Online harassment targeting your business: what you can do

Online harassment targeting small businesses is more common than many owners realise, and it can take many forms: fake reviews, coordinated social media campaigns, threatening direct messages, and the publication of personal information about owners or staff. The impact can range from minor reputational annoyance to genuine financial harm and personal safety concerns.

The challenge for business owners is knowing which situations warrant formal action, which ones call for platform reporting, and which are best managed through documentation and strategic silence. This guide walks through the main types of online harassment affecting small businesses, what to do in each case, and how to think about legal options without overreacting to minor provocation.

Types of online harassment targeting businesses

Understanding what you are dealing with is the first step to responding appropriately. Not all unwanted online content is harassment in a legal sense, and conflating minor complaints with genuine harassment can lead to responses that make things worse.

Fake or coordinated negative reviews

These are reviews posted by people who have not genuinely used the business, often posted in a short period or by accounts with no other review history. A single fake review is frustrating but rarely rises to the level of harassment. A sustained campaign of fake reviews, especially where evidence points to a single person coordinating multiple accounts, may involve conduct prohibited under Australian Consumer Law, platform terms of service, or in serious cases, harassment law.

Coordinated pile-ons and social media callouts

In some cases, a complaint about a business is amplified across social media and draws many people into critical or abusive comments. These situations often escalate quickly and can feel overwhelming for small business owners who lack the resources of large corporations. Most individual comments in a pile-on, even harsh ones, are protected expression. The exception is where comments include threats, false factual claims presented as true, or constitute harassment directed at specific individuals.

Threatening messages

Direct messages containing threats — whether sent to a business inbox, a personal email, or a staff member's contact details — are a different category altogether. Threats of violence, threats to damage property, or messages designed to intimidate are not protected expression and may constitute criminal conduct. These situations generally warrant contact with police as well as documentation.

Doxxing

Doxxing refers to the deliberate publication of private personal information about an individual or business, typically to expose them to harassment, intimidate them, or encourage others to contact them. For business owners this might mean someone publishing a home address, a personal mobile number, or details about family members. Doxxing is increasingly recognised as serious harmful conduct under Australian law, and the Online Safety Act 2021 (Cth) provides additional mechanisms for addressing it.

Impersonation

Creating fake social media profiles, websites, or email addresses that impersonate a legitimate business is another form of online harassment. Impersonation can damage a business's reputation, mislead customers, and in some cases facilitate fraud. Platform reporting is an important first step, as most major platforms have policies against impersonation and processes for removal.

How to document online harassment

Good documentation is the foundation of any response to online harassment, whether that response is a platform report, a legal letter, or a police complaint. The first instinct many people have is to report or flag content immediately. Before you do that, document it.

Once content is reported, platforms sometimes remove it quickly. If you have not captured evidence first, it may be gone before you can use it for anything else.

What to capture

For each piece of harassing content, capture:

• A screenshot that includes the content, the sender or account name, and the date and time of posting
• The full URL of the post, profile, or review (copy this from the address bar, not a shared link)
• If available, any profile information about the account (number of reviews, account creation date, other posts)
• Any preceding communications that provide context, such as a dispute that preceded the review campaign

Organising your records

Keep a log that records each incident chronologically: date, platform, nature of content, URL, and action taken. This log serves multiple purposes. It helps you assess whether a pattern exists, provides evidence for platform escalations, and gives a lawyer or police officer a clear picture of what has occurred over time.

Store evidence in at least two places. Cloud storage with automatic backup is sensible. Do not rely solely on screenshots on a phone that could be lost, stolen, or break.

Preserving direct message threats

If threatening messages have been sent to a business email address or mobile number, preserve these in their original form. For emails, export the full message including headers if possible, as headers can assist in identifying senders. For SMS, take screenshots that include the sender's number and the timestamp.

If your business contact number is publicly listed and has become a vector for threatening or harassing calls and messages, this is one area where structural change can help. A dedicated relay number means threatening messages arrive through a filtered channel rather than directly to a personal or main business number. More on this below.

Reporting to platforms

Most major platforms have processes for reporting harassment, fake reviews, and impersonation. Results vary significantly between platforms and between individual content moderators, so persistence and specificity matter.

Google reviews

To request removal of a fake or policy-violating Google review, sign in to Google Business Profile, navigate to the review, and select the flag option to report it. In your report, specify which Google review policy the content violates — for example, the prohibition on fake reviews, spam, or content that does not reflect genuine service experience. If the standard report process fails, you can escalate via the Google Business Profile support channels, including live chat support for verified businesses.

Be aware that Google does not remove reviews simply because they are negative or because you disagree with them. A review expressing a genuine opinion, even a harsh one, will generally not be removed even if you consider it unfair. The grounds for removal are policy violations.

Social media platforms

For threatening content or harassment on social media platforms, use the in-app reporting tools and specify the nature of the conduct. If the initial report is not actioned, escalate through the platform's business support channels if you have a verified business account. For serious threats, provide police report numbers alongside your escalation as this often prompts faster action.

For impersonation, most platforms have dedicated impersonation reporting processes that differ from general harassment reports. Use these specific pathways rather than general community standards reports.

eSafety Commissioner

The eSafety Commissioner is Australia's independent regulator for online safety and provides avenues for reporting serious online harassment, image-based abuse, and cyber abuse targeting adults. If platform-level reporting has not resolved a serious harassment situation, the eSafety Commissioner can direct platforms to remove content and can take further action in appropriate cases. The eSafety Commissioner's website provides reporting tools and guidance on what conduct falls within their remit.

