Fake review bombing can feel like an ambush: one day your restaurant, clinic, hotel, store, or service business has a healthy online rating; the next day, several anonymous accounts accuse you of being a “scam,” “unsafe,” “dirty,” “unlicensed,” or “dishonest.” In the Philippines, not every bad review is illegal, but coordinated fake reviews, false factual accusations, impersonation, and competitor-driven attacks can lead to platform takedowns, civil damages, criminal cyber libel complaints, unfair competition claims, and cybercrime investigation. The key is to move quickly, preserve evidence properly, and choose the remedy that matches what actually happened.

What counts as fake review bombing?

Fake review bombing is a coordinated or suspicious flood of negative online reviews meant to damage a business rather than share a genuine customer experience.

It commonly appears on:

Google Business Profile
Facebook pages
TikTok, Instagram, or X posts
food delivery apps
hotel and travel platforms
marketplace seller pages
app stores
Reddit, forums, and community groups

A bad review is not automatically illegal. A real customer may honestly say:

“Service was slow.”
“The food was cold.”
“The staff was rude.”
“I did not like the product.”

Those statements may be unpleasant, but they are often treated as opinion or fair comment based on experience.

The legal problem becomes stronger when the review contains false factual claims, such as:

“This business is a scam.”
“They stole my money.”
“They sell fake products.”
“The doctor is unlicensed.”
“The restaurant caused food poisoning,” when the reviewer never ate there.
“They use expired ingredients,” with no basis.
“They refuse refunds,” when no transaction happened.
“The owner is a criminal,” without proof.

The strongest cases usually involve a pattern: newly created accounts, similar wording, reviews posted within a short time, reviewers with no record of visiting the business, links to a competitor, or threats demanding money, free service, or a refund in exchange for deleting the reviews.

Is fake review bombing illegal in the Philippines?

It can be. Philippine law does not have one single statute called a “fake review bombing law,” but several laws may apply depending on the facts.

The most common legal bases are:

Situation	Possible legal remedy
False online accusation that harms reputation	Cyber libel under RA 10175 and the Revised Penal Code
Coordinated false reviews by a competitor	Civil damages, unfair competition, or IP Code remedies
Anonymous accounts pretending to be customers	Platform takedown, cybercrime investigation, possible identity-related offenses
Fake page or account using your business name/logo	Impersonation, trademark/unfair competition, platform enforcement
Threats to post bad reviews unless paid	Grave coercion, unjust vexation, extortion-related theories, or other applicable crimes depending on the threat
Posting staff/customer personal data	Data Privacy Act issues and possible NPC complaint
Hacked business account used to post damaging content	Illegal access or other cybercrime offenses

The practical question is not simply “Is this illegal?” It is: Can you prove who did it, what was false, how it harmed the business, and which legal route gives the fastest useful result?

Legal basis for cyber libel against fake online reviews

Cyber libel is the online version of libel. Under Article 353 of the Revised Penal Code, libel is a public and malicious imputation of a crime, vice, defect, act, omission, condition, status, or circumstance that tends to dishonor, discredit, or bring contempt upon a natural or juridical person. A juridical person includes entities such as corporations. Article 355 punishes libel committed through writing, printing, and similar means. (Lawphil)

RA 10175, the Cybercrime Prevention Act of 2012, applies when libel is committed through a computer system or similar digital means. In Disini v. Secretary of Justice, the Supreme Court upheld cyber libel but limited its reach, including rejecting liability for mere recipients or passive reactors to a libelous post. (Lawphil)

For a fake review to become cyber libel, prosecutors usually look for these elements:

Defamatory imputation The review must say or imply something that harms reputation, such as dishonesty, fraud, criminal conduct, professional incompetence, unsafe practices, or immoral conduct.
Identifiability The business, owner, manager, professional, branch, or brand must be identifiable. Naming the business is obvious, but a post can still identify a target through location, photos, initials, screenshots, or context.
Publication The statement must be communicated to at least one person other than the target. A public Google review, Facebook post, TikTok comment, or marketplace review usually satisfies this.
Malice Philippine libel law generally presumes malice in defamatory imputations unless good intention and justifiable motive are shown. Fake accounts, repeated posting, refusal to correct falsehoods, and evidence of competitor involvement can support malice.
Use of a computer system Because the review is posted online, RA 10175 may apply.

A review saying “I did not like their service” is usually very different from “This store steals from customers.” The first is likely opinion. The second accuses the business of criminal or dishonest conduct and may be actionable if false.

