Review bomb crisis playbook — first 48 hours and recovery.

If you are reading this article right now because your Google rating just dropped from 4.6 to 2.1 overnight, or because seventy-two new one-star reviews have appeared on your Trustpilot page in the last six hours, or because your app store rating has collapsed under a coordinated campaign — stop reading linearly. Skip to the first section titled "First 60 minutes" and follow it literally. Come back to the rest later when the immediate fire is controlled.

For everyone else, this article is a complete playbook for responding to review bombs. It assumes you either have one happening now, have had one recently, or are preparing for the possibility. The structure moves through immediate response, platform-specific escalation paths, evidence packages that actually succeed with trust and safety teams, response messaging strategy, and the longer recovery phase.

What a review bomb actually is

Review bombs are coordinated campaigns of negative reviews posted to a business in a short time window — typically a few hours to a few days — by people who are not genuine customers. They differ from ordinary negative reviews in that the participants are reacting to something external (a news event, a political controversy, a viral social media post, a competitor's campaign) rather than to an actual experience with the business.

Platforms have explicit policies against this pattern. Google's review policy prohibits reviews from people without a genuine transactional relationship. Trustpilot's guidelines prohibit reviews posted "in response to external events unrelated to the buying experience." Yelp's content guidelines ban reviews motivated by "off-topic considerations." The App Store guidelines prohibit "coordinated manipulation of reviews and ratings." These policies exist because the platforms know review bombs degrade the quality of their review ecosystem. Your job in responding is to make the pattern visible to platform trust and safety teams, so they enforce policies they already have.

First 60 minutes

The first hour is evidence preservation and triage, not response. The single most common error in review bomb response is rushing to publicly reply before the team has controlled the situation, which usually makes things worse.

Designate one person as response lead. Everyone else follows their direction. This person's job for the next three hours is to coordinate, not to execute individual tasks.

Start a timestamped evidence log. Open a shared document (Google Doc, Notion, wherever your team writes). The response lead adds timestamped entries for every action taken, every communication sent or received, every screenshot captured. This log will matter both for the platform escalations and for any later legal or insurance matters.

Screenshot the affected pages immediately, at full resolution, with timestamps visible. Capture the current rating, the review count, the list of recent reviews (both normal and the bomb reviews), and the time the page was captured. Take a second round of screenshots every thirty minutes for the next six hours to document the rate of new reviews arriving.

Export review data if the platform supports it. Google Business Profile lets you download reviews as CSV. Trustpilot has an API for accounts above a certain size. Yelp does not have a direct export but screenshots work. The goal is to have machine-readable data for the evidence package you will build in hour three.

Identify what triggered the bomb. Usually this is obvious — a news event, a tweet that went viral, a post on a relevant subreddit. Sometimes it is less obvious and requires checking Google Trends for your brand name, searching Twitter for recent mentions, checking whether your competitors ran something that invited backlash. Document the triggering event and the time it went live. This becomes a central piece of the evidence package — showing that the review spike started hours after a specific public event, not from actual customer activity.

Do not publicly respond yet. Do not post on social media about the situation. Do not reply to the bombing reviews individually. Do not issue a press statement. All of those activities amplify the situation and remove your ability to handle it quietly. There is a time for public response, and it is not in the first sixty minutes.

Hours 2 to 6 — building the evidence package

The evidence package is the single document that decides whether platform trust and safety teams remove the bomb reviews or not. Platforms receive thousands of takedown requests per day. Most get rejected because the requester sent a generic complaint. The requests that succeed are the ones that make the reviewer's job easy by documenting the pattern clearly.

A strong evidence package has five components.

First, a timeline chart showing the rate of reviews arriving over the last thirty days, with the bomb spike clearly visible against the baseline. If your business normally receives two to three reviews per day and suddenly received seventy-eight in six hours, that chart tells the story by itself. Make it as a simple bar chart — review count per hour or per day — with the triggering event marked on the timeline.