Legal options

Legal options for online harassment targeting businesses range from civil claims to criminal complaints, depending on the nature of the conduct. Not every harassment situation warrants legal action, but knowing what is available helps you make an informed decision with a lawyer.

Defamation

Defamation law protects against the publication of false statements of fact that damage a person's or business's reputation. In Australia, defamation law has been reformed to include a serious harm threshold, meaning that minor reputational damage may not be sufficient to ground a claim. Defamation litigation is expensive, time-consuming, and can attract additional media attention. For most small businesses, defamation proceedings are a last resort rather than a first response.

Before considering defamation action, speak with a defamation lawyer who can assess whether the content is actually defamatory (as opposed to merely unfair), whether the serious harm threshold is met, and whether other options are likely to be more effective.

Criminal harassment and stalking laws

Depending on the severity of conduct, online harassment of a business owner or their staff may constitute criminal stalking or harassment under state legislation. In Victoria, for example, stalking includes conduct intended to cause physical or mental harm, including conduct carried out through electronic communication. In NSW, similar provisions apply under the Crimes Act. If the harassment involves threats, repeated contact designed to intimidate, or the publication of personal information to incite others to make contact, these provisions may be relevant.

Police complaints are appropriate where conduct appears criminal. Provide police with your organised documentation, including dates, platforms, content, and any identifiable information about the person responsible.

Restraining and intervention orders

In serious cases, it is possible to apply for a court order that prohibits specific conduct, including online contact. In NSW this is an apprehended violence order (AVO); in Victoria it is an intervention order. The scope of these orders has expanded over time and courts have become more familiar with online harassment as covered conduct. Police can apply on your behalf, or you can apply privately. Speak with a lawyer about the evidence threshold and process in your state.

Cease and desist letters

Before pursuing court action, a cease and desist letter from a lawyer is often a proportionate and effective first step. It creates a formal record that the conduct is unwanted and warns of legal consequences. For some people, a lawyer's letter is enough to stop the behaviour. See our guide on when to send a cease and desist letter for more detail on this option.

Defamation vs a bad review: understanding the difference

One of the most common confusions for small business owners is the distinction between a genuinely defamatory statement and a negative review that they consider unfair. Understanding this distinction helps you calibrate your response and avoid wasting resources on situations that do not warrant legal action.

Protected expression

Opinions and value judgements are generally protected expression and are not defamatory, even when negative. A review that says "the service was slow and the staff were rude" is an expression of opinion about a genuine experience. Even if you believe the characterisation is unfair, it is not defamatory — opinions cannot be proved false. Similarly, a review that is harsh or colourful in its language is not necessarily actionable just because it is unpleasant.

False statements of fact

Defamation requires a false statement of fact, not just a negative opinion. If a review states that your business did something it did not do — for example, claiming you charged for work that was never performed, or that you were found guilty of fraud — and that statement is false, it may be defamatory. The key question is whether a reasonable person reading the statement would understand it as a factual claim that can be proved or disproved, not merely as an expression of displeasure.

The volume problem

A single bad review, even an unfair one, rarely justifies significant legal action. The practical question is proportionality. A business that responds to every negative review with legal threats often does more damage to its own reputation than the review itself. Responding publicly, calmly, and professionally to negative reviews is almost always better for your reputation than legal escalation. Save legal options for coordinated campaigns, clear falsehoods, or conduct that crosses into threats and harassment.

Protecting your reputation

Beyond legal and platform responses, there are practical steps you can take to protect and strengthen your business's online reputation when you are under attack.

Respond professionally to reviews — including bad ones

On review platforms where responses are possible, a measured, professional response to a negative review can do more for your reputation than the review itself. Readers of reviews often pay as much attention to how a business responds to criticism as to the criticism itself. A calm, factual response that addresses the concern without being defensive demonstrates professionalism and can neutralise the impact of even a highly negative review.

Do not respond emotionally, do not engage in arguments in the comments, and do not deny that the reviewer ever used your business unless you have clear evidence. Where a review is factually incorrect, say so politely and briefly, and offer to resolve the matter offline.

Build your review base

The best defence against fake negative reviews is a strong base of genuine positive ones. Encourage satisfied customers to leave reviews, and make it easy for them to do so. A business with 200 genuine reviews is much less damaged by five fake negative ones than a business with ten genuine reviews. Most review platforms allow businesses to request reviews from customers, and this is something to build into standard practice.

Monitor your online presence

Set up Google Alerts for your business name so that you are notified when new content mentioning your business appears online. Check your profiles on key review platforms regularly. The earlier you identify harassing content, the more options you have to respond before it spreads or is seen by many people.

Protect personal information

If your business is a target for harassment, review what personal information about you and your staff is publicly available. Check whether your home address is associated with your ABN registration (ASIC allows suppression in certain circumstances). Consider whether a separate business address or registered agent address can reduce exposure. Use a dedicated business email and phone number so that your personal contact details are not accessible to people who wish to harass you.

For situations where direct messages and calls from specific senders have become a harassment problem, a relay system that filters incoming contact before it reaches you can substantially reduce the personal impact of sustained harassment campaigns. Rather than each message arriving directly and requiring a conscious decision about whether to open it, a filtered relay handles the screening automatically and preserves the original for your records.

Brief your staff

If your business is under a harassment campaign, staff need to know about it. Brief them on what is happening, how to handle calls or messages from people who may be associated with the campaign, and how to escalate concerns. Staff should not engage with harassers on social media, even in defence of the business. Make sure staff know they can report incidents to you and that their experiences will be taken seriously.