It violates Google's policies (conflict-of-interest reviews are prohibited) and, when it states false facts, can cross into defamation. But 'illegal' rarely matters practically; your realistic remedies are platform removal and public response, not court.
The removal path: flag it (Report review), then escalate through the Business Profile help center with evidence. No matching customer record, the reviewer's profile pattern (one-star sprees on local rivals is a classic tell). Removal succeeds when you can show policy violation, not merely unfairness.
While it stands, respond for the audience: calm, factual, unmistakably professional. 'We have no record of serving you; if we're mistaken, call (your number) and we'll make it right.' Prospects reading it can spot a hit job answered with grace.