Google now runs a dedicated Merchant Extortion Contact Form because coordinated review-extortion attacks against small businesses have grown common enough to demand one. The scam hits plumbers, dental clinics and other local operators with a specific, repeated pattern: fifteen or more 1-star reviews land within a 24-hour window, and a payment demand follows shortly after.

The attack is not random negativity. It is extortion built on a business's most visible asset — the star rating on its Google Business Profile. One case cited by practitioners shows a rating dropping from 4.8 to 3.2 overnight, with calls and leads stopping in tandem.

How does the scam operate?

The attack follows a documented three-stage sequence.

• The network. Reviews come from fake profiles that often carry WhatsApp numbers or suspicious links directly in their bios. In one documented example, every attacker profile used the same profile picture, and that image contained a WhatsApp contact number.
• The extortion. Shortly after the reviews appear, the scammer contacts the owner via WhatsApp or email and offers removal for a price.
• The "alternative." Some scammers offer to swap the negative reviews for fake 5-star reviews, reframing extortion as a reputation-management service.

The reviews themselves are engineered to defeat detection. Scammers write full paragraphs with fabricated, detailed accounts of poor service, mimicking the tone of a genuine customer so Google's automated spam systems do not flag them immediately.

The Federal Trade Commission has researched the wider problem and found fake reviews and deceptive endorsements cost the economy billions in lost consumer trust and diverted revenue.

Why doesn't Google catch these attacks?

Google's automated detection is the first line of defense, and these attacks are built to slip past it. Because the reviews read like real customer complaints, the AI filters often let them through. That shifts the burden of proof entirely onto the business owner, who must document the fraud and force a manual review.

This is where the impact becomes concrete rather than technical. When a rating falls from 4.8 to 3.2 overnight, consumers click the profile less, leads dry up and revenue drops — a cascade the owner experiences as a threat to livelihood, not a dashboard anomaly.

What should a targeted business do?

Practitioners recommend three steps, and in every case where owners followed all three, the fraudulent reviews were eventually removed. The first instruction is absolute: do not pay the scammers and do not engage with them.

Step 1 — Flag every individual review. Flagging one review is not enough; every fake review in the attack must be reported individually. Click the three dots next to the review, select "Report Review," and choose "Spam or Off-topic." Staff members or trusted associates should also flag the reviews from their own devices to strengthen the signal to Google.

Step 2 — Report the reviewer profiles. Scammers reuse the same accounts across multiple victims, so reporting the profile itself is often more effective than reporting a single review. This only works in the Google Maps mobile app: open the reviewer's profile, tap the three dots in the top right corner, and select "Report profile."

Step 3 — File the Google Merchant Extortion Form. Google created this dedicated channel specifically for businesses facing blackmail. Response times vary, but the form places the case in a specialized extortion queue rather than the general review-removal pipeline.

What evidence actually moves Google to act?

Community documentation is the most effective tool available, practitioners report. When businesses record patterns — the same WhatsApp numbers appearing across different business profiles, identical profile images, reused account names — those details can be published and submitted as evidence, prompting Google to act against entire networks rather than single reviews.

The consistent outcome data point matters: every case in which an owner diligently completed all three steps ended with the fraudulent reviews removed. Payment, by contrast, funds the network and invites repeat attacks.

Local businesses should monitor their review velocity daily, treat a sudden cluster of 1-star ratings within 24 hours as a likely attack rather than a reputation problem, and capture screenshots, profile names and contact numbers before they file. The Merchant Extortion Form and pattern documentation remain the strongest levers to watch as Google scales its response to these networks.

By Nathan Brooks