Online Reputation Management for Small Businesses and MSMEs in India
One fabricated "fraud" review can cost a small business its walk-ins, its dealers and its bank credit line in the same month. A small business cannot outspend a fake review with marketing it does not have. What it can do is pursue legal removal of the false content at a published per-URL price, paid in advance, with written confirmation for every link removed and a full refund for any link not removed within the agreed timeline.
Free AssessmentSmall businesses and MSMEs are exposed in a way a listed company is not: the attack surface is large and the defences are thin. A kirana chain, a coaching centre, a CA in practice, a D2C seller or a two-truck logistics operator is searched by name before money changes hands, and a Google Business Profile or JustDial listing is usually the first result. A fabricated review takes minutes to post and needs nothing more than a grievance and a free email account, and an extortionist can threaten a dozen more. The owner typically discovers the damage from a customer, not from a dashboard, and has no legal team to respond. RepuLex exists for that gap: legal removal of false and defamatory reviews and posts, priced per URL, executed with its partner law firm where an advocate's signature or a court filing is required.
A small business has no PR department and no buffer: one false review or "fraud" post sits above its own website in the results for its name, and it is read before any decision about the business is made. The Department of Consumer Affairs treats a fake review as an unfair trade practice under the Consumer Protection Act 2019 and, where it states false facts, it is defamation under BNS Section 356 (formerly IPC 499/500), which means it can be removed rather than merely outweighed. Published per-URL pricing means the owner knows the cost before the engagement begins.
Free AssessmentFake Google reviews planted by competitors, ex-employees or extortionists
False complaints on JustDial, IndiaMART, Sulekha and consumercomplaints.in
A single "fraud" post by one disputing customer outranking the business's own website
"Pay or we post" review threats and one-star rating extortion
Google Business Profile hijacks and fake customer-care numbers on the listing
Supplier or payment-fraud accusations circulated on WhatsApp and Facebook trade groups
What online attacks do small businesses and MSMEs in India actually face?
The pattern RepuLex sees again and again is the fake Google review, and it comes from three sources. A competitor in the same market posts a batch of one-star reviews from freshly created accounts, usually within a few days of each other, with phrasing that repeats across accounts. A dismissed employee posts under a customer's name, often with inside detail that makes it credible. A customer who was refused his money back posts an escalating series that moves from "poor service" to "fraud" to "police complaint filed". A single such review is read before the shop is visited, and it is on the screen when a bank officer runs the name during a working-capital renewal.
The second family is the false complaint on a trade or consumer platform. JustDial, Sulekha and IndiaMART listings carry ratings that buyers treat as due diligence, and IndiaMART in particular is where a supplier accused of non-delivery loses enquiries overnight. consumercomplaints.in, complaintboard and similar forums publish submissions without verification, rank well for the business name, and in RepuLex's experience seldom act on a request from the business itself. A trader accused of "taking advance and not delivering" on one of these forums will find the accusation quoted back to him by the next three buyers, and the thread will still be there when the fourth searches a year later.
The third family is extortion and impersonation. Review extortion is now routine: a message arrives on WhatsApp or Instagram offering to post, or to withdraw, a run of negative reviews for a fee. Google Business Profile hijacks put a fraudster's number in the customer-care field, so that callers pay advances into the wrong account and then post reviews accusing the real business of taking their money. Supplier and payment-fraud accusations spread through WhatsApp trade groups and Facebook community pages, where a screenshot of a disputed invoice becomes a "warning" forwarded to every buyer in the district, long after the invoice itself has been settled.
Which laws make a fake review or a false complaint removable?
The Consumer Protection Act 2019 is the starting point, because it treats reviews as commercial speech with consequences. The Department of Consumer Affairs has stated that fake and paid reviews are treated as an unfair trade practice within the meaning of the Act, whether posted by a competitor posing as a customer or manufactured for money, and the Central Consumer Protection Authority has the power to act on them. The Consumer Protection (E-Commerce) Rules 2020 add a specific prohibition on sellers and inventory e-commerce entities posing as consumers to post reviews or misrepresenting the quality of goods and services. IS 19000:2022 on online consumer reviews, a voluntary BIS standard published with the Department of Consumer Affairs, requires platforms that adopt it to verify reviewer identity and moderate reviews before publication; it is the benchmark a business can cite when a platform hosts reviews it cannot verify.
