The short answer
An attack shows up as many low reviews in a short span, wording that repeats or describes no real visit, reviewer accounts that are new or review places in far apart cities, and often an outside trigger such as a viral post or a message asking for money. A bad week from real customers names dates, orders and staff, and is spread over time.
Timing signs
- Several low reviews inside a day or two, after weeks of normal traffic.
- Reviews posted at hours your business is closed, describing a visit that day.
- A burst, then silence, then another burst.
- Reviews dated on days you did not open.
- Several reviews within minutes of each other.
Sort your reviews by newest and write down the date of each low review for the last three months. A real dip in service tends to show up as a slow rise in complaints. An attack shows up as a cliff.
Google's policy names this directly: unusual volumes or patterns of reviews that point to an effort to manipulate a rating count as fake engagement.
Wording signs
- The same sentence, or the same few words, across different reviewers.
- No detail of a visit: no product, no date, no staff member, no price.
- Details that are wrong: a service you do not offer, a staff name nobody has, a branch that does not exist.
- Talk about the owner, the news or a post online instead of a visit.
- A phone number, link or offer in the text.
- Wording that sounds translated or machine written, across several reviewers.
Read the low reviews side by side. Real customers write about different things, at different lengths, in their own words. Attack reviews often share an odd phrase, the same complaints in the same order, or the same mistake about your business. One line of copied text across reviewers is the clearest sign there is, and it is what Google's policy calls repetitive content.
See which of your reviews break a rule.
The check reads every low review on your listing and labels it. Free, and nothing is filed until you pick.
Account signs
Tap each reviewer's name to open their profile. Real customers have a mix of reviews, many of them near where they live. Accounts used in an attack tend to share some of these traits.
- A brand new profile with one or two reviews.
- Reviews of businesses in far apart cities posted within days of each other. Google gives this exact example when it describes the patterns its systems watch for.
- The same review text left on other businesses.
- Names that follow a pattern, or no profile photo across the whole group.
- A low review on your listing and a high one on a direct competitor's listing, posted the same day.
Open two or three of the other businesses each account reviewed. If the same account left one star reviews on several businesses in your trade, in different cities, that is a pattern, not a customer.
Star pattern signs
A wave of one star ratings with no text at all is a common shape, because a rating without words is quick to post from many accounts. Watch your two star reviews too, since Google describes extortion waves as a rise in both one and two star reviews.
Compare the wave with your usual star mix. If your listing has drawn mostly four and five star reviews for years and the new ones are almost all one star, the change itself is a signal. Real service problems usually bring some three and two star reviews along the way.
Outside signs
- A message demanding money, goods or services to stop or remove reviews. See the guide on the WhatsApp review scam.
- A post about your business that spread online. See the guide on fake reviews after a viral post.
- A dispute with a former employee or a competitor opening nearby.
- A new listing that has been live for a short time. See the guide on fake reviews on a new listing.
Ask your team whether anyone has had odd calls, emails or messages in the past week. Demands sometimes reach the front desk or a general inbox before the owner sees them. Check your own calendar too: a local news story, a price change or a dispute with a supplier can each bring a few angry real reviews that are not part of any attack.
What a bad week from real customers looks like
Real complaints are specific. They mention the wait, the dish, the invoice, the person at the desk. They come from accounts with other local reviews. They are spread out over days and weeks, and they often line up with something you can see on your side, such as a short staffed shift. These reviews break no rule. A calm, specific reply is the tool for them, and a report will not move them. Answer them well even in the middle of an attack. A real complaint handled properly, sitting next to the fake ones, shows readers how you behave when something goes wrong.
Read every review in one pass
The free review check reads every low review on your listing and labels each one against Google's policies, so you can see in one list which reviews are part of a pattern and which are real customers. You choose which to file. If it is an attack, the guide on the first 24 hours sets out what to do next.
If only a few reviews match the signs above, you may be dealing with one or two bad actors rather than an organized attack. The response is the same at a smaller scale: label, report, reply calmly. Seeing several reviews share one label is often the quickest way to spot a pattern.