Second, the triggering event with timestamp. This is the external event that the bomb is reacting to. Screenshot the original post, article, tweet, or video that kicked things off. Note the time it was published and the time bomb reviews started arriving. The gap is usually two to six hours — the time it takes for the initial audience to see the triggering content and take coordinated action. A clear temporal connection between triggering event and review spike is the most compelling single piece of evidence.

Third, the reviewer pattern analysis. Click through to the reviewer profiles of a representative sample of bomb reviewers. Document patterns: accounts created in the last 30 days, accounts with zero or one prior review, accounts with review histories showing similar coordinated activity on other targets. For Google reviews specifically, check whether reviewers are reviewing many geographically unrelated businesses. A reviewer in Germany who has never left a Google review suddenly one-starring a restaurant in Los Angeles is a red flag.

Fourth, content analysis showing that the bomb reviews do not describe actual customer experiences. Many bomb reviews are near-identical or copy-pasted from a coordinating source. Others reference the triggering event directly ("boycott this company for what they said about X"). Others contain no actual experience details — just a one-star rating with no text or with political commentary. Document these patterns with direct quotes and screenshots.

Fifth, your business context. A short paragraph explaining the business, the normal review baseline, and the damage the bomb is causing. Platforms are more responsive to documented business impact than to abstract complaints. Include the rating drop, the visible impact on sales, and the contrast with customer satisfaction metrics from internal data if available.

Hours 6 to 24 — platform escalations

With the evidence package built, begin filing to each affected platform. Do not rely on generic flag buttons on individual reviews — those go to first-line triage that rejects most requests. Use each platform's escalation path for coordinated inauthentic behavior.

Google

Google Business Profile provides a Business Redressal Complaint Form accessible through the Google Business support pages. File there, not through the per-review flag buttons. Attach the evidence package as a PDF. Use the category "fake engagement" or "coordinated inauthentic behavior." Response time is typically 3 to 14 days for a first review, faster for well-documented coordinated attacks.

Trustpilot

Trustpilot has a dedicated process for reporting coordinated attacks via their Compliance Team, accessible at trustpilot.com/trust. They have a documented "mass reporting" process for coordinated inauthentic reviews. Trustpilot is generally responsive because they have a business interest in review ecosystem quality. Response time is usually 2 to 5 days.

Yelp

Yelp has an Active Cleanup Team that handles coordinated attacks. Contact via the business owner support portal, not through individual review flags. Yelp is slower than Google or Trustpilot — typical response is 7 to 14 days — but they do act on coordinated campaigns when evidence is strong.

App Store and Google Play

Apple and Google both provide developer support channels for reporting coordinated review manipulation. Apple's App Review support is accessible through App Store Connect. Google Play's developer console has a similar escalation path. Both platforms can act quickly — within 24 to 48 hours for clear cases — because coordinated app review bombs are a known pattern they actively police.

Glassdoor

For review bombs against employer pages, Glassdoor has a Community Reviews Team accessible through the employer support portal. They require authenticated employer account verification before accepting escalation. Response time is typically 3 to 7 days.

Amazon, eBay, and marketplace platforms

Each major marketplace has its own Seller Support escalation path. Amazon's Seller Support accepts documented review-abuse reports. eBay's Seller Protection team handles coordinated feedback attacks. Response times vary but are generally 3 to 10 days.

Hours 24 to 72 — public response phase

By the 24-hour mark, platform escalations are in flight and you can consider public response. The response strategy depends on whether the triggering event was something your business did or said, or whether you were targeted without cause.

If the triggering event was legitimate business activity being misrepresented — a news story that got facts wrong, a social media rumor with no basis — the response is a short factual clarification published on your owned channels (company blog, LinkedIn) and amplified through organic sharing. Do not respond directly to the bombing reviews; respond to the underlying false claim at its source.

If the triggering event was something your business did that generated legitimate criticism, the response is more careful. Acknowledge what happened, explain what has changed or will change, and do not attempt to discredit the legitimate criticism. The bomb reviews that are clearly fake (coordinated, from non-customers, reacting to headline rather than experience) can still be escalated to platforms regardless. But the public response must be honest, because anything else will be detected and amplified.

If you were targeted without any basis — mistaken identity, confusion with another business of similar name, pure trolling — a short, calm, factual statement on your owned channels works well. You can link to the statement when platforms ask for context in the escalation.