Important deadline: cyber libel prescribes in one year from discovery

The Supreme Court has affirmed that cyber libel prescribes in one year from discovery by the offended party, authorities, or their agents, not 12 or 15 years. The Court explained that cyber libel is not a new crime separate from libel; it is libel committed through a computer system. (Supreme Court of the Philippines)

For a business, this means you should document the date you first discovered the fake review. Do not wait months before preserving evidence or filing a complaint if the post is serious.

Civil remedies: damages, injunction, and unfair competition

Criminal cyber libel is not the only remedy. In many business cases, the more practical goal is to stop the attack, remove the false reviews, recover losses, and prevent repetition.

Civil Code remedies

The Civil Code gives several bases for damages:

Article 19 requires everyone to act with justice, give everyone their due, and observe honesty and good faith.
Article 20 makes a person liable for damages caused wilfully or negligently contrary to law.
Article 21 covers wilful acts causing loss or injury in a manner contrary to morals, good customs, or public policy.
Article 28 specifically provides a right of action for unfair competition in commercial enterprises through deceit, machination, or other unjust, oppressive, or highhanded methods.
Article 33 allows a separate civil action for damages in cases of defamation, fraud, and physical injuries, independent of the criminal action and proven by preponderance of evidence. (Lawphil)

A civil case can claim:

actual damages, such as lost sales or cancelled bookings
moral damages, when allowed by law and proven
exemplary damages in proper cases
attorney’s fees and litigation expenses, when justified
injunction or restraining orders to stop further false posting
removal, correction, or cessation of specific false statements when legally proper

IP Code and unfair competition

If a competitor is behind the campaign, the Intellectual Property Code may matter. Section 168 of RA 8293 protects goodwill and treats as unfair competition acts that use deception or means contrary to good faith. Section 168.3(c) specifically covers false statements in the course of trade or other acts contrary to good faith calculated to discredit another’s goods, business, or services. Section 169 also covers false or misleading descriptions or representations of fact in commerce. (Lawphil)

This can be useful when the fake reviews are not merely personal insults but part of a commercial attack, such as:

a competing salon posting fake “infection” reviews
a rival seller accusing another seller of counterfeit goods
a hotel competitor posting false safety complaints
an agency creating fake client reviews against another agency
a business using dummy accounts to push customers away from a rival

Step-by-step guide: what a Philippine business should do first

1. Do not delete, argue, or threaten immediately

Your first reaction matters. Avoid posting an emotional reply like “We will sue everyone!” or revealing the suspected reviewer’s personal details. That can create a separate privacy, harassment, or defamation issue.

A safe public response is short and factual:

“We have no record of this transaction under the details provided. We take all customer concerns seriously and are checking this matter through the proper channels.”

This protects your brand without escalating.

2. Preserve evidence before reporting the reviews

Platforms may remove fake reviews after a report. That is good for business, but bad for evidence if you did not save proof first.

Preserve:

full-page screenshots showing the review, rating, date, URL, and business profile name
screen recordings scrolling from the business page to each review
reviewer profile URLs
visible usernames, display photos, review history, and timestamps
links to related posts, comments, shares, or messages
screenshots of sudden rating drops
customer inquiries mentioning the fake reviews
analytics showing traffic, booking, or sales decline
internal records showing the reviewer was never a customer
CCTV, booking logs, invoices, POS records, delivery records, or appointment calendars

The Rules on Electronic Evidence place the burden of proving authenticity on the person presenting an electronic document, so screenshots should be organized, traceable, and supported by affidavits from the person who captured them. (Lawphil)

3. Make an evidence matrix

Create a simple spreadsheet:

Review URL	Date seen	Username	Exact statement	Why false	Evidence disproving it	Possible witness
Google review link	2026--	“Juan D.”	“They stole my deposit”	No booking under name	Booking records, cashier log	Admin staff
Facebook comment	2026--	“Maria S.”	“Unlicensed clinic”	License valid	PRC/DOH documents	Compliance officer

This helps platforms, lawyers, police investigators, and prosecutors understand the case quickly.

4. Report through the platform’s official process

Report the reviews as fake, spam, conflict of interest, harassment, impersonation, or defamatory content, depending on the platform’s available categories.

For Google, Facebook, marketplaces, and booking apps, include:

the exact review links
proof the reviewer was not a customer
proof of duplicate or coordinated wording
proof of conflict of interest, if known
business registration or proof of ownership of the page
a calm explanation of why the review violates platform rules

Takedown timing varies widely. Some platforms act within days; others require repeated reports, business verification, or escalation. A platform takedown does not automatically identify the person behind the account.

