Someone Is Impersonating Your Brand Online: What to Do First
August 6, 2026
Key takeaways
- Capture evidence before reporting - impersonators delete accounts the moment they are challenged.
- Warn your own audience early; a customer who has already been warned is far harder to defraud.
- Report as the impersonated party, not as a general complaint - the two go to different queues.
- Expect the account to reappear under a new handle, and plan for monitoring rather than a single takedown.
Impersonation is usually discovered by a customer, not by the business. A message arrives asking whether the discount offer is genuine, or whether the account requesting an advance payment is really yours - and by then the impersonator has been operating for a while.
What happens in the first hour after that message determines most of what follows. The instinct is to report immediately and get it taken down. That instinct, acted on alone, is how businesses lose the evidence they later need.
Capture first, report second
An impersonator who realises they have been noticed will delete the account, change the handle, or make the profile private - and platform reports become almost impossible to progress once the content is gone. Reporting before capturing is the single most common and most expensive mistake here.
Record the profile URL and handle, the numeric or permanent account identifier where the platform exposes one, full-page screenshots of the profile and of every deceptive post or message, the follower count, the account creation date if visible, and any payment details being solicited. Note the date and time on each capture.
Where customers have already been contacted, ask them for their own screenshots. A message thread from the victim's side is stronger evidence than anything visible from outside the conversation.
Warn your own audience the same day
A short factual notice on your genuine channels does more to limit losses than the takedown will. State that an account is impersonating the business, name the exact handles that are genuinely yours, and state plainly what your business never does - never requests payment over direct message, never asks for OTPs, never sells through a personal account.
This is worth doing before the impersonator is removed, not after. Customers who have already read the warning are far harder to defraud, and a business that warned its customers early is in a materially different position afterwards from one that stayed silent.
How platform reporting actually works
Every major platform has a dedicated impersonation channel that is separate from generic content reporting, and it is assessed differently. Report as the impersonated party or their authorised representative, because that route asks for and accepts proof of identity - typically registration documents, trademark registration, or official identification for a named individual.
Anonymous or third-party reports of the same account routinely fail where an authorised report succeeds. Volume does not substitute for standing: a hundred followers mass-reporting an account is weaker than one properly filed report with documents attached.
Trademark registration changes the ground substantially. Where a registered mark is being used, the complaint moves from impersonation policy to intellectual property, which most platforms process through a separate and generally faster channel.
The threats that travel together
Impersonation rarely stays on one surface. A fake social profile is frequently paired with a lookalike domain, a cloned website, or a fake listing, because the operation needs somewhere to send the customers it has convinced.
Checking for the associated infrastructure at the same time - domain registrations close to your brand name, cloned pages, duplicate business listings - is what turns a single takedown into a resolution. Removing the profile while the clone site keeps running mostly relocates the problem.
Expect it to come back
A removed account is not a resolved incident. Where impersonation was deliberate and commercially motivated, a new handle typically appears within days, often a close variant of the one that was removed.
This is why the useful measure is not whether a takedown succeeded but whether the next attempt is detected in hours rather than weeks. The evidence file assembled for the first report is also what makes each subsequent report faster.
How DiReFTY responds to impersonation
DiReFTY monitors for accounts, pages and handles using a client's name and its close variants across social platforms, and checks the surrounding surfaces - domains, listings, cloned sites - at the same time, because they are usually part of the same operation.
Each detection is documented to the standard a platform report requires, filed through the authorised-party channel with the ownership evidence attached, and the variant space is watched afterwards. The objective is not a single removal but a shrinking window between an impersonator appearing and being taken down.
Frequently asked questions
Should I report the fake account immediately?
Capture the evidence first - it takes minutes. Impersonators delete accounts as soon as they are challenged, and a report is very hard to progress once the content is gone. Screenshot the profile, the posts, and any messages, then report.
Should I tell customers publicly that a fake account exists?
Yes, and early. A short factual notice naming your genuine handles and stating what your business never does over direct message limits losses more than the takedown itself, because it reaches customers while the impersonator is still active.
Do I need a registered trademark to report impersonation?
No - platforms accept business registration documents or official identification. But a registered mark moves the complaint into the intellectual-property channel, which is generally faster and harder to contest.
The fake account was removed and a new one appeared. Is there any point reporting again?
Yes, and it is usually quicker the second time because the evidence file already exists. Recurrence is normal where the impersonation is commercially motivated, which is why monitoring matters more than any individual takedown.
A customer already paid the impersonator. What now?
Ask them to file a report with their bank or payment provider and, in India, with the National Cyber Crime Reporting Portal, and keep their evidence alongside yours. Your platform report should reference that a completed fraud occurred, which raises the severity of the account.
Know your digital reputation exposure
Start with a free assessment of the threats targeting your brand across every channel.
Keep Reading