Reviewer Contact Is Now a Peer Review Incident

Peer review depends on a strange kind of intimacy. A reviewer sees unfinished work, private data, uncertain arguments, and sometimes the most vulnerable version of an author before publication. That access is tolerated because it is supposed to happen inside a governed channel. When a reviewer, or someone pretending to be a reviewer, steps outside that channel and contacts an author directly, the journal is no longer managing a routine review problem. It is managing an incident.

That is the useful lesson from Retraction Watch reporting on July 20, 2026 about an alleged bribery scheme involving a submission to Wiley journal Security and Privacy: https://retractionwatch.com/2026/07/20/publisher-investigating-peer-reviewer-for-alleged-bribery-scheme/. According to the report, cybersecurity researcher Tushar Sen said a purported reviewer contacted him outside the journal system, offered to revise the manuscript for payment, and said he would recommend acceptance. The same person later suggested rejection would follow if Sen did not respond. Wiley told Retraction Watch its research integrity team was investigating, that the email address did not match any invited reviewer, and that the complaint was supported by copies of email conversations while the publisher could not otherwise confirm their legitimacy.

Those details matter because this is not a finding of reviewer corruption. It could be reviewer misconduct, impersonation, a leak, a misunderstanding, or some combination of weak process and bad behavior. Journal leaders should not convert one reported case into a verdict about a journal, publisher, country, discipline, or author. They should, however, notice the control failure the case makes visible: an author believed someone with review access had turned the manuscript into leverage, and the journal needed a way to investigate without improvising under pressure.

The Problem Is The Side Channel

The side channel is the core risk. Once review communication moves into personal email, messaging apps, social media, or payment conversations, the editor loses the ability to know what was said, whether confidential material was shared, whether a reviewer sought advantage, whether an author was pressured, and whether the final report was independent. Even if the manuscript decision is scientifically defensible, the process becomes harder to defend.

Wiley states in its peer review confidentiality policy that reviewers must not reveal manuscript details or communications related to peer review beyond what the journal releases, and that confidentiality applies during and after review: https://authors.wiley.com/Reviewers/journal-reviewers/tools-and-resources/review-confidentiality-policy.html. In the Retraction Watch report, Wiley also said reviewer conflicts must be avoided, reviewers are not allowed to contact authors in the context of peer review, and requesting financial compensation from authors is strictly prohibited.

COPE guidance points in the same direction. Its Ethical Guidelines for Peer Reviewers instruct reviewers not to contact authors directly without journal permission and to respect confidentiality, including not using information gained through review for their own or another person advantage: https://publicationethics.org/guidance/guideline/ethical-guidelines-peer-reviewers. The rule is simple, but systems often treat it as a training sentence rather than a control that needs evidence.

Reviewer Identity Is A Control

Many journals still verify reviewer identity lightly. An editor recognizes a name, follows an author suggestion, accepts an institutional-looking email address, or relies on a reviewer profile created years earlier. That may work for ordinary peer review. It is weak against impersonation, compromised accounts, fake identities, citation cartels, and conflicted reviewers who understand the journal workflow well enough to exploit it.

Identity control does not require turning every reviewer into a compliance project. It does require separating convenience from trust. Reviewer invitations should go to addresses linked to durable professional identity where possible. Reviewer profile changes should be logged. ORCID, institutional affiliation, publication history, prior review behavior, and conflicts should be treated as signals that need consistency, not as decorations on a profile page. When a reviewer asks to use a different email address, delegate the review, or communicate outside the platform, that should create a visible event.

The most important design principle is that authors should never have to decide whether a side-channel message is real. Author instructions should say plainly that reviewers must not contact authors directly about an active manuscript, that authors should forward any such message to a named journal address, and that reporting the contact will not prejudice the manuscript. Without that promise, an author may stay silent because the person contacting them appears to have power over the decision.

Review Mills Show The Pattern At Scale

Direct contact is one version of reviewer integrity failure. Review mills show another. In March 2026, Accountability in Research published "Gaming the peer review system: Evidence for a review mill in medicine highlights the need to ensure reviewer integrity": https://doi.org/10.1080/08989621.2026.2640012. The authors reported a network with characteristics of a review mill in gynecological oncology, including boilerplate review language and citation suggestions that benefited reviewers or connected authors.

The public abstract and indexed summaries report 195 similar review reports from 170 targeted articles, with 186 reports suggesting at least one citation coauthored by the reviewer or another network member, and authors of 142 articles complying with some or all of the suggestions: https://pubmed.ncbi.nlm.nih.gov/41784219/. That is not the same fact pattern as an alleged payment demand. It is the same governance lesson. A review report is not only text attached to a manuscript. It is an action by a person inside a network, with patterns that may only become visible across manuscripts.

Journals that review each report in isolation can miss repeated boilerplate, unusual citation requests, reviewer clusters, recycled critiques, and editors who repeatedly route papers through the same people. The operational challenge is to see enough pattern to protect the record without building a surveillance culture that treats every productive reviewer as suspect.

What An Incident Workflow Should Do

• Give authors a single reporting route for suspected reviewer contact, payment requests, threats, coercive citation, confidentiality breaches, or identity concerns.
• Preserve evidence immediately: message headers, screenshots, platform logs, reviewer invitation records, account changes, decision timestamps, and correspondence inside the manuscript file.
• Pause reliance on the questioned review while keeping the manuscript moving where possible through an independent editorial assessment.
• Check whether the email, account, ORCID, affiliation, IP signals available to the platform, and prior reviewer history match the invited reviewer record.
• Compare the questioned report with the reviewer earlier reports and with reports on related manuscripts for boilerplate text, repeated citation requests, or unusual recommendation patterns.
• Separate author tone from allegation substance. A stressed or angry author can still report a real process failure.
• Document the outcome: no issue found, impersonation suspected, reviewer removed, report discounted, decision re-evaluated, institution notified, publisher integrity team escalated, or further audit opened.

The point of this workflow is not to guarantee that every complaint ends with a clean answer. Some will not. The point is to make the journal response inspectable. If the publisher later has to explain why a decision stood, why a review was removed, or why a reviewer was banned, the answer should come from records rather than memory.

Do Not Make Authors Prove The System Is Broken

Authors who report suspected reviewer misconduct may be confused, emotional, mistaken, or difficult. That cannot be the deciding filter. The editorial office can require civil communication while still treating the allegation as evidence to triage. A journal that responds mainly by defending its reputation teaches authors that reporting is risky. A journal that responds with a clear incident path can protect the manuscript, the reviewer process, and the staff handling the complaint.

This is especially important for early-career researchers, unaffiliated authors, and authors outside dominant publishing networks. They may not know what legitimate reviewer communication looks like. They may also be more vulnerable to pressure because a single publication decision carries high career weight. A good process does not assume the author is right. It does assume the author needs a safe path to report a breach of the channel.

Practical Takeaway For Journal Leaders

Treat unauthorized reviewer-author contact as a peer review incident, not an awkward correspondence problem. Publish the rule, give authors a reporting address, preserve evidence, discount any tainted report until assessed, verify reviewer identity, audit nearby review patterns, and record the outcome in the manuscript history. Then test the workflow with one scenario: an author forwards a payment request from someone claiming to be a reviewer two days before rejection. If the team cannot say who acts, what is paused, what is logged, and how the decision is re-evaluated, the policy is not yet operational.

The integrity of peer review is not protected only by choosing honest reviewers. It is protected by making the review channel strong enough that dishonesty, impersonation, and coercion have fewer places to hide.