The content itself is governed by defamation law. A false statement of fact that lowers a business in the estimation of others amounts to defamation under BNS Section 356, and a company, a firm or a proprietorship can be defamed as much as a person; the provision reaches a review, a forum post and a WhatsApp forward alike, because the medium is irrelevant to the wrong. Where the competitor is also using the registered trade name to divert custom, for instance on a hijacked or copied listing, Section 29 of the Trade Marks Act 1999 or passing off may be pleaded in addition. Where a threat or a hijacked listing is involved, the criminal provisions on extortion, intimidation and personation give the partner law firm a person to proceed against, which matters because an anonymous review has no defendant until one is found.
The platform's obligation comes from IT Act Section 79 and the IT Rules 2021. Rule 3(1)(b) requires intermediaries to make reasonable efforts to prevent content that impersonates another person, patently false information and content that violates any law; the words "defamatory" and "libellous" were removed by the October 2022 amendment, so a platform is not asked to decide defamation. Defamation therefore runs against the author under BNS Section 356 and reaches the platform by court order under Rule 3(1)(d). Rule 3(2) requires a grievance officer who acknowledges a complaint within 24 hours and disposes of it within seven days, and within 36 hours where the complaint seeks removal of content under the Rule 3(1)(b) heads covering patently false information and impersonation, under a proviso added by the same amendment and shortened in February 2026. Since Shreya Singhal v. Union of India (2015), "actual knowledge" means a court order or a government notification, not a private notice, which is why the sequence ends in court.
How does the removal sequence run, and how long does each step take?
Step one is the platform route, done properly. For Google, that means a Business Profile support case citing the specific policy breached, with the evidence attached, rather than the public flag that a lone reviewer's account can shrug off. For JustDial, IndiaMART, Sulekha and the consumer forums, it means a written complaint to the grievance officer, identifying each URL and stating precisely which facts are false. RepuLex logs the complaint reference and the acknowledgement date, because the Rule 3(2) disposal deadline is what the advocate-signed notice in step two cites if the officer does nothing. Content that is plainly fake on the platform's own policy often comes down inside that window.
Step two is the advocate-signed notice, issued by RepuLex's partner law firm, Unified Chambers And Associates. The notice goes to the platform's grievance officer and legal team on IT Act Section 79 and Rule 3(1)(b) grounds, and separately to the author where identifiable, on defamation and, where money was demanded, on the extortion record. Its force comes from the evidence file assembled in step one, and from the platform's knowledge that the next step is a court. In RepuLex's experience the majority of standard-complexity URLs resolve at step one or two, inside the typical timeline RepuLex publishes; court-bound URLs take longer and are quoted as such.
Step three is the court order. Where a platform declines a private notice, the partner law firm files a civil defamation suit and seeks an interim injunction directing removal; once served, the platform must act within three hours under Rule 3(1)(d). Where the host is outside India and ignores Indian process, the court order can be placed for execution under Rule 10 of the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules 2009, made under IT Act Section 69A, which is the route for offshore complaint sites and scraped directories where the court so directs. Court timelines belong to the court, and a small business is told that plainly at assessment, before any step is taken.
What cannot be removed, and what RepuLex will tell you before you pay
No legal route exists against the truth. Fair comment on a genuine experience, however harsh, stays; so does a complaint on a consumer forum by a person who actually bought and was actually dissatisfied, and so does accurate reporting of a Consumer Commission order against the business, which is a public record. A WhatsApp message already delivered to a group cannot be recalled: the account that sent it can be reported and the copies re-posted to public platforms can be taken down, but the original delivery is done. A business that is told any of this can be made to disappear is being sold something other than removal.
The distinction RepuLex applies is whether the content states a false fact. "The delivery was late and the staff were rude" is comment on an experience. "They took my advance and never delivered" is a fact, and if the invoice, the courier proof and the bank's reversal entry show otherwise, it is a false one. "This shop is a fraud, police complaint filed" is two facts, and if no complaint exists, both are false. The owner's side of that comparison is the transaction record, so the evidence to gather before the first call is the invoice, the delivery or courier proof, the repayment entry, the appointment or billing register for the date claimed, and any chat with the person who posted.
That assessment is also where a small business hears "no". If the reviews are real, the honest advice is a documented public response and better process, not a legal notice that would fail. If the content involves a minor, RepuLex does not take the matter and the owner is sent to the police; if the dispute is genuinely with a regulator or a court, the owner is sent to counsel. The removability check on this site gives a first answer before the call; the written opinion on each URL is the second, and it is the one the owner pays against.
