Brand impersonation on social media: a response playbook

Not every impersonation attack lives on a website. A growing share happens on social media, where a fake profile borrows your brand's name and logo to reach your customers directly — with all the built-in trust and reach the platform provides. Here is how brand impersonation works on social, and a playbook for responding to it.

The shapes it takes

• Fake support accounts — profiles posing as your help desk, intercepting customers who ask for assistance and steering them to phishing or payment scams.
• Cloned brand pages — near-identical copies of your official page running fake giveaways or promotions that lead to credential traps.
• Lookalike handles — usernames a character or two off from yours, lending credibility to scam links and direct messages.
• Impersonated executives — fake profiles of your leadership used in trust-based scams.

Why attackers love it

Social platforms hand attackers three things for free: an audience that already follows and trusts your brand, a frictionless way to message customers directly, and a veneer of legitimacy from the platform itself. A fake support account does not need to break anything — it just needs to be in the right place when a customer is frustrated and looking for help.

The response playbook

1. Find it. Monitor platforms for unauthorised use of your name, handle variants and logo — do not wait for customers to report it.
2. Capture evidence. Record the profile, its handle, the impersonating content and timestamps before it can be edited or deleted.
3. Report through the right channel. Use the platform's impersonation or intellectual-property process, with proof of brand ownership and of the passing-off.
4. Protect customers in parallel. If the fake account links to a phishing site, take that site down too — the profile and the page are one campaign.
5. Keep watching. Impersonators often return with a new handle; ongoing monitoring catches the next one quickly.

Connect it to the rest of the campaign

Social impersonation rarely stands alone. The fake profile usually points somewhere — a lookalike domain, a fake login page, a payment scam. Treating the profile and the linked site as a single campaign, and taking down both, is far more effective than chasing each in isolation.

The takeaway

Social media impersonation puts your brand in front of your own customers on someone else's platform, backed by borrowed trust. You cannot control the platform, but you can detect the abuse, evidence it, and drive it through the right takedown process — and take down the phishing infrastructure it feeds. Watch continuously, act on proof, and treat the profile and its payload as one.