“Send $300 and the six one-star reviews disappear. Don’t pay and they stay.”
That sentence belongs in your evidence file—not in a reply to the sender.
For restaurant Google review extortion, the useful record connects a payment demand to specific reviews and the affected Google Business Profile. Six low ratings alone do not establish extortion. A threatening message alone does not identify which reviews the sender controls.
The annotated dossier below shows how to preserve that connection without overstating what you know.
Everything in this folder is fictional: the restaurant, sender, messages, dates, review text, and identifiers. Links using example.com are illustrative placeholders, not Google submission links or live reviews.
Case folder: Juniper Table / JT-EXT-001
Juniper Table is a fictional 48-seat neighborhood restaurant. On May 12, its manager receives an email demanding payment to remove six recent one-star reviews.
The manager creates one restricted-access folder:
JT-EXT-001 — Juniper Table — May 12
Inside are the original demand, sender details, a timestamp log, individual review records, and the restaurant’s Business Profile information. A short index explains where each item came from.
The purpose is narrow: make the suspected scheme understandable to someone who has never seen the restaurant’s inbox or profile.
Exhibit A: The demand, preserved as received
File: A01-demand-original.eml
Companion file: A02-demand-full-screen.png
From: Profile Restore Desk
<restore-desk@example.com>
Received: May 12, 2026, 10:14 a.m. EDT
Subject: Your restaurant ratingsYou have six new one stars. Send $300 and the six one-star reviews disappear. Don’t pay and they stay. More can come tomorrow. Reply here for payment instructions.
The manager saves the email in its original format, including available headers, and takes a screenshot showing the sender, date, subject, and complete message. The screenshot is a readable companion—not a replacement for the original.
What it establishes: Someone demanded money in exchange for removing reviews and threatened additional harm.
What it does not establish: The sender’s real identity, whether they wrote the reviews, or whether they can remove them. “Profile Restore Desk” is a display name, not evidence of authority or affiliation with Google.
Google currently advises businesses not to engage with or pay extortionists, and to preserve evidence. You do not need to reply to obtain a clearer confession. Keep the message you already received.
Exhibit B: Sender details without an identity claim
File: B01-sender-details.txt
The fictional record contains:
- Display name:
Profile Restore Desk - Email address:
restore-desk@example.com - Reply-to address: same as sender
- Available email headers: preserved in Exhibit A
- Payment destination: not supplied
- Other contact accounts: none observed
Record identifiers exactly as received. If a demand arrives through a messaging app, preserve the visible account name, phone number or handle, message dates, and surrounding conversation.
Do not click unfamiliar payment links or open attachments to complete the file.
What it establishes: The contact details used for this demand. Those identifiers may help connect later messages.
What it does not establish: That the visible sender owns the address, that an account has not been compromised, or that a phone number identifies a particular person. Leave missing fields marked “not supplied”; do not investigate by continuing the conversation.
Exhibit C: The review cluster, with individual links
Folder: C-reviews/
The manager saves six individual review links and screenshots. Each screenshot includes the reviewer’s displayed name, rating, text, and the date label Google shows.
Two entries illustrate the format:
C01 — Reviewer display name: “Mara L.”
Rating: One star
Text: “Dirty kitchen. Avoid.”
Google date label: “2 hours ago”
First observed: May 12, 2026, 9:42 a.m. EDT
Illustrative review-link placeholder:https://example.com/fictional-review/C01
C02 — Reviewer display name: “Dinner Check”
Rating: One star
Text: “Worst service anywhere.”
Google date label: “2 hours ago”
First observed: May 12, 2026, 9:46 a.m. EDT
Illustrative review-link placeholder:https://example.com/fictional-review/C02
For a real submission, save the actual Google review links—not just a screenshot of the overall rating.
What it establishes: Which reviews you suspect are connected, what they said when captured, and where they appeared.
What it does not establish: That every reviewer is fraudulent. Short text, unfamiliar names, and a sudden cluster can justify scrutiny, but they do not independently prove coordination. A genuine guest may also post during a suspected restaurant review bombing incident.
If you check reservations or orders, record the result narrowly: “No matching reservation name found.” That is not the same as “This person never visited.”
Exhibit D: The timeline, with observation separated from publication
File: D01-timeline.txt
The fictional timeline reads:
- 9:42–10:03 a.m. EDT: Manager first observes six one-star reviews.
- 10:14 a.m. EDT: Payment demand arrives.
- 10:22 a.m. EDT: Manager saves the original email.
- 10:28–10:51 a.m. EDT: Manager captures review screenshots and links.
- 11:06 a.m. EDT: Manager records the affected Business Profile details.
Use one timezone throughout. Keep exact message timestamps separate from relative labels such as “2 hours ago.”
What it establishes: The order in which the restaurant observed the reviews and received the demand.
What it does not establish: Exact review publication times when Google displays only approximate labels. Do not turn “first observed at 9:42” into “posted at 9:42.”
Exhibit E: The affected Business Profile
File: E01-affected-profile.txt
Business: Juniper Table
Location: 18 Example Lane, Test City — fictional address
Illustrative profile-link placeholder:https://example.com/fictional-profile/juniper-table
Profile identifier: Record if available
Affected location: This location only; no other branches identified
Save the actual Business Profile link for your restaurant, especially if you operate several locations with the same name.
What it establishes: Where the suspicious reviews appeared and which business needs review.
What it does not establish: That similarly named restaurants or other branches were affected.
The cover note should connect—not prosecute
A useful cover note for a Google review extortion report can stay factual:
We received a $300 demand stating that six one-star reviews would be removed after payment. Exhibit A contains the original email. Exhibit C contains the six reviews we suspect are connected, with individual links and screenshots. Exhibit D records when we observed them. We cannot independently verify that the sender controls these reviewer accounts.
That last sentence strengthens the file. It separates direct evidence from inference.
Keep original files unchanged. Put annotations in separate notes, restrict access, and exclude unrelated guest information. Your review scam evidence should explain the incident, not expose your reservation book.
Extortion reporting and review-policy reporting are different routes
Google provides a dedicated extortion-reporting channel for demands involving payment or other favors in exchange for removing negative reviews. Find the current guidance and reporting form through Google Business Profile Help by searching for “Report extortion scams.” Submit the demand, sender details, affected profile, and review evidence through that route.
Ordinary review-policy reporting serves a different purpose: it flags an individual review you believe violates Google’s content policies. Use the relevant reason honestly. A low rating is not itself a policy violation, and the extortion demand does not automatically prove every recent negative review is connected.
Neither route guarantees removal or a resolution deadline.
Your next step is not a better argument with the sender. It is a preserved demand, identifiable reviews, and a clear record of what you know—and what you do not.