One bad review is a Tuesday. Nine in forty-eight hours is a different kind of morning, and the first thing to resist is reading them one at a time.
Individually, each review will look either plausible or suspicious and you will go back and forth. Read as a set — timing, geography, wording, star distribution — a burst usually declares what it is within ten minutes. And it matters enormously which one it is, because the correct response to a genuine bad weekend is the worst possible response to a coordinated attack, and vice versa.
There are three causes worth distinguishing.
The three, and what each one looks like
A real operational failure. Something actually went wrong — a Saturday with two chefs off, a fridge failure, a booking system double-selling tables — and twenty-odd guests had the same bad experience within a few hours of each other.
A pile-on. One incident became visible: a post that travelled, a local news item, a complaint in a community group, a staff member's behaviour recorded on a phone. Most of the people reviewing were not there. They are reacting to the story.
A coordinated attack. Accounts posting to damage you — a competitor, a sacked employee, an organised extortion attempt, or occasionally a dispute that has nothing to do with the restaurant.
The four tests, run across the set
1. Do the reviews cluster on one service, or scatter across the week?
A real failure is tight. Twenty guests who had a bad Saturday describe Saturday. The incident dates land inside one or two services even though the reviews arrive over several days.
A pile-on scatters or omits dates entirely, because most reviewers were not there and have nothing to date.
An attack often clusters by posting time rather than visit time — nine reviews posted within two hours, describing nothing in particular, sometimes referencing visits months apart or no visit at all.
The distinction to hold onto: real failures cluster on the date of the meal; attacks cluster on the date of the posting.
2. Is there a shared concrete detail, and is it the same detail?
Twenty guests from one bad service will independently name the same specific thing — the wait, the cold mains, the one unmanned section. They will describe it in different words, from different seats, with different levels of annoyance. That convergence on a detail nobody coordinated is nearly impossible to fake and is the strongest sign you are looking at something real.
Pile-ons converge on the story, not the meal. Expect the same adjective about your management, the same reference to the incident, and almost nothing about food.
Attacks converge on nothing, or on suspiciously similar phrasing. Reviews of similar length, similar vocabulary, no checkable specifics.
3. What do the reviewer accounts look like as a group?
Check the set, not each account:
| Signal | Real failure | Pile-on | Attack |
|---|---|---|---|
| Account age | Mixed, mostly established | Mixed | Often new or dormant |
| Other reviews | Normal local spread | Normal | Few, or bursts across unrelated businesses |
| Geography | Local to you | Local and wider | Frequently distant or implausible |
| Photos attached | Some, of your food | Rare | Almost never |
| Star spread | Mostly 1–3, some 2s and 3s | Heavily 1 | Uniformly 1 |
That bottom row does more work than people expect. Real bad services produce twos and threes. Guests calibrate — the one whose food was late but whose server was lovely gives three stars. A set of nine identical one-stars with no threes among them is not how a bad Saturday looks.
4. Does your own operational record agree?
The fastest test available and the one operators skip because it feels like homework during a crisis.
Pull the service the reviews describe. Covers, ticket times, staffing against the rota, any voids or comps, the manager's log. If it was genuinely bad, the evidence is there: ticket times double the norm, two no-shows on the rota, eleven comped mains.
If the service ran completely normally, you have ruled out the first cause, which is the single most valuable thing you can establish in hour one. The per-service records worth having to hand make this a five-minute check rather than an afternoon.
The first forty-eight hours, by cause
If it is a real failure
Reply to all of them, individually, quickly, conceding the specific thing. This is the one scenario where volume of replies helps you, because the reviews are accurate and visibly engaging with them is the only available repair.
Name the cause if you can do so without blaming a named person. Say what has changed. Do not offer compensation publicly to everybody — offer it in one line, privately, by inviting contact.
Then fix it, and expect the review stream to carry the memory for about six weeks. Whether a week of fixes actually worked is measurable and worth measuring, because this is exactly the situation where everyone will have an opinion.
If it is a pile-on
Reply once, publicly, in one place, and then stop. Replying individually to forty reviews from people who were never in the building amplifies it: each reply bumps the thread, reads as defensive, and gives the story another surface.
Address the underlying incident, not the reviews. Short, factual, no adjectives, no legal language, and absolutely no mention of the reviews being from non-customers — true or not, that argument always reads badly.
Do not report them en masse. A review from somebody who was not there is reportable in principle, and reporting forty at once gets you nothing while consuming the day.
Pile-ons decay. The volume typically collapses within a week and the rating recovers over a couple of months. The thing that stops the decay is the restaurant arguing.
If it is an attack
Build one file covering the whole set, not nine separate reports. A pattern is the argument here, and the pattern is only visible in aggregate: posting times within hours of each other, account ages, geographic spread, similarity of wording. The file that gets actioned looks like this.
Capture everything within the hour. Attack accounts get deleted, and the deletion does not take the review with it.
Reply to none of them, or to one neutrally. Then consider whether this belongs somewhere other than a reports queue — an extortion demand, a campaign tied to a sacked employee, or anything naming a staff member personally is a matter for advice beyond the platform, and your dated file is what makes that conversation possible.
The mistake that spans all three
Asking staff, friends and regulars to post positive reviews to dilute the damage.
It fails mechanically. A burst of five-star reviews from new accounts in the same window as a burst of one-stars is the clearest filtering signal there is, and the filter does not distinguish between the reviews you organised and the genuine ones arriving at the same time. Restaurants do this and lose real reviews.
It also fails strategically. Average rating is not where this damage lives — it lives in the recent reviews a guest reads, and a stack of short five-stars sitting under nine detailed one-stars makes the one-stars look more credible.
The awkward cases
A real failure can trigger a pile-on. The most common difficult case: a genuinely bad Saturday that someone posts about, which then draws reviews from people who were not there. You will have both at once. Handle them by review, not by burst — reply properly to the ones with a checkable visit, once publicly to the story.
Small review volumes make the tests weak. If you normally get six reviews a month, four in a day is a burst and the star-spread and account-pattern tests have nothing to work with. Lean harder on your own service records.
Being attacked does not mean nothing is wrong. Competitors tend to attack the venue that is already wobbling, and a sacked employee usually knows exactly which real weakness to describe. Check the records even when you are certain.
Not everything that disappears was removed. If reviews are vanishing rather than arriving, that is its own thing and usually benign — removal and a dry spell look identical from where you sit.
The expensive part of a burst is rarely the reviews. It is the day and a half spent deciding what kind of burst it is. OMMU flags unusual review velocity with the posting times, account histories and star distribution grouped together, which is the view that answers the question. A spreadsheet and a calm half-hour gets there too — the thing to avoid is reading them one at a time.