Scammers Extorted Restaurants with One-Star Google Reviews. Is this the New Normal?

“In the grand scheme of stupid things that restaurant owners have to deal with, this is just one more stupid thing.”
Restaurant Owners are at the Mercy of Google Review Scammers
Illustration by Hazel Zavala

Beverly Kim owns two restaurants in Chicago and is no stranger to the ups and downs of reviews and criticism. But a series of one-star reviews posted to her restaurant Parachute’s Google business profile in early July raised an alarm.

“My initial reaction was, are they being racist? This is a Korean restaurant; maybe people aren’t understanding it,” she said.

As it turned out, it wasn’t a racist attack, but it was a coordinated one. A new scam targeting independent restaurants across the country emerged a few weeks ago. First, scammers left multiple one-star ratings on restaurants’ Google listings. Then they emailed the restaurants to demand small cash payments in exchange for deleting the reviews.

“Hello. Unfortunately, negative feedback about your establishment has been left by us. And will appear in the future, one review a day. We sincerely apologize for our actions, and would not want to harm your business, but we have no other choice,” the emails read, before asking for $75 gift cards to be sent to an encrypted email address. “The fact is that we live in India and see no other way to survive.”

It was extortion by Google rating.

Parachute was just one of the Chicago restaurants targeted by scammers in attacks that spanned the country from San Francisco to Houston to New York.

This was going to be a story about Google’s inaction in response to the organized and widely publicized scam. As of last week many of the fraudulent ratings still appeared in search results and on Google Maps. Though Google encourages business owners to report suspicious reviews, the platform was slow to respond to frantic restaurant owners, and in some cases even said that reviews didn’t go against company policy. Now, weeks later, some targeted restaurants, including Parachute, have found the one-star reviews are finally gone.

Still, the scammers found an easy target in independent restaurants that faced headaches as they tried, unsuccessfully at first, to have the reviews removed. Weeks after the scam began, it’s revealed just how reliant restaurants are on review platforms like Google, and how little power they have to respond to bad actors. It’s a fragile system that restaurant owners rely on heavily to succeed, and one that has few checks and balances to ensure they aren’t being taken advantage of or extorted.

Some restaurant owners, Kim included, reported all the offending reviews and received responses saying that the reviews didn’t violate Google’s policies and would remain on the site. (The response asked business owners to “consider replying to the customer directly to resolve the issue.”) Despite having proof of extortion in hand, restaurants, stuck in a loop of technological customer service, were left to ignore the fake ratings, or worse, engage their extortionist, hoping they wouldn’t pile up and hurt business.

Google also recommends, obviously, that restaurants don’t pay the scammers. In an emailed statement provided on July 25, a Google spokesperson said the company was aware of the extortion scam and that its team was working “around the clock” to thwart the attacks, take down fraudulent reviews, and protect affected restaurants’ profiles, without elaborating further. “Our policies clearly state reviews must be based on real experiences, and we use a combination of human operators and industry-leading technology to closely monitor 24/7 for fraudulent content,” the spokesperson said. “We encourage users and business owners to flag suspicious activity to us, which helps us keep the information on Maps accurate and reliable.”

In this case, though, the industry-leading tech wasn’t enough to decipher extortion—at least not at first. Will it catch the inevitable next scam? If not, it becomes a more dangerous place for restaurants and risks eroding the trust that customers have placed into the rating systems.

When Zoe Schor, owner of Split-Rail in Chicago, noticed a few random reviews the day she returned to work from a short vacation, she wasn’t too concerned. After reading coverage of the scam in local media and then checking her various email inboxes, though, she realized Split-Rail had been targeted.

“What I wound up doing is putting it on Instagram,” she said, after receiving 16 one-star reviews in a single week. “I just put a call out to our followers and said, ‘listen, here’s what’s happening. If anyone feels like putting a review up, go for it. If not, no big deal.’”

Instagram content

This content can also be viewed on the site it originates from.

From the call to Split-Rail’s 8000-plus Instagram followers, customers rose to the occasion, posting 95 five-star reviews to help mitigate the damage. But the negative reviews and subsequent email threats kept coming. An email sent to Schor repeated the threatening language of the original note and directed her to a different email address after the first was, presumably, disabled. “And yes, we are continuing our work,” it read. Schor kept reporting each instance of fraud, flagging fake reviews and emailing Google with proof of the extortion, receiving automated responses. (As of this week the fraudulent one-star reviews are gone.)

For internet-savvy restaurant owners like Schor, putting out an online call to customers helps lessen the blow of these one-star reviews. But for restaurant owners who don’t have a social media presence or aren’t comfortable on the internet, the situation could cause strife and serious loss of business without the recourse of a loyal group of online followers to step in and help.

It’s alarmingly easy to rate any business on Google. It takes under 15 seconds for someone with a Google account to add a star rating to any restaurant, without any proof that they ate there or even were in close proximity to the business. I know because I just did it. In fact, in the time it’s taken you to read to this point, a motivated “reviewer” could have left bogus ratings on four or five listings.

“There’s a hobby around this,” said Prasad Vana, an associate professor of business administration at Dartmouth who studies online reviews. A cute cafe on a remote Pacific island, for example, might have hundreds of reviews from people who say they were browsing Google and stumbled upon it, adding a review out of boredom. They’re usually not malicious, but they’re also not honest or helpful.“If you make your review platform open to anybody anywhere, you will get these kinds of things,” he said.

Whether the reviews are true or not, they carry real weight. In his research, Vana has found that the first few reviews that are displayed on a review platform can be quite powerful when it comes to affecting customer choice. “A one-star versus a five-star, that’s a huge effect on purchase likelihood,” he said. This particular study focused on retail, but Vana said the same principle applies to restaurants. That means it’s up to the tech company to determine if the review is legit. Blocking reviews that can’t be verified or giving more weight to reviews that can be verified would improve those chances, he said.

Google’s spokesperson did not answer specific questions about how ratings are calculated or whether diners who leave reviews with photos or other context that indicate actually visiting an establishment are weighted more heavily than those that simply click a star and move on.

The sheer volume of reviews on Google, the most well-known service on the internet, poses an interesting problem. Making it easy to leave a review or rating means more people will do it, boosting numbers and, in theory, creating a realistic picture of a business online. Google says it removed or blocked 95 million fraudulent reviews last year, including 1 million that were flagged by businesses. It permanently disabled more than 1 million user accounts connected to nefarious behavior. But it clearly can’t catch them all, and a restaurant’s rating and reviews show up prominently all over Google. What someone behind a keyboard or mobile phone sees as a way to kill some time or make a quick buck could easily damage a restaurant’s business.

Some sites have put guardrails on user reviews to reduce the chances of bogus ratings. Yelp requires at least a few words to be added to a star rating. (Last year the average Yelp review was about 500 characters.) On OpenTable or Resy, only diners who showed up for their prebooked reservations can review or rate their experience. Verified diners can send private feedback directly to the restaurant instead of posting publicly, a feature that Parachute’s Kim appreciates.

If it’s easy enough to game the system, what’s the point of online reviews? They might not be objective—they may not even be real. This round of extortive reviews may have been taken down, but there’s not much evidence that suggests big tech companies are considering some sort of structural change to an imbalanced system. Instead, vulnerable independent restaurants end up at the mercy of reviewers.

“We put so much faith in these machines and these systems that are all so arbitrary and subjective. In the grand scheme of stupid things that restaurant owners have to deal with,” Schor says, “this is just one more stupid thing.”