5. Send a demand or preservation letter when the attacker is identifiable

If you know who posted the fake reviews, a formal letter may demand:

immediate deletion of the false reviews
written undertaking not to repost
preservation of accounts, devices, messages, and communications
correction or retraction
payment for documented damages, when appropriate

Use care. A demand letter that overstates facts, threatens illegal action, or is later posted online can worsen the dispute. In some cases, especially where evidence may be destroyed, it may be better to file with investigators first.

6. File a cybercrime complaint with NBI or PNP-ACG

For anonymous or serious attacks, businesses usually go to:

NBI Cybercrime Division / Regional Cybercrime Centers
PNP Anti-Cybercrime Group
Office of the City or Provincial Prosecutor
DOJ Office of Cybercrime, especially for coordination and cross-border cybercrime matters

The NBI Citizens Charter for computer crime victims indicates that complainants fill up complaint forms and submit them to the proper personnel, while cybercrime complaints in practice commonly require a sworn complaint-affidavit and supporting evidence. (National Bureau of Investigation) The DOJ Office of Cybercrime was created under RA 10175 and acts as a central authority for cybercrime-related coordination. (Department of Justice)

Common filing documents include:

Document	Purpose
Complaint-affidavit	Your sworn narration of facts
Valid government ID of complainant/representative	Identity verification
DTI certificate, SEC documents, mayor’s permit, BIR registration, or business permit	Proof the business exists and is yours
Board resolution or secretary’s certificate	Authority to file for a corporation
Screenshots and screen recordings	Proof of publication
URLs and reviewer profile links	Helps tracing and preservation
Transaction records	Shows the review is false
Sales reports, booking cancellations, customer messages	Proof of damage
Witness affidavits	Supports authenticity and business impact
Notarized SPA, if representative files	Authority to act

Investigators may ask for original devices, account access confirmation, notarized affidavits, or clearer screenshots. For anonymous accounts, law enforcement may need platform data, subscriber data, or other digital traces. The Supreme Court’s Rule on Cybercrime Warrants governs warrants and related orders involving preservation, disclosure, search, seizure, examination, custody, and destruction of computer data under RA 10175.

7. Go through preliminary investigation

If a criminal complaint is filed, the usual process is:

The complainant files a complaint-affidavit and evidence.
The prosecutor issues subpoenas if the complaint is sufficient in form.
The respondent submits a counter-affidavit.
The complainant may submit a reply-affidavit.
The prosecutor resolves whether probable cause exists.
If probable cause exists, an Information is filed in court.
The accused may post bail, be arraigned, and proceed to trial.

Timelines vary. A simple complaint may move in a few months. Anonymous account cases, cross-border platforms, incomplete screenshots, or overloaded dockets can take much longer.

8. Consider a civil case for damages or injunction

A civil case may be more useful when:

the business suffered measurable losses
the attacker is known
the reviews continue despite takedown requests
you need a court order to stop a campaign
the case involves competitor misconduct

Under RA 11576, first-level courts generally have expanded jurisdiction over civil actions where the demand does not exceed ₱2,000,000, while claims above that or actions not capable of pecuniary estimation may fall under the RTC depending on the main relief. The Rules on Expedited Procedures also increased covered civil actions and complaints for damages to ₱2,000,000 and small claims to ₱1,000,000, subject to the nature of the case and relief sought. (Lawphil)

Fake review cases seeking injunction, takedown, cessation of defamatory publications, or protection of goodwill often need careful venue and jurisdiction analysis because they may not be simple money claims.

How to prove business damage from fake reviews

Courts and prosecutors are more persuaded by records than general statements like “Our sales went down.”

Useful proof includes:

sales reports for 3–6 months before and after the review bombing
booking cancellation logs
customer messages saying they avoided the business because of the reviews
screenshots of rating decline
ad spend needed to repair reputation
refund requests triggered by false posts
delivery app or marketplace performance data
testimony from front desk, sales, or customer service staff
accounting summaries signed by the responsible officer
expert or digital marketing report for large claims

Actual damages must be proven with reasonable certainty. A business owner’s frustration is understandable, but courts need documents connecting the fake reviews to financial loss.

Special issues for foreigners and overseas business owners

Foreigners and foreign companies dealing with Philippine review bombing should pay attention to documentation and authority.

If the business is Philippine-registered

A corporation should usually file through an authorized representative with:

board resolution or secretary’s certificate
SEC registration documents
valid ID of representative
notarized complaint-affidavit
proof of authority to access the business account

If the owner is abroad

Documents signed abroad may need notarization and an apostille if executed in a country that is a party to the Apostille Convention. If the country is not an apostille country, Philippine consular authentication may be required. Translations may be needed for documents not in English or Filipino.