Do not issue combative legal threats, do not publicly name and shame individual reviewers, and do not try to win an argument with an anonymous crowd. Every one of these escalations has been documented to make the situation worse.

"The right response to a review bomb is not emotional. It is procedural. Platforms have rules. Your job is to demonstrate the rules were broken."

Days 3 to 14 — the rating recovery phase

Once the bomb has stabilized and platform escalations are in progress, the next phase is rating recovery. Removal of bomb reviews restores some of the damage but rarely all of it — platforms typically remove 40 to 70 percent of flagged bomb reviews, not 100 percent, because some reviewers use more sophisticated account patterns that survive policy review.

The way to recover the rest of the rating is not to fight the remaining bomb reviews one by one, which will be futile. It is to solicit reviews from real recent customers through compliant channels. Both Google and Trustpilot have legitimate review-solicitation flows that let businesses send review requests to customers who have a genuine transactional relationship. Run a concentrated 30-day campaign inviting your recent positive-experience customers to leave reviews. The aggregate rating responds to new genuine reviews faster than most people expect.

The math is straightforward. If your rating dropped from 4.6 to 2.1 with fifty bomb reviews and you have an existing base of 200 real reviews, you need approximately 100 new four-to-five-star reviews over the next thirty days to pull the rating back to the mid-threes, and another 100 over the subsequent thirty days to get back to your baseline. This is achievable for most businesses with an engaged customer base, and it is the standard recovery pattern.

Do not buy fake positive reviews to speed up recovery. Every major platform has fraud detection that flags coordinated positive-review patterns just as reliably as coordinated negative ones, and the platform penalty for being caught doing this is worse than the rating damage it would have corrected.

Prevention and monitoring after recovery

Review bombs are rarely one-time events for brands that operate in contested spaces. If you were bombed once, you are more likely to be bombed again. Invest in monitoring infrastructure that detects bombs within the first hour of the spike starting. Modern reputation tools can alert on unusual review volume patterns within minutes; our own traceremove.io does this continuously as part of brand monitoring.

Build relationships with each platform's trust and safety team before you need them. Account managers at Trustpilot, Yelp, and Google Business Profile (for larger accounts) are much more responsive when they already know the brand and have context for escalations. This is worth investing in during peacetime, not during a crisis.

Document your incident response for internal use. The team that handled this bomb will remember the process, but in two years when the next one hits, half that team may have changed roles. A written playbook with the specific platform contacts, the evidence-package template, and the response messaging patterns that worked makes the next response much faster.

When to bring in professional help

Three situations justify external crisis support. First, when the bomb is large enough that internal capacity cannot process the platform escalations fast enough — over fifty bomb reviews across multiple platforms is typically that threshold. Second, when the triggering event involves legal dimensions (defamation, coordinated attack by a specific identifiable party, tortious interference) — bring in counsel in parallel with reputation work. Third, when the bomb is connected to ongoing business matters (M&A process, funding round, IPO, lawsuit) where reputation damage has specific monetary impact and needs to be addressed on a compressed timeline.

Reputation firms handling crisis engagements typically deploy a senior analyst within two hours of initial contact, coordinate platform escalations across all affected platforms in parallel, build the evidence package, handle response messaging in coordination with PR and legal, and run the rating recovery phase over the following two to six weeks. Crisis engagements are priced differently from standard work — premium for the speed and parallelism required.

Strategic summary

Review bombs are a known pattern with documented response playbooks. The right response is procedural, not emotional. The first hour is evidence preservation. The next five hours are building the evidence package. The next eighteen hours are platform escalations. Days two and three are measured public response. The following two weeks are rating recovery through legitimate review solicitation from real customers.

Most platforms have explicit policies against coordinated inauthentic behavior, and enforcement is real when the evidence package makes the pattern clear. Typical removal rates are 40 to 70 percent of flagged bomb reviews within two to three weeks. The rest of the rating damage is recovered through new genuine reviews over the subsequent thirty to sixty days. This is the standard pattern. It is stressful in the moment but it is well-understood territory.