affected and which accounts received the demand. Export messages when the application permits and preserve originals without editing.

Limit the distribution of evidence. A controlled folder with a chronological record is more useful than screenshots forwarded by many employees. Do not put passwords, verification codes, complete banking details or identity documents in an initial form. If the incident includes physical threats, unauthorized access, doxxing or immediate danger, put safety first and use the appropriate official channel in your country.

• URL for every review and profile
• Full, uncropped screenshots
• Original messages and attachments
• Timeline of reviews and demands
• Orders or records that help verify the relationship

How to submit the case to Google

Google maintains dedicated guidance and a reporting form for negative-review extortion on a Business Profile. Sign in with an authorized account, identify the affected profile and include every relevant communication. Describe observable facts: when the reviews arrived, what was demanded and how the demand was linked to removal. Avoid guessing the actor's identity or location if you cannot prove it.

Also report content that violates Maps policy. Contributions must reflect genuine experiences; fake engagement, campaigns intended to harm a competitor and incentives for posting, changing or removing reviews are prohibited. Connect each review to the most appropriate policy category. A name missing from your customer system may be an indicator, but it does not always prove by itself that no experience occurred.

Keep the confirmation and any case reference. Do not submit contradictory versions from multiple accounts. If Google asks for more information, answer with a short chronology and the relevant files. Google makes its own decisions and guarantees neither removal nor timing; clear documentation supports review, but no agency can promise the outcome.

What to communicate while the case is reviewed

Decide whether a public reply helps readers or amplifies the attack. If you respond, keep it brief and professional: say that you cannot identify an experience from the available information, invite genuine customers to use a private channel and do not repeat the threat. Never publish order numbers, phone numbers, full names or accusations of crime.

Brief reception, sales, social media teams and location managers. One person should coordinate captures, replies and communication with Google. Tell staff not to negotiate through personal accounts and that nobody should share verification codes. Audit Business Profile owners and managers, email, social accounts and domains in case the incident is paired with an access attempt.

Continue a normal, neutral request for authentic reviews from all eligible customers; do not recruit friends, employees or compensating reviews. Google prohibits rating manipulation, and selectively approaching only happy customers can create another risk. The objective is to protect the profile's integrity, not manufacture a score that hides the incident.

Spain, the United States and other markets

In Spain, INCIBE operates the confidential cybersecurity helpline 017 and publishes guidance for businesses affected by fake reviews, including preserving evidence and using platform reporting channels. When facts involve threats, fraud, impersonation or extortion, qualified counsel can assess the appropriate route. This article is general information, not legal advice.

In the United States, victims of suspected internet crime may consider the relevant law-enforcement reporting channels in addition to Google's process. In every country, a criminal, civil or regulatory report depends on facts, jurisdiction and evidence. Do not claim that every fake review automatically constitutes a crime.

Specialist help can be useful when an attack affects multiple locations, combines reviews with impersonation or leaked data, continues after reporting or requires multilingual coordination. ReputationGeo.ai can organize evidence, platform reports, replies and monitoring, but it does not control Google's decisions or guarantee removal. For an initial assessment, share public links and a timeline—not secrets or credentials.

How to turn this guidance into a responsible plan

Begin with evidence, not assumptions. Save the exact URLs, screenshots, publication dates, search phrases, review profiles and AI answers that are creating concern. Record where each item appears, who controls the source and whether the information is inaccurate, outdated, private, misleading or simply unfavorable. These distinctions matter because removal, correction, response, suppression and monitoring are different remedies. A credible adviser should explain those differences before recommending work or discussing timing.

Next, define the audience and the decision at risk. A result seen by prospective clients in Spain may require different language, sources and local signals from a result affecting investors in the United States. Decide which names, brands, locations and search questions matter most. Prioritization prevents a campaign from becoming a vague attempt to control the internet and turns it into a measurable program focused on accuracy, trust and discoverability.

Evidence, people and measurements to prepare

Create a baseline before changes begin. It can include the first two pages of Google for agreed searches, ratings and review volume, visibility of owned pages, recurring themes in AI answers and the status of platform or publisher requests. Keep personal data to the minimum necessary and share sensitive documents only through an agreed secure process. If a legal right may apply, involve qualified counsel in the relevant jurisdiction; reputation strategy does not replace legal advice.

Assign an owner for approvals, factual verification and customer responses. Review progress consistently, but do not judge the program by one daily ranking. Useful measures include corrected or removed items, response completion, the share of credible owned and independent sources, search-result composition, branded query trends and whether public information answers real questions. The objective is a more accurate and resilient digital record, not an artificial promise that criticism will disappear.

Keep a decision record, not just a list of links

For every material item, record the exact source, the factual concern, the person responsible for verification, the proposed route and the reason that route is proportionate. Include the date of any request, response deadline, platform reference number and next review date. This record prevents duplicate or contradictory reports and helps a new decision-maker understand why an item was corrected, challenged, answered, monitored or left alone.

A sound record also separates confirmed facts from interpretations. Label legal questions for qualified counsel, service failures for operational owners and public explanations for communications review. If an item changes, preserve the before-and-after evidence without collecting more personal data than necessary. This discipline is especially important when search engines and AI systems update unpredictably: it shows what actually changed and avoids claiming credit for movements that may have several causes.

• Source, URL, date and affected search or prompt
• Verified facts, disputed claims and supporting evidence
• Chosen route, owner, status and next review date
• Privacy, amplification and escalation risks