Genuinely curious: what are some heuristics that could be used to distinguish between fraudulent reviews paid for by the developer and those paid for by a malicious third party?

Maybe I'm missing something, but it seems practically impossible to distinguish between the two unless there was a royal screw up somewhere along the line.