What to do if someone is impersonating your brand: a step-by-step guide

In 2025, nearly 30% of people who reported losing money to a scam told the US Federal Trade Commission that it started on social media, with reported losses reaching $2.1 billion (FTC, April 2026). The FTC also notes that scammers buy ads using the same targeting tools real businesses use (FTC Data Spotlight).

For brands, that is the problem in one line. Impersonators borrow your name, logo and ad creative, and the customer's loss becomes your complaint, your support cost and your trust gap.

If someone is impersonating your brand, the response needs to be fast, evidenced and owned. This guide sets out what to do, step by step, for social, marketing, infosec, legal and risk teams.

Why brand impersonation needs an incident response, not a one-off report

Brand impersonation is the unauthorised use of a company's identity to deceive customers, partners or the public. On social platforms, it moves at the speed of a post.

In November 2022, a paid-verified account posing as Eli Lilly posted that insulin was free. The post stayed online for several hours, and the following day Lilly's shares fell by more than 5%, although it is unclear whether the post alone caused the fall (Semafor).

The lesson is timing. A convincing fake can reach customers, press and investors before anyone internally has agreed who owns the response.

Most organisations still handle impersonation ad hoc. Social teams report accounts in-app, legal hears about it later, and security never sees the phishing link in the bio. Treating impersonation as an incident, with named owners and a repeatable workflow, closes that gap.

What counts as impersonation, and what does not?

Not every unofficial account is fraud. Before acting, classify what you have found:

• Impersonation: an account posing as the brand, an executive or a support channel in order to deceive. This is the priority.
• Account takeover: your own official account has been compromised. Secure it first; this is a security incident, not a takedown.
• Trademark misuse: an account using your name or logo commercially without permission, such as a counterfeit shop.
• Fan, parody or commentary accounts: often permitted by platform policy where clearly labelled.
• Legacy accounts: created by a former employee, agency or regional team and never closed.

Classification decides the route. Reporting a fan account as impersonation weakens your credibility with the platform; treating a takeover as a takedown loses time you do not have.

How to respond to brand impersonation: step by step

Step 1: Capture the evidence before you report

Accounts are often deleted, renamed or made private once reported. Build an evidence pack first: the profile URL and account ID (handles change, IDs do not), timestamped screenshots of the profile, posts and ads, linked websites, any payment details requested, and customer messages or complaints. The same pack supports the platform report, a trademark claim and a police report.

Step 2: Protect customers on your official channels

If customers are being targeted, tell them where the real brand lives. After the Lilly incident, the company's apology named its official account (Pharmaceutical Processing World). Pin a short notice on official profiles, give customer support a holding line, and make sure your website links to every official account. Avoid linking to the fake, which can amplify it.

Step 3: Report through the right platform route

Platforms separate impersonation from intellectual property claims, and the route matters. X handles accounts posing as a brand under its impersonation policy, but asks companies to report trademark misuse under its trademark policy (X Help Centre). On Facebook and Instagram, brands with a registered trademark can apply for Meta's Brand Rights Protection, which supports search, takedown requests and report tracking (Meta Business Help Centre).

Legal or brand protection should own trademark-based claims. Social teams can own in-app reports.

Step 4: Escalate beyond the platform where harm is real

If the account links to a phishing site, security should pursue the domain and hosting separately and check whether staff or customers have entered credentials. Where UK customers have lost money, report it to Report Fraud, which replaced Action Fraud as the national reporting service for cyber crime and fraud in December 2025 (GOV.UK). Risk and compliance teams should log the incident, particularly in regulated sectors.

Step 5: Close the gaps the impersonator exploited

Impersonators work in the spaces a brand leaves open: missing regional handles, unverified accounts, inconsistent naming and dormant profiles. Once the threat is contained, build an account registry of every official account, apply a naming convention, verify where platforms allow and review who holds access. Our social media security audit checklist sets out what to review.

Step 6: Monitor for repeat offenders

A single takedown rarely ends the problem. Removed accounts can return under a new variant of the handle. Track repeat offenders, link their evidence packs, and monitor for new variants of your name, logo and executive profiles rather than waiting for customers to report them.

Who should own brand impersonation response?

Impersonation sits across teams, so ownership needs to be agreed before the next incident. Social and marketing teams typically own detection signals and customer communications. Legal owns trademark routes and formal escalation. Infosec owns account takeover, phishing and lookalike domains. Risk and compliance own logging, reporting thresholds and regulatory obligations. All four need one source of truth for which accounts are official.

How handles.ai supports the impersonation response workflow

handles.ai gives brand, legal, fraud, security and social teams a shared control layer for this workflow, from detection through to remediation.

• Radar surfaces potential impersonation and brand misuse across monitored platforms, keeps evidence together and helps reviewers track eligible platform reports.
• Audit reviews account ownership and access within the agreed scope, highlights verified exceptions and sets out next steps.
• Pulse connects official accounts, people and partners so teams can review recorded access, ownership and policy exceptions.
• Legal & IP connects rights and evidence with the appropriate platform policy route for trademark and impersonation cases.
• Acquire helps assess and pursue social handles through the routes the platform permits, with a clear handover when a name is secured.

In the adidas customer story, handles reports 9,000+ social accounts removed in phase one of the engagement. This is a customer-specific programme result, not a general removal rate or promised response time (adidas customer story).

Summary: a repeatable response to brand impersonation

Brand impersonation is an operational risk, not only a marketing issue. The response that works is consistent: classify, evidence, protect customers, report through the right route, escalate where harm is real, close the gaps and monitor.