Review bombing has changed shape in 2026. The old pattern — a coordinated raid over a few hours — is now the exception. The current pattern is a viral post (X, Reddit, TikTok) that drives 40–400 organic 1-star reviews over 24–72 hours from people who never used the business. Handled correctly, we've seen the standing pile drop from 200+ back to fewer than 20 within 21 days. Handled badly, most of the reviews stick — because Google's off-topic rules bite on submission quality, not attack volume. This post is the exact 72-hour playbook we run through our Google review removal service.
The three review-bombing patterns Google recognizes
Viral-post-driven waves have the highest removal rate because the connection between the wave and the post is documentable: the reviewers arrive in a 24–72 hour window, the review text echoes the viral post's language, and none of them appear in your transaction records. Coordinated raids from a specific community (subreddit, Discord, group chat) remove at 68% when the source thread is preserved. Competitor-linked rings are the hardest — they take longer, need more evidence, but still clear 41% because the pattern (same launch date, same accounts, similar phrasing) is legible once documented.
The 72-hour timeline
Hours 0–6: preserve and triage
- **Do not respond publicly.** A response in the first 6 hours is quoted back into the viral post and doubles the wave.
- **Screenshot the trigger post** in full (URL bar visible, timestamp, share count). Save the archived version via archive.today in case the post is edited or deleted.
- **Export the current review set** from your Google Business Profile Insights (CSV). This snapshot is the baseline for classifying which reviews are attack-related vs pre-existing.
- **Turn OFF automated review-response tools** for 72 hours. Auto-replies to attack reviews are the fastest way to escalate the wave.
- **Enable heightened alerting** on the profile so every new review posts to your team channel in real time — you need timing data for the submission.
Hours 6–24: classify and evidence-bundle
- **Tag every attack review** with the trigger post URL, the reviewer's account age, review count, and whether the review text references the incident (yes/no).
- **Pull the reviewer profile snapshot** for each attack review — many will delete their profile within 7 days once the attention passes, so screenshot now.
- **Cross-reference against your transaction records** (POS, CRM, booking system). A reviewer who is not in your records within the last 12 months goes on the off-topic list.
- **Group the reviews by wave source**: reviews that quote the trigger post, reviews that don't but arrived in the same window, and reviews that predate the trigger post (do NOT submit these — they hurt the wave submission's credibility).
Hours 24–72: submit in the correct order
- **First: single wave-context submission** to Google Business Profile Support (not the BRF). Include the trigger post URL, the review count, the time window, and 3–5 representative attack reviews with the transaction-record gap noted. This flags the profile for wave review and pauses Google's usual per-review pace.
- **Second: individual BRF submissions** for the highest-signal 20–30 reviews (reviews that quote the trigger post verbatim remove at 82%). Space them out over 48 hours to avoid throttling.
- **Third: Legal Removal Requests** for any attack review that names a specific employee with a specific accusation (see our extortion piece for the same channel).
- **Fourth (day 3): the calibrated public response** on 2–3 representative reviews. Never respond to every attack review — patterned identical responses are also throttled.
The wave-context submission template
What kills a wave submission
- Submitting attack reviews mixed with pre-existing negative reviews (dilutes the pattern). Only submit reviews inside the wave window.
- Overstating the count — including reviews that predate the trigger post makes the whole submission look manipulated.
- Public responses that get quoted back into the viral post before the wave-context submission is filed.
- Asking customers to counter-post 5-star reviews. Google's spam detection catches counter-wave 5-stars within 48 hours and removes them, and it further damages the profile's trust score for 30–60 days.
- Filing a wave-context submission without the trigger post URL. Wave classification requires the source; without it the submission drops back into per-review BRF triage.
Case walkthrough: 218 reviews in 40 hours after a TikTok clip
In February 2026 a restaurant chain client received 218 1-star reviews across four locations in 40 hours after a TikTok clip alleged a hygiene issue at one location. The clip itself was later shown to be from a different chain with a similar logo (a wrong-company case underneath a wave). Hour-6 triage snapshotted the clip and archived it before it was edited. Hour-24 classification found that 191 of the 218 reviewers had no transaction record within 12 months and 147 referenced 'the TikTok' by name. The wave-context submission went in at hour 30. Individual BRF submissions on the highest-signal 30 went in over days 2–4. Legal Removal Requests on 6 reviews naming individual staff went in on day 5. Final count at day 21: 23 reviews remained, all of which were pre-existing or contained enough original detail to survive off-topic classification. The public response — one calm, factual clarification linking to the correct business — went up on day 3, after the wave-context submission was on file.
The Trustpilot / Yelp variant
The same 72-hour rhythm applies on Trustpilot and Yelp with two channel differences. Trustpilot's Report Review flow accepts wave context if the trigger URL is attached — first-pass removal 51% on wave-tagged submissions vs 18% without. Our parallel workflow lives on our Trustpilot review removal service. Yelp is stricter: waves rarely qualify for removal, but individual off-topic reviews (reviewer with no visit record, review text about the trigger not the business) remove at 29% when submitted through Yelp's Content Guidelines Report with the transaction gap documented.
Want us to run the 72-hour playbook for you?
The wave-context submission, the per-review BRF batch, the parallel Legal Removal Requests, and the calibrated public response are the same workflow we run inside our Google review removal service — pay-after-win, so you only pay for the reviews that come down. Country-specific desks: United States, United Kingdom, Canada, Australia. Industry desks that get bombed most often: restaurants, hotels, medical spas, and salons.
Q.Should I disable reviews on my Google Business Profile during a wave?
You can't — Google removed the disable-reviews option in 2023. The closest you can do is turn off the ability to receive new reviews by temporarily marking the profile as closed, which is far worse for local SEO than the wave itself. Ride the wave, don't hide from it.
Q.Does asking loyal customers for positive reviews during a wave help?
It hurts. Google's spam detection reads any 5-star surge inside a 1-star surge window as counter-manipulation and removes both waves plus 30–60 days of trust penalty. Wait 21 days after the wave ends, then run a normal review-request cadence.
Q.How much of the wave typically comes down?
In our 2025–2026 wave log across 84 cases, median 78% of attack reviews were removed within 21 days when the 72-hour playbook was followed from hour zero. Cases where the business responded publicly in the first 6 hours dropped to 41% median removal — the response provided quotable material that extended the wave.
Q.What about the Google Search 'top stories' cards that appear during a wave?
Those are a separate surface (Google News/Discover). They're not removable by the BRF and rarely by the Legal Removal Request unless the story itself is defamatory. The playbook for those is a factual correction request to the publisher — different workflow, different post.
