Section 1
The artifact: the moat, in two numbers and one machine
Your rating's resilience comes down to two numbers, base and velocity, plus one routing system that fills both without breaking the law. Number 1: base size (makes the average attack-proof) Your star rating is a simple average, so the arithmetic of an attack is fixed. A burst of fake one-stars moves your average by an amount that shrinks as your base grows. Here is what 15 fake one-star reviews does to a 4.8-star business at different base sizes: The formula behind the table, so you can run your own numbers: new average = (old count × old average + attack count × attack rating) ÷ (old count + attack count). The lesson is blunt. At 80 reviews an attack knocks you from a 4.8 to a 4.2, which is the difference between "book them" and "keep scrolling." At 400-plus the same attack is nearly invisible. Base size is the first wall of the moat, and it is why you build the base before you ever get attacked, not after. Number 2: velocity (makes the attack disappear from view and recover fast) Base size protects the lifetime average. Velocity protects the thing customers and the algorithm actually weight most: recent reviews. Consumers heavily discount old reviews. Around 73 percent trust reviews from the last 30 days and a large majority require recency (aggregated review-behavior data, 2025; treat percentages as directional). Google treats freshness the same way, and review signals make up a meaningful share of local ranking, with velocity often outweighing raw count: a profile with 30 reviews gaining 5 a month tends to outrank one with 60 gaining one a month (local-SEO ranking analyses, 2025). So the second wall of the moat is a steady stream of genuine reviews. The practitioner target is 8 to 12 real reviews per month, and that steady flow beats a once-a-year push (local-SEO review-velocity guidance, 2025). At that velocity, when 15 fake one-stars hit on a Saturday, the following weeks refill the recent view with real five-stars, so a reader looking at your latest reviews sees a wall of happy customers with a few obvious outliers buried below, and the algorithm sees a business that is very much alive. The recovery calculator. To restore your average to a target after an attack, the number of new five-star reviews you need is n = (target × current count − current star total) ÷ (5 − target). Run it on the 200-review example after the hit (975 total stars across 215 reviews): restoring toward a 4.7 needs roughly 118 fresh five-stars, which at 10 a month is about a year, while restoring the recent-30-day view takes only the next month's normal flow. That gap is the whole point. Velocity fixes what customers see almost immediately, even while the lifetime average heals slowly. It is why a business with a moat feels fine within weeks even though the math says the average takes longer. The machine: a routing system that fills the moat legally Here is the trap that ruins most review programs. The intuitive way to get a high rating is to ask only your happy customers and quietly steer the unhappy ones to a private complaint form. That is called review gating, and it is now an FTC violation. The FTC's Consumer Reviews and Testimonials Rule, in effect since October 21, 2024, treats selectively soliciting only-positive reviews as a material misrepresentation of your true reputation, with civil penalties up to 53,088 dollars per violation and first enforcement warnings already issued in December 2025 (FTC final rule and enforcement action, 2024 to 2025). So the moat has to be built by asking everyone, and winning on volume and recency rather than by filtering who gets to speak. The compliant routing machine: • Ask every completed customer, not just the happy ones. The request goes out to everyone. No satisfaction survey that routes happy customers to Google and unhappy ones to a private form. Asking all customers is both legal and, at scale, what produces the steady genuine velocity the moat needs. • Ask at the moment of peak satisfaction, for everyone. Timing the request to job completion is legitimate. Choosing who to ask based on predicted sentiment is not. The line is asking-when versus asking-whom. • Make it one tap. Every point of friction cuts response rate. A direct review link by text right after the job, sent to all customers, is the single highest-yield mechanism. • Respond to every review, good and bad. Owner responses are a review signal and a trust signal to future readers. A calm, factual reply to a negative review (never revealing customer details) does more for a browsing customer than a removal ever would. • Fix the unhappy customer through service, then still let them review. You are allowed to make it right. You are not allowed to make the fix conditional on a positive review or on staying silent. Resolve the problem because it is the right thing and because a genuinely satisfied customer often updates their review on their own.
Section 2
Why the moat beats removal: two models, briefly
Threshold and dilution (the statistical lens). An attack is a fixed quantity of bad signal. Whether it crosses the threshold that changes buyer behavior depends entirely on the size of the pool it lands in. A large base dilutes the average below the visible-damage threshold, and a high velocity dilutes the attack out of the recency-weighted view that buyers actually use. You are not removing the bad signal. You are making the pool so large and so fresh that the bad signal cannot reach the threshold that matters. Assumes the attack is bounded and one-time. Breaks against a sustained, high-volume campaign that outpaces your velocity, or against a platform algorithm that weights a sudden cluster of negatives more heavily than the raw average. Counteracts the panic reflex to chase individual removals. May reinforce complacency: a moat is not immunity, and a large enough coordinated attack still hurts. Behavioral recency (the buyer lens). Buyers satisfice. They do not compute your lifetime average. They read a handful of recent reviews and form a snap judgment, and the data says they weight the last 30 days heavily. Velocity is powerful precisely because it targets the signal buyers actually consume, which is why fixing the recent view matters more than fixing the lifetime number. Assumes recency behavior holds in your category. Breaks for a buyer who sorts by lowest rating specifically to find the worst, for whom the buried one-stars are the first thing they read. The structure-break flag. The moat assumes today's rating math and today's ranking weights. Both can move. Google deleted over 292 million reviews in 2025 and deletion rates surged over 600 percent in the first half of the year as its AI detection tightened (Google transparency and industry deletion data, 2025). If Google starts discounting sudden velocity as suspicious, or reweights how recency counts, the moat's mechanics shift. Build genuine velocity from real jobs, never purchased or incentivized reviews, because the one thing that survives every algorithm change is reviews that are actually real.
Section 3
What the moat cannot do
Be honest about the limits so you build it at the right size. A moat does not make you immune. A large, sustained, coordinated attack can outrun any small business's velocity, and at that point you are back to the removal levers and possibly a defamation action for the provably false ones. The moat also cannot fix a genuine quality problem: if the negative reviews are true and recurring, no volume of five-stars is a substitute for fixing the service, and trying to bury real problems under review velocity is a treadmill you lose. And the moat is slow to build, which is the recurring theme of this whole cluster. You cannot construct 400 reviews the week after an attack. The moat only protects you if it exists before the attack, which is the entire argument for starting the routing machine now, while your rating is calm.
Section 4
The fitness test
You should build the moat now if your lifetime base is under a few hundred reviews, your velocity is sporadic rather than a steady monthly flow, and you have completed customers you are simply not asking. Under those conditions you are one coordinated weekend away from a rating you cannot quickly recover, and the fix is a routing machine that asks every customer at job completion and compounds volume and recency until an attack becomes arithmetic you can absorb. You should audit your program for gating before anything else if you already run a review system that surveys customers first and steers only the happy ones to Google. That system is both an FTC liability of up to 53,088 dollars per violation and a weaker moat than asking everyone, because it caps your velocity at your happiest subset. Rebuild it to ask all customers, time the request to job completion rather than to predicted sentiment, and win on real volume and freshness. The compliant machine is also the stronger one, which is the rare case where the legal path and the effective path are the same path.