How to spot fake Trustpilot reviews

ByNicolas Peter
Fake Trustpilot reviews: timestamps can expose an organised operation. Accounts appear one by one, each posting a few seconds after it was created. ONLINE REPUTATION · INVESTIGATION Fake Trustpilot reviews Timestamps can expose an organised operation Nicolas Peter · Oli-via-net 386d4380account · T 386d438creview · T + 12 s 386d5a1faccount → review +9 s 386d5e33account → review +8 s 386d61c8account → review +15 s Coordinated operation detected

Are these Trustpilot reviews real? Many people ask themselves that question. Among my clients, I often meet business owners who find reviews on their listing that they cannot trace, very negative ones, or on the contrary, surprisingly glowing ones on a competitor’s listing, and who are convinced they are fake.

The problem is that a conviction is not enough. Reporting a review to Trustpilot without a solid reason almost always ends in a refusal. To get a review removed, you need facts: verifiable evidence that the platform can recalculate itself, and that leaves no room for interpretation.

There are several ways to build that kind of evidence. I am going to share one of the methods I use, which I consider essential: timestamps. It does not require any secret tool, just some method, logic and rigour. To illustrate it, I will use a real case: a restaurant hit by a series of one-star reviews.

Trustpilot timestamps everything, to the second

Every account, every review and every business listing on Trustpilot has a 24-character ID. Its first 8 characters encode the exact moment it was created, as the number of seconds elapsed since 1 January 1970. A conversion from hexadecimal to decimal is all it takes, a spreadsheet will do. It is raw data: it does not depend on what the author displays, and anyone can recalculate it from the public pages.

Decoding a fictitious Trustpilot ID: the first 8 hexadecimal characters give the exact moment the account, then the review, were created, here 12 seconds apart. ACCOUNT ID (fictitious example) REVIEW ID (fictitious example) 386d4380 a1b2c3d4e5f60718 386d438c 9f8e7d6c5b4a3921 hexadecimal → seconds elapsed since 1970 hexadecimal → seconds elapsed since 1970 Account created at time T Review posted at T + 12 seconds Gap: 12 seconds
Decoding a fictitious ID: the first 8 characters give the exact moment the account, then the review, were created.

By timestamping every account, review and listing involved, I was able to rebuild the full timeline. Three clues came out of it.

Clue #1: two listings created 58 seconds apart

Something many businesses do not know: anyone can create a business’s listing on Trustpilot, without its consent, simply to post a review on it. The listing then exists online without the business knowing. If it finds out, it can ask to take over the listing: this is called claiming it. Until it does, the listing stays “unclaimed”, and the business can neither reply to reviews nor report them from its own account.

That was the case for this restaurant: it had never created its listing, and only discovered it four months later. Its ID gives the exact time it was created. And 58 seconds later, another listing was created: that of a competing restaurant, which was about to receive a flood of five-star reviews.

Another telling detail: both listings were created from Eastern Europe, while every other restaurant in the area was correctly located in France. So this was not a default setting, but the fingerprint of whoever created both listings. That same morning, the first five five-star reviews landed on the competitor’s listing. Three days later, the first one-star reviews arrived on the restaurant’s.

Clue #2: 48 throwaway accounts, made in clusters

By widening the analysis to neighbouring restaurants, I identified 48 accounts used for a single review, then abandoned, spread across four listings: 27 to inflate the rating of the competitor that benefited, 9 and 6 to attack two other restaurants, and 6 against my client. Almost all of them posted their review less than 30 seconds after the account was created. No customer writes a detailed review in a few seconds: the text was prepared in advance, then pasted. An account created just before its review can happen with a genuine customer; it is the pattern repeating, account after account, that gives the operation away.

Above all, these accounts are not created at random. They are made in clusters: on a single day, eight accounts were created in under two hours for the listing that benefited. And a writing quirk kept coming back from one review to the next, such as the targeted restaurant’s name typed entirely in capital letters.

The logic of the operation then becomes clear: one restaurant showing nothing but positive reviews, and around it, as if by chance, several competitors receiving negative ones. That is also what makes the method useful both ways: it helps defend a listing under attack, but also spot a business whose positive reviews are suspicious, including a competitor’s.

Timeline of 48 single-use accounts across four restaurants over five months: two listings created on day 0, 58 seconds apart, accounts made in clusters, and two windows in which several restaurants are hit within 12, then 18 minutes. Anonymised case. Reviewer account creation, listing by listing 1 dot = 1 account used for a single review · relative time, anonymised case day 0month 1month 2month 3month 4month 5 Targeted restaurant−1★Competitor B+5★Competitor C−1★Competitor D−1★ 2 listings, 58 s 12 min 18 min 8 accounts in 2 h Almost every review posted less than 30 seconds after the account was created, then the account abandoned.
Timeline rebuilt from the IDs (anonymised case): accounts are created in clusters, and several restaurants are hit within the same time windows.

Clue #3: restaurants hit within the same window

This is the clue that leaves no room for doubt. One day, three competing restaurants were hit with one-star reviews, from accounts all created within 12 minutes. About ten days later, within 18 minutes, two accounts praised the restaurant that benefited and a third attacked another one.

A genuinely unhappy customer does not create their account within the same few minutes as accounts that, elsewhere, praise one competitor and attack others. This synchronisation across businesses is the signature of an operation run by a single actor, not of independent customer feedback. To make sure these coincidences are not down to chance, I run them through a permutation test: I shuffle the dates at random 2,000 times, and such a concentration almost never reappears.

The result: 42 fake reviews out of 42 removed

I documented everything in a file sent to Trustpilot: the full timeline, the IDs and the calculations, which the platform can redo itself. A few weeks later, on the three competing listings, all 42 fake reviews identified had been removed: the 27 five-star reviews of the restaurant that benefited, and the 15 one-star reviews of the two restaurants under attack. On the listing that benefited, the only review left was precisely the one the file identified as genuine.

For my client’s listing, one of the platform’s rules came into play: its reviews had been reported as soon as they were posted, before I got involved, but under the wrong reasons. Those reports had been rejected, and after one year, a review can no longer be reported, whatever the reason. The remaining route is a written exchange with the platform, which takes longer.

Trustpilot Business window: This flagging reason is unavailable, this review is more than one year old, so this violation is no longer applicable
Trustpilot Business interface: after one year, a review can no longer be reported, whatever the reason.

My method

  1. Act fast. The one-year limit is a hard one. Ideally, report within days of the review being posted.
  2. Timestamp everything you can. Accounts, reviews and listings: the IDs give the exact timeline, which the platform can recalculate.
  3. Widen the search to neighbouring listings. A fake review operation rarely targets a single business. The evidence often shows up on competitors’ listings.
  4. Build a body of evidence, not a single clue. Account clusters, synchronisation across targets, shared fingerprints, a permutation test, and always a baseline for the sector.
  5. Pick the exact reason and follow the procedure. The wrong reason gets the report rejected and can lock that reason for the review. And the request must come from the business’s own domain email address, with no one else in copy.
  6. Never report a genuine customer. A genuinely unhappy customer deserves a careful public reply. That is also what gives credibility to the reports that are well founded.

Timestamps are not read review by review: they are read by comparing accounts and listings with one another. That is where an organised operation, however discreet, always ends up leaving a trace.

Do some Trustpilot or Google reviews look suspicious to you? I analyse them and tell you frankly what can be demonstrated, what cannot, and how to respond. Get in touch.

Similar Posts