How to tell if a review score is fake

I spent about ten years building restaurant software at Tiller and later as CPO at Kody. Merchants kept asking me the same thing in different words: "Can I trust this score?" They meant Google, Trustpilot, App Store ratings, the big 4.9 on a landing page, sometimes an NPS they saw in a deck.

Most of the time the number looked fine. The problem was that nobody could show who was behind it.

In November 2026, Malwarebytes Labs published research on underground forums selling five-star reviews and review removal on Google, Trustpilot, Yelp and app stores, with AI used to scale the copy. That matched what I had already seen from merchants: you can buy praise, and you can sometimes buy silence.

This piece is the checklist I use when I look at a public score. It is for founders and buyers. No legal advice.

What changed with the FTC rule?

In the United States, the FTC finalized the Trade Regulation Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465). It was published in the Federal Register on August 22, 2024 and took effect on October 21, 2024.

Among other things, the rule makes it illegal for a business to create, sell or buy fake consumer reviews, to buy reviews conditioned on a positive or negative sentiment, to hide insider relationships when officers or managers leave reviews, and to run a company-controlled "independent" review site that is not independent. The official text lives on the Federal Register and in the eCFR.

Shopify's 2026 merchant guide repeats the same point: prefer verified collection, and do not buy fake praise.

The rule helps. Underground sellers still advertise anyway, so you still have to read the page.

Why does a high score still feel wrong?

When I ran product for restaurants, owners would show me a 4.8 and ask why conversion was flat. We would open the reviews together. Same sentence three times. Same week with forty new five-stars. Almost no 3-star notes. Support replies that said nothing useful.

Shoppers feel that too. A Forbes figure Shopify cites says 76% of customers distrust reviews if they are all positive. A perfect wall of praise reads like marketing, even when some of it is real.

So I stop treating the average as proof. I treat it as a starting point.

What signs should you look for first?

I start with patterns, not vibes.

Bursts. A quiet profile that suddenly gets dozens of glowing reviews in a few days is a yellow flag. Malwarebytes describes sellers who promise volume and "non-drop" placement. Timing clusters are one of the few things you can still see from the outside.

Generic language. "Amazing product, highly recommend" with no product, no size, no delivery detail. Real buyers usually mention something awkward: a late parcel, a size that ran small, a support email that took two days.

One-review accounts. Lots of brand-new profiles that only ever reviewed this one business. Not proof by itself, but common in farmed campaigns.

Missing middle. Only 5 and 1. Almost no 3 or 4. Real products annoy people a little. Flat five-stars with zero friction is weird.

Over-specific employee praise. Review after review naming the same staffer with the same adjectives. Fraud analysts on Reddit call this out a lot. It can be real, but it is also a known template for bought praise.

None of these prove a review is fake on their own. Together they tell me to slow down.

Does "verified purchase" actually prove the review is honest?

Mostly it proves a transaction happened for that email or order. It does not prove the person writing the text is describing a real experience in good faith.

Competitors can place a small order and leave a nasty review. Friends can buy and get reimbursed outside the system. Underground sellers brag about real people posting, which still does not make them real customers of yours.

So I like verified purchase when it is present. I do not stop reading once I see the badge.

Should you trust the average or the 1-star filter?

I almost always sort by newest, then skim the 1-star and 2-star reviews.

Fake praise is easy to buy. Specific failure stories are harder to invent at scale: "order 4821 never arrived", "refund promised on Tuesday, nothing on Friday". If those stories repeat across months, I believe the pattern more than the average.

I also read how the company answers. A calm reply with an order reference beats a marketing paragraph. Silence next to serious complaints is its own signal.

What about NPS versus star reviews?

NPS asks "how likely are you to recommend us?" on a 0 to 10 scale. It is useful inside a company. On a landing page it has the same problem as stars: anyone can publish a number.

I published our NPS work at Objectif years ago while I was at Tiller. The useful part was not the headline. It was that we could not quietly rewrite the score after the fact, and that it came from people we could actually reach.

If someone shows you an NPS in a sales deck, ask three boring questions: who was surveyed, over which dates, and can a stranger check a public page? If the answers are fuzzy, treat it like any other marketing claim.

How do AI-written reviews change the game?

Malwarebytes found forum users talking about faking E-E-A-T style signals with AI so reviews sound experienced. That means spelling mistakes and "human tone" are weaker filters than they used to be.

What still helps:

• sudden volume on quiet days
• repeated phrases across many accounts
• reviews that never mention the actual SKU, plan, or city
• mismatch between review volume and anything else public (support footprint, social mentions, order capacity)

When Fakespot-style tools disappeared, people on Reddit started rebuilding detectors. Those tools guess. Looking at the timeline yourself still matters more.

What should a merchant do instead of chasing a perfect score?

Collect feedback only from people who actually paid. Keep a mix of scores visible. Answer the bad ones in public with facts. Do not pay for a specific sentiment. Under the FTC rule, incentives conditioned on positive or negative wording are banned.

If a platform removes real reviews while leaving suspicious ones up, keep dates, invitation method, and order IDs. Ecommerce merchants on Reddit describe that mess with Trustpilot a lot. You cannot control a customer's VPN. You can keep your own evidence.

Where does TrustNPS fit?

I am building TrustNPS for a narrower case: a public NPS that only paying customers can answer, with the invite tied to a real Stripe or Shopify transaction. The score is meant to be checkable on a public page, not pasted as a badge with no trail.

We are early. I am not going to invent merchant counts here. If the idea is useful to you, the checklist above still stands on its own. You can use it on any platform tonight.