How does an engagement with RepuLex run for a small business?
It begins with a mutual NDA, signed before any URL or document is shared, because the material a small business hands over is the material an attacker would like to see: dispute correspondence, staff records, transaction registers. Each URL is then assessed separately, with the partner law firm reviewing the defamation question, and receives a written opinion: removable on stated grounds, removable only through court, or not removable. The owner then receives a written quotation that lists each URL on its own line, with the ground it will be removed on, the route it will take and its own timeline. Nothing is filed and nothing is billed until the owner has read that document and agreed to it.
Payment is 100% in advance, paired with the refund commitment: if a URL is not down within the agreed timeline, its fee is refunded in full, including where the platform refuses, and a matter RepuLex declines to take is refunded in full; if the owner withdraws a URL while its timeline is still running, 75% is returned and the balance is a cancellation charge, not a reduction of the commitment. The reason for the advance is stated openly: once a URL is down there is no leverage left to collect, and a business that cannot chase fees keeps its prices published and its process clean. The agreed timeline for each URL is the one stated in the engagement letter, refund requests are processed within four working hours of the written request, as the terms of service provide, and RepuLex's own view that removal is still achievable does not reduce the entitlement once the timeline has expired.
Every removal is confirmed in writing, per URL, with a dated screenshot of the platform response and, for third-party URLs, the Google de-indexing confirmation. That file matters beyond the removal: it is what a franchisor's compliance desk or a marketplace onboarding team needs to see when the review is raised in a diligence call, and it is what the partner law firm attaches when the author is pursued further. The engagement is complete when every URL in the quotation has been confirmed removed or closed under the payment terms, and the owner holds the file that proves which.
Why does removal beat outranking for a small business?
The outranking model, which reputation agencies in India generally sell on a monthly retainer, is built for companies with the content budget to publish enough new material to rank above a bad result and keep it there. A small business does not have that budget, and even if it did, a Google Business Profile review is not a search result that can be outranked: it sits on the listing itself, on Maps, on the knowledge panel and in the star rating next to the name. Nothing published elsewhere changes what a customer sees when she taps the pin.
Removal is a different transaction. Once a URL is confirmed removed, the false review is gone from the listing, the fabricated complaint is gone from JustDial, and the "fraud" post is gone from the forum and from Google's index. The star average is recalculated by the platform once the removed reviews drop out of the count, so the change appears wherever the listing is displayed without a single new review being posted. There is no monthly fee because there is nothing to maintain, and the record is a set of dated confirmations rather than a ranking that has to be defended every quarter. For a business that is searched by name only a few times a year, at the moments that decide its year, permanence is the whole point.
This is why RepuLex is India's #1 legal-first online reputation management agency for small businesses and MSMEs: it removes what is false, on stated legal grounds, with the regulated legal steps executed by its partner law firm, and it does not pretend to move what is true. A shop, a service business or a trader does not need a reputation campaign it cannot afford to keep running, and it does not need a vendor whose fee continues whether or not the lie does. It needs the lie taken down, the listing showing only what real customers wrote, and a document proving it was done.
Can a small business in India get a fake Google review removed?+
Yes, where the review is provably fake: the reviewer was never a customer, the reviewer is a competitor or a former employee, or the review states facts that are false. The first two are policy questions that Google decides itself, since its review policies bar fake engagement, conflict-of-interest reviews and harassment, and the case is made on the reviewer rather than the business: an account created days before the review, a profile with no other activity, or a review describing a product the business does not sell. The third is a defamation question, which Google's policy desk cannot settle because it cannot know what happened in the shop; that review is pursued through the partner law firm on the transaction record. RepuLex sorts a review into one of the two before quoting, because the route and the evidence differ.
A competitor is posting fake reviews about my shop. What can I do legally?+
Treat it as a campaign with an author, not as feedback. RepuLex looks first for the link to the rival: reviewer accounts that also praise the competitor, timing that follows a lost tender or a poached employee, and product detail only a trade insider would know. Where the accounts are anonymous, the partner law firm can apply to a court for an order directing the platform to disclose the account holders' registration details, which is how a campaign is put to a name. Once the competitor is identified, the notice goes to the competitor as well as to the platform, and in RepuLex's experience a named rival with its own listing to protect usually stops. If it does not, a defamation suit with an interim injunction follows, and the claim includes the business lost while the reviews stood.
