The single most damaging review pattern we see is not a lone angry customer — it is a competitor running a coordinated attack from behind five to fifteen accounts over a few weeks. Individually the reviews look plausible. In aggregate they carry forensic fingerprints that Google's Conflict-of-Interest (CoI) channel will act on, if you submit them as a bundle instead of one at a time. In our 2025–2026 log, competitor-sabotage clusters removed at 74% first-pass when submitted with the full fingerprint bundle — and at 23% when submitted individually as separate spam reports. This post is the five fingerprints, how to gather them without a subpoena, and the exact CoI submission that routes correctly. This is the pattern our Google review removal service sees most often in competitive local markets.
The five fingerprints of a coordinated attack
1. Account age cluster
Click every attacking reviewer's name and check their profile. In a genuine attack cluster, 60-90% of the accounts were created within the last 60 days and have between 1 and 4 total reviews. Screenshot each profile page showing 'Contributor · X reviews' and the account's earliest visible review date. This is the highest-signal fingerprint — present in 82% of confirmed sabotage cases in our log.
2. Reciprocal 5-stars for one competitor
This is the smoking gun. In 67% of coordinated attacks, most of the attacking accounts have also left a 5-star review for one specific competing business — usually the actual competitor running the campaign. Click through each reviewer's profile, scroll their review history, and note which businesses received their 5-stars. When 4 out of 7 attacking accounts have all 5-starred 'Competitor XYZ' in the same city, that is not coincidence — that is the CoI evidence Google's reviewers act on.
3. Template phrasing overlap
Coordinated attackers reuse phrases. Look for shared unusual constructions: same odd word choice ('the service was terribly disappointing'), same specific complaint framing ('would not recommend to anyone'), same closing sentence pattern, same misuse of a technical term specific to your industry. Copy each review's text into a document, highlight the overlaps. Three or more accounts sharing a 6+ word phrase is a very strong signal — natural reviews almost never do that.
4. Timing burst
Genuine negative reviews arrive at your business's normal review velocity — usually 1-3 per week for a healthy local business, per Google Business Profile analytics. A coordinated attack compresses 5-15 negatives into 3-14 days. Pull your review timeline from GBP Insights, mark the attack window, and calculate the multiplier vs your baseline velocity. A 6x+ multiplier over a two-week window is the signal Google's algorithm itself flags — CoI reviewers cite it as corroboration.
5. Shared geographic origin
The weakest fingerprint (49% present) but useful when it is. Review each attacker's profile for photos they've posted or businesses they've reviewed with visible location data. If 4 of 7 attacking accounts have review history concentrated in the same city — especially a city that is not yours and is not a major metro — that geographic cluster corroborates the CoI theory even without IP data (which you do not have access to).
The Conflict-of-Interest submission (not spam)
Why bundle submission beats one-at-a-time
The Spam channel evaluates each review against a per-review threshold. Individual reviews in a sabotage cluster often look ambiguous in isolation — the phrasing is plausible, the account is young but real. The Conflict-of-Interest channel evaluates the cluster as a whole and applies a lower per-review bar when the aggregate pattern is strong. In our A/B: 47 sabotage clusters submitted individually as Spam removed 23% of reviews first-pass; the same 47 clusters submitted as CoI bundles removed 74% first-pass. Same evidence, different channel, 3.2x better outcome.
A sabotage cluster is not seven fake reviews. It is one coordinated violation. Submit it that way.
Case walkthrough: seven 1-stars in nine days
In March 2026 a med spa client received seven 1-stars in nine days after two years of a stable 4.8 average. Fingerprint audit: all seven accounts <45 days old, five had 5-starred the same competitor med spa 3 miles away, four shared the phrase 'inexperienced staff who did not know what they were doing,' timing burst was 9x baseline velocity, six of seven accounts had geographic concentration in a city 40 miles from the client's location (the competitor's city). CoI bundle submitted with all five evidence categories. Response 11 days later: six of seven removed. Seventh appealed with additional evidence (the seventh account posted a photo geotagged at the competitor's location), removed 8 days after appeal. Total: 7/7 removed in 19 days, average recovered from 3.9 back to 4.7 within a month.
What NOT to do
- Do NOT submit the reviews one at a time as Spam — you lose the aggregate signal and the algorithm evaluates each on its individual (weak) merits.
- Do NOT publicly accuse the competitor by name in your review responses — it creates a defamation exposure for YOU even if the accusation is accurate. Keep the accusation inside the CoI submission where it is a private evidence submission, not a public statement.
- Do NOT contact the competitor directly. It never helps and it creates an evidence trail they can use against you if the situation escalates to litigation.
- Do NOT wait to see how bad it gets. The fingerprint evidence is strongest in the first 30 days — after that, attackers often start posting genuine-looking reviews for other businesses to muddy their profile history.
When to escalate to legal
If the CoI submission is rejected and the fingerprint evidence is strong, the next step is a subpoena to Google (via a defamation or tortious interference filing) to obtain the IP addresses behind the attacking accounts. In our log, 3 of every 20 sabotage cases require this escalation, and when IP overlap is confirmed, the case usually resolves via settlement with the competitor rather than trial. See our tortious interference definition guide and how to file defamation lawsuit walkthrough for the legal path.
Want us to run the fingerprint audit and CoI submission for you?
The five-fingerprint audit, the bundled CoI submission, and the escalation-to-legal decision are the workflow we run inside our Google review removal service — pay-after-win, so you only pay for reviews that actually come down. Country-specific desks: United States, United Kingdom, Canada, Australia. Industries where competitor sabotage shows up most: med spas, dentists, restaurants, and auto repair.
Q.Can I get the competitor's IP address without a lawsuit?
No. Google will not disclose reviewer IPs without a valid subpoena or court order. That is why the fingerprint bundle matters — it is the strongest evidence you can gather without legal process.
Q.What if some of the attacking accounts don't have a reciprocal 5-star for the competitor?
Common — sophisticated attackers scrub the reciprocal 5-star before running the attack, or use accounts that never had one. Submit anyway if 3+ of the 5 fingerprints are present. The aggregate pattern is what matters.
Q.How long do coordinated attacks typically last?
Median 11 days from first to last review in our log; 90th percentile 28 days. If you're inside day 14 of an active attack, submit the CoI bundle immediately — do not wait to see if more come in. Later reviews can be added to the same case as a supplemental submission.
Q.Will removing the sabotage reviews restore my star average?
Yes. When Google removes reviews, they are excluded from the average calculation retroactively. If your average dropped from 4.8 to 3.9 during the attack and 6 of 7 sabotage reviews are removed, your average recovers to approximately its pre-attack level within 24-72 hours of removal.
