The Google review extortion scam: what to do when fake reviews come with a ransom note

Natalia Piper runs a contracting business in Los Angeles. In 2025 she got a WhatsApp message from a Pakistani number telling her that someone had ordered 20 negative reviews of her company - and sure enough, her Google rating slid from a perfect 5.0 to 3.6 as the fake 1-stars rolled in. She paid. Twice, $250 total. The reviews kept coming, because of course they did: she’d just confirmed she was the kind of target who pays.

If this is happening to you right now, here’s the whole playbook in one paragraph: don’t pay, don’t reply to the WhatsApp message, screenshot everything, and file through Google’s dedicated review-extortion reporting form - launched November 2025 specifically for this scam, and reportedly fast, sometimes clearing the fake reviews overnight. The rest of this post is why each of those four steps is the right one, starting with the economics that make paying not just risky but mathematically pointless.

How the scam runs

The pattern, which hit businesses globally in a wave from roughly September 2025 on: 10 to 20 fake one-star reviews land on your Google Business Profile inside 24 to 72 hours. Then the message arrives - WhatsApp usually, sometimes email - offering to remove the reviews for a payment, often in crypto. It’s profession-agnostic: the documented victims include dog trainers, contractors, wedding DJs, lawyers, dentists, surgeons, movers, and HVAC companies. ConsumerAffairs documented the wave in September 2025, including Piper’s case. The targeting logic is simple: small, review-dependent, and emotionally invested in a rating the owner spent years building.

Why paying never works: do the supply-side math

The New York Times found a seller, Rashid Ghallu, who admitted on the record that he sells negative Google reviews at $100 per batch of 20. Sit with that number. The product being held over your head costs five dollars a unit to manufacture. When you pay $250 to make 20 reviews go away, you haven’t bought peace - you’ve revealed that you’ll trade $250 for something that costs your attacker $100 to recreate by Friday. You’re not a victim closing out an incident. You’re a customer with demonstrated willingness to pay, and your number is now worth sharing.

That’s the pattern in case after case: payment is followed by escalation, not relief. Piper’s second payment bought her nothing her first one hadn’t. There is no version of this where the scammer’s incentive is to stay bought.

What actually works now (and didn’t in 2024)

Older advice on this scam has a fatalistic streak - flag each review, wait weeks, hope. That advice is stale. In November 2025 Google shipped a dedicated reporting flow for review extortion inside Google Business Profile, treating the ransom demand itself as the evidence rather than making you argue each review’s merits one flag at a time. Early reports are that removals through this channel come quickly when the report is done right. Google has also gone after the supply side directly, suing a fake-review broker in federal court in October 2024 - this is a fraud category the platform is visibly motivated to kill.

Doing the report right means evidence, which is why the screenshots matter: capture the ransom message with the sender’s number visible, every fake review with its timestamp, and the reviewer profiles. Don’t reply to the scammer first - you want the thread frozen as received, and any negotiation muddies what is otherwise a clean extortion record. The same documentation serves you if some reviews need the ordinary flag-and-appeal route as backup; the broader fake-review identification toolkit is in our guide to handling fake reviews, and if the volume turns your whole profile into an emergency, the 72-hour crisis playbook sequences the first three days.

What to say publicly while you wait

Mostly: nothing. Replying to each fake review wastes hours and adds engagement to content that’s about to be deleted. But there’s a case for one visible note while removals are pending, because real prospects are reading your profile today. Brightside Dog Training in Mesa, Arizona - 18 fake one-stars over a single weekend, then a $400 Bitcoin demand - posted one reply on the most-visible fake review:

“This review is part of a paid extortion attack on our business - we received the ransom demand and have reported it to Google with evidence. We have no record of this reviewer, and you’ll see these reviews disappear shortly. Our actual clients are the 200+ reviews below. - Kate.”

She filed the extortion form Monday morning; 16 of the 18 were gone by Wednesday, the last two on appeal the following week. She never paid, and the attack didn’t resume. One steady, factual reply - not eighteen panicked ones. If you want help keeping that tone when your hands are shaking, there’s a threat de-escalation template worth keeping bookmarked before you ever need it.

The part nobody tells you

The scam’s real weapon isn’t the reviews - it’s the 72 hours of panic before you learn the reviews are removable. Every bad decision in these cases happens in that window: the payments, the angry replies, the desperate “reputation repair” service hired at 1 a.m. that turns out to be the same scammer wearing a different hat. The fake reviews are a solved problem with a form and a waiting period. Your composure isn’t, and it’s the only thing the scammer is actually betting on. (It’s also the skill that outlasts the incident - the same discipline behind every good reply in the negative review response playbook.)

Ghallu sells twenty reviews for a hundred bucks. The only way to make that business model fail is to be a target that costs more than it pays - and a business that documents, reports, and never wires a cent is exactly that.