If the complainant is a foreign corporation

A foreign corporation doing business in the Philippines generally needs proper licensing to sue in Philippine courts. Section 150 of the Revised Corporation Code restricts an unlicensed foreign corporation transacting business in the Philippines from maintaining or intervening in court or administrative actions, though it may still be sued. (Lawphil)

This issue matters for foreign brands, online sellers, franchise groups, and offshore companies with Philippine operations.

Common mistakes businesses make

Reporting the reviews before saving evidence

Once a review disappears, you may lose the best proof of publication. Capture evidence first.

Treating every negative review as cyber libel

Honest criticism is not fake review bombing. Weak or retaliatory complaints can backfire.

Posting the suspected attacker’s private information

Doxxing can create Data Privacy Act exposure, especially if personal information is disclosed or misused. RA 10173 protects personal information in government and private sector information systems, and the NPC accepts formal complaints for privacy violations. (National Privacy Commission)

Failing to prove falsity

If the reviewer was a real customer and the complaint has some factual basis, the case becomes harder. Focus on what is demonstrably false.

Ignoring the one-year cyber libel period

For cyber libel, count from discovery and act promptly. Preserve the discovery date.

Inflating damages

Claiming ₱5 million in losses without accounting support may weaken credibility. Use real numbers.

Using fake positive reviews to “balance” the attack

Do not fight fake reviews with fake reviews. That may violate platform rules and damage your own credibility.

Frequently Asked Questions

Can I sue someone for fake Google reviews in the Philippines?

Yes, if the review contains false statements that damage your business, and you can identify the person responsible or obtain enough evidence for investigation. Possible remedies include platform takedown, cyber libel complaint, civil damages, and unfair competition claims.

Is a one-star review automatically illegal?

No. A one-star review without false factual claims is usually not enough. The stronger case is when the reviewer lies about being a customer, makes false accusations, or participates in a coordinated malicious campaign.

Can a corporation be defamed in the Philippines?

Yes. Article 353 of the Revised Penal Code refers to imputations that dishonor, discredit, or bring contempt upon a natural or juridical person. A corporation or registered business may have protectable reputation and goodwill. (Lawphil)

What if the fake reviewer is anonymous?

You can still preserve the review links and file a complaint with NBI, PNP-ACG, or the prosecutor. Investigators may need platform data or cybercrime warrants to identify account owners, subscriber information, or related digital evidence. Anonymous cases are slower and more evidence-sensitive.

Should I reply publicly to fake reviews?

Usually, reply briefly and professionally. Say you cannot verify the transaction, that you take concerns seriously, and that you are reviewing the matter. Avoid insults, threats, and disclosure of private information.

How long does it take to remove fake reviews?

Platform takedowns may take days to weeks, and sometimes longer if the platform requires additional verification. Legal remedies take longer. A criminal complaint or civil case can take months or years depending on complexity, identity issues, docket congestion, and appeals.

What evidence do I need for cyber libel?

You need screenshots or recordings showing the post, URL, date, account, and exact words; proof the business was identifiable; proof the statement was false; proof of publication; and proof of damage or malicious pattern. A sworn affidavit should explain how and when the evidence was captured.

Can I claim lost income from fake reviews?

Yes, but you must prove it. Use sales reports, booking cancellations, customer messages, analytics, ad spend, and accounting records. Courts generally do not award actual damages based on speculation.

Can I file both a criminal case and a civil case?

Depending on the facts, yes. Civil Code Article 33 allows a separate civil action for damages in defamation cases, independent of the criminal action and proven by preponderance of evidence. (Lawphil)

What if a competitor paid people to post fake reviews?

That can support civil damages, unfair competition, and possibly criminal complaints depending on the content and methods used. If there are messages, payment records, instructions, or repeated coordinated posts, preserve them carefully.

Key Takeaways

Fake review bombing is legally different from honest criticism.
The strongest cases involve false factual accusations, fake customers, coordinated posting, impersonation, or competitor involvement.
Cyber libel may apply when false defamatory reviews are posted online.
Cyber libel in the Philippines prescribes in one year from discovery.
Preserve screenshots, URLs, screen recordings, business records, and proof of falsity before reporting reviews.
NBI Cybercrime, PNP-ACG, prosecutors, courts, platforms, DTI, IPOPHL, or NPC may become relevant depending on the facts.
Civil claims can recover damages and, in proper cases, seek injunctions or other relief.
Businesses should respond calmly, document thoroughly, and avoid retaliatory posts or privacy violations.