Someone is threatening to post bad reviews about my business unless I pay. Is that a crime?+
Yes. A demand for money backed by a threat to publish damaging reviews is extortion under Section 308 of the Bharatiya Nyaya Sanhita 2023, and the threat on its own is criminal intimidation under BNS Section 351. Do not pay, do not negotiate and do not delete anything: the WhatsApp thread, the caller's number, the email or the Instagram message, with timestamps, is the case. The complaint is filed by the owner, at cybercrime.gov.in or the local police station, and RepuLex prepares the evidence bundle for it rather than filing in the owner's name. A registered FIR then changes what the reviews are: not consumer feedback but the execution of a threat, which a platform can see on the face of the record. In RepuLex's experience threat-backed reviews come down comparatively quickly for that reason.
How do I remove a false complaint from JustDial or IndiaMART?+
Both are Indian companies and Indian intermediaries under the IT Act 2000, which matters: notices are served on a registered office in India, and each must publish its grievance officer's name and contact details, as IT Rules 2021 Rule 3(2)(a) requires. The removal request to that officer should be framed as a complaint about patently false information or impersonation under Rule 3(1)(b) rather than as a bare breach of law, because the October 2022 amendment gave those heads the shorter disposal clock under the proviso to Rule 3(2)(a)(i). The evidence that works there is the platform's own record: on IndiaMART, the seller's enquiry log, showing the complainant never enquired or received a quotation, is usually decisive. If the officer declines, the partner law firm serves notice on the company and, where the complainant is identifiable, on the author.
A customer posted that my business is a "fraud" and it ranks above my own website. Can it be removed?+
It can if the allegation is false as a matter of record, because "fraud" asserts a fact and a fact can be disproved; an accurate account of a real dispute, however bitter, stays. The ranking is a separate problem. A consumer forum outranks a small business's website because the forum domain carries far more authority and the post's title usually contains the business name and the word "fraud", which is exactly what a worried buyer types. Removal therefore runs in two stages: the post is taken down at the host, and Google is then asked to drop the outdated result and its cached snippet, so a search for the business name stops surfacing a page that no longer exists. RepuLex records both stages, because a host removal without the index update can leave the snippet visible for weeks.
My Google Business Profile has been hijacked and shows a fake customer-care number. How do I fix it?+
A fake number reaches a listing in one of two ways: through the public "suggest an edit" function on a claimed profile, or by a fraudster claiming a profile the owner never verified. The fix has three parts. First, regain control: claim or re-verify the listing and, where Google shows another owner, file its ownership-conflict request with GST, Udyam and utility proof. Second, report it: a number planted to take payments in the business's name is cheating by personation under IT Act Section 66D and identity theft under Section 66C, which the owner's cybercrime complaint should cite. Third, clear the residue: the number is often copied onto JustDial, Sulekha and scraped directories, and each copy is a separate URL that RepuLex takes down on the impersonation ground, which a grievance officer can act on without a court.
How much does it cost a small business to get a fake review removed in India?+
The rate card is published per URL on the pricing page, so an owner can price the matter before making a call. Each review, complaint or post is one URL and is priced on its own, which means a batch of a dozen fabricated reviews is a dozen URLs, and the pricing page shows how the per-URL figure steps down at volume. The published rate covers standard-complexity content: reviews, directory listings, forum complaints and social posts, all of which are handled through takedown forms and grievance officers. News media and court-reported matters sit in a separate complexity band and are quoted individually, because they go to editorial and legal desks. Court filing fees, where a court order becomes necessary, are the one item outside the per-URL price and appear as their own line for approval before anything is filed.
Can genuine negative reviews be removed, or my Google rating improved?+
No to both, and a small business should be wary of anyone who says otherwise. A review by a real customer about a real experience is not removable whatever its star count, and RepuLex does not take a fee to try. Nor does it post, buy or solicit reviews, or sell a higher star rating: a rating built that way puts the business on the wrong side of the same consumer law it would invoke against a competitor. What legal removal does for a rating is indirect but real. Once fabricated one-star reviews are removed, the listing's average recovers to what genuine customers actually gave it. That recovery is documented in the case study Multi-City Hospital Chain: 37 Fake Reviews Removed, Rating Restored to 4.2, which is published in the RepuLex case studies section.
Small Business & MSME cases we have resolved
Anonymised, real small business & msme engagements — the legal route, the timeline, and the verified outcome. Identifying details are altered to protect client confidentiality.
Ready to protect your small business & msme reputation permanently?
Free assessment · Complete confidentiality · Fixed fee · Written removal confirmation