A dermatology client called us on a Sunday, close to tears. Over the weekend her practice had picked up fourteen 1 star reviews. No comments on most of them, just the single star. The few that had words were vague, the kind of thing that could be said about any office anywhere. Not one of the names matched a patient in her system. Her rating had gone from a hard earned 4.8 to a 4.2 in about thirty six hours.
This is review bombing, and if it has happened to you, take a breath. It is upsetting, it feels like an ambush, and it is happening more often to healthcare practices. But it is not the end of your reputation, and the worst thing you can do is react in a panic. Let us walk through what it is, why it happens, and the exact steps that get you back to solid ground.
What review bombing actually is
Review bombing is a sudden flood of coordinated negative reviews, almost always 1 star, dropped on a business in a short window. The key word is coordinated. This is not five real patients who had a rough month all deciding to speak up at once. It is a spike that does not match your actual patient flow, usually from accounts that have never set foot in your office.
For a medical practice, it tends to come from one of a few places:
- A disgruntled former employee who leaves and encourages friends to pile on.
- A single upset person who rallies a group online, most of whom were never treated by you.
- A competitor playing dirty, though this is riskier and rarer than people assume.
- A spam or extortion ring that hits random businesses with fake 1 star reviews, then messages the owner offering to make them disappear for a fee. Do not ever pay these people.
- A misdirected mob that confuses you with another business that made the news, and aims at the wrong target entirely.
The common thread is the pattern, and the pattern is your best evidence. Real reviews trickle in over time and describe specific experiences. An attack arrives in a clump, often with no detail, from profiles that review a hundred unrelated businesses or have no history at all.
Why this matters more than it used to
Patients lean on reviews to choose a doctor now, more than most owners realize. Year after year, the BrightLocal Local Consumer Review Survey finds that the large majority of people read online reviews before choosing a local business, and that many trust them nearly as much as a recommendation from a friend. In healthcare, where trust is the whole product, a score that suddenly reads 4.1 with a stack of angry 1 star ratings on top can send a nervous new patient straight to the practice down the street.
The damage is real but it is usually temporary, and there is a reason to be hopeful. Google does not want fake reviews on its platform any more than you do, because junk reviews make Google less useful. The company reported that it blocked or removed more than 170 million reviews that violated its policies in 2023 alone, using a mix of automated systems and human review. Fake content is against the rules, and the rules have teeth. Your job is to point the system at the right reviews and let it work.
The first hour: do these things, skip these things
Speed helps, but calm helps more. Here is the order that works.
Document everything first. Before you flag a single review, take screenshots of all of them, with the reviewer names, dates, and the timestamp. If the reviews get removed later, which is the goal, you will lose your evidence. Save it now in case you need it for an appeal or, in a serious case, for the police.
Flag each fake review through Google. Open your Google Business Profile, find each review, and report it. The policies that matter to you are the ones against fake engagement, spam, off topic content, and reviews from people with a conflict of interest or no genuine experience. You can read them straight from Google in the Google review content policies. Flag them one by one and note which policy each one breaks.
Escalate, do not just wait. Flagging drops the review into a queue that can be slow. Follow up by contacting Google Business Profile support directly and, when the attack is clearly coordinated, use the review removal request tool to lay out the pattern with your screenshots. A short, factual message that shows a spike of ratings from non patients gets further than an emotional one.
And the things not to do in that first hour: do not pay anyone who promises to remove the reviews, do not post a furious public reply, do not go silent and hope it blows over, and do not, under any circumstances, buy fake 5 star reviews to balance the scale. That last one can get your whole profile suspended and now violates federal rules too. The FTC rule banning fake reviews and testimonials, finalized in 2024, carries real penalties for buying or selling them. Two wrongs make a lawsuit.
How to respond publicly without making it worse
You do not need to reply to all fourteen. Replying to two or three of the loudest ones is plenty, and the audience is not the attacker. It is the next real patient who scrolls down, sees the pile of 1 stars, and reads your reply to decide whether you are a steady professional or someone who loses their cool.
Keep it short, warm, and boring on purpose. Something like: "We take all feedback seriously and want to make things right, but we have no record of you as a patient at our practice. If we are mistaken, please contact our office directly so we can help." That single reply does three jobs at once. It signals to readers that the review is likely fake, it shows you are calm and reachable, and it never once confirms or denies that anyone was a patient, which protects you from a privacy misstep.
That privacy line is not optional. Never confirm someone was a patient, never reference a visit, a diagnosis, or a treatment, and never argue the facts of a case in public. Doing so can turn a fake review problem into a HIPAA problem, which is far worse. When a review is clearly not from a real patient, saying you have no record of them is both true and safe. We go deeper on the tone and legal side in our guide on whether fake reviews are hurting your medical practice, and on speed in how fast you should reply to a Google review.
The long game: why some practices barely feel an attack
Here is the part nobody wants to hear in the middle of a crisis, but it is the most important. The practices that survive a review attack without a scratch are the ones that built a deep, current bank of real reviews before it ever happened.
Think about the math. If you have 40 reviews at a 4.9 average and someone drops ten fake 1 star ratings, your score dips but holds in the 4s and recovers within weeks as removals go through and new real reviews come in. If you have 12 reviews and take the same ten hit, your rating craters and looks like a different practice overnight. Volume is armor. A steady flow of honest reviews from happy patients is not just good for ranking, it is your insurance policy against the bad day you cannot predict.
The other half is awareness. Most owners find out about an attack days or weeks late, once a patient mentions it or they happen to check. By then the damage has been sitting there, unanswered, for anyone to see. Set up alerts so a spike pings you within hours, and keep your Google Business Profile claimed, verified, and complete so you always have full access to flag and appeal. This is exactly the kind of work that lives inside local SEO and reputation: a system that watches your reviews, asks the right patients at the right moment, and responds fast when something breaks.
Where EtherealMinds fits
We handle this for practices as part of the reputation side of our patient acquisition system. That means an automatic, gentle way to invite happy patients to leave a review right after a good visit, so your real score keeps climbing and stays deep enough to shrug off a few fakes. It means monitoring, so an unusual spike reaches a human the same day instead of next month. And it means calm, policy correct replies and removal requests when an attack does land, written to protect your privacy obligations while pushing the fakes off your profile.
An attack feels like it is about the fourteen reviews from last weekend. It is really about the hundred real patients who will read your profile next month. Win those, and the weekend fades. We wrote more on the mindset in whether patients read negative reviews before booking, and it is worth the five minutes.
Do this today, even if you have never been hit
Open Google Maps and search your practice like a patient would. Look at your review count and your average. If you have fewer than 30 or 40 recent reviews, you are exposed, and fixing that is the single most useful thing you can do before anything goes wrong. Then check that your Business Profile is claimed and that you would actually notice if ten reviews landed tomorrow. If the honest answer is that you would not, that is the gap to close.
A review attack is a bad day, not a death sentence. Document, flag, escalate, reply once with a level head, and keep the real reviews flowing. The practice that does the boring reputation work every week is the one that barely notices the weekend someone tried to tear it down.
Worried your reputation could not take a hit?
Book a free strategy call. We will look at your reviews the way a new patient does, tell you honestly how exposed you are, and show you how we build and defend a practice reputation that holds up on a bad day. Clear, honest, no jargon.
Book a free strategy call →