Brand impersonation: how to get fake accounts, ads and sites taken down

1. The right words

These usually come together: a typosquatted clone site, promoted by scam ads using your logo, with a fake "support" account answering worried customers.

2. First steps

1. Save evidence before you report: the exact URL of every account, ad, page and site; dated screenshots; the fake site's contact details and legal notices; messages and complaints from customers who were fooled. Scam sites can vanish overnight.
2. Warn customers on your website, official social accounts and by email: "Fake websites / accounts are using our name. Our only official addresses are… We never ask for passwords or card details by message."
3. Brief your team (front desk, support, sales) so customer reports reach one person.
4. Do not engage with the impersonator, and never pay to "get back" a domain or account.
5. Gather your proof of rights: company registration, trademark registration certificate if you have one, your official website. Platforms ask for them.
6. Keep a log of what you reported, when, to whom, and the answer. Your lawyer, the police and any appeal will need it.

3. Fake accounts and pages using your brand

1. Report from the account itself with the impersonation reason ("pretending to be someone"), stating that it is your business.
2. If your trademark is registered, also use the platform's trademark form. It is usually the strongest route for an account using your name or logo, and only the owner or an authorised representative can file it.
   • Facebook: trademark report form
   • Instagram: trademark report form
   • TikTok: trademark report form
   • X: trademark report form
   • YouTube: trademark complaint webform
   • LinkedIn: trademark policy and reporting
3. Use a work email address: platforms may pass your name and report to the account you report.
4. For a fake executive or recruiter profile, also report it on behalf of the person being impersonated (see our fake profile guide).
5. If the platform refuses or goes silent: in the EU, the Digital Services Act requires online platforms to offer an internal appeal; everywhere, request a review and send a written notice using our takedown request template.

4. Scam ads using your brand

1. Find every ad from the same advertiser in the public libraries: Meta Ad Library and Google Ads Transparency Center. Note the advertiser's name and ID.
2. Report each ad from the ad itself (the "…" menu > "Report ad") or, for Google, through the report an ad form.
3. If your trademark is registered, file a trademark complaint against the advertiser: the Meta forms above, and for Google Ads the "Report Content On Google" process. Google only accepts these in countries where you hold trademark rights.
4. If you qualify, apply for Meta's Brand Rights Protection: it lets registered trademark owners search for and report infringing content, accounts and ads at scale on Facebook and Instagram, including scam ads that exploit the brand name.
5. In the UK, also report the ad to the ASA's scam ad alert system.
6. If the ad features a fake version of your CEO (photo, video or cloned voice), treat it as a deepfake too: see our scam ad guide and AI voice clone guide.

5. Clone sites, typosquatting and phishing

1. Find the host and the registrar: ICANN Lookup shows the registrar and its abuse contact. For a site behind Cloudflare, use abuse.cloudflare.com, which forwards to the real host.
2. Email the abuse contacts of the host and the registrar with the URL, screenshots, proof that you are the brand being imitated and, for phishing, examples of victims. ICANN-accredited registrars must investigate and respond to abuse reports.
3. Get the site blocked in browsers: report it to Google Safe Browsing; in the UK, to the NCSC suspicious website service; forward scam emails to the NCSC at report@phishing.gov.uk, and scam texts to 7726 (your mobile operator's free reporting number).
4. Alert the payment provider the fake site uses (PayPal, Stripe, the acquiring bank): cutting off payments often ends the scam.
5. Ask search engines to delist it: see our guide to removing a Google result.
6. To recover the domain itself, use the UDRP (WIPO and other providers) for .com, .net, .org and most generic extensions; country domains have their own schemes (Nominet's DRS for .uk, Afnic's Syreli for .fr). In the US, the Anticybersquatting Consumer Protection Act also allows a lawsuit. These need a well-argued case: involve a trademark lawyer.

6. Report the fraud and get legal help

United States: report to the FTC at ReportFraud.ftc.gov; since April 2024 the FTC's Impersonation Rule lets it sue scammers who pose as businesses. If customers lost money online, report to the FBI's IC3.

United Kingdom: report to Report Fraud (England, Wales and Northern Ireland; the service that replaced Action Fraud). A business under active cyber attack can call 0300 123 2040. In Scotland, contact Police Scotland on 101.

European Union: report to your national police or cybercrime platform (in France, 17Cyber), and use the DSA notice procedure on each platform.

Everywhere: cease-and-desist letters, infringement or passing-off claims, damages and court orders to unmask the operator are a job for an intellectual property lawyer. This page does not replace one.

7. What the law says

In the US, the Lanham Act protects registered and unregistered marks against confusing use (15 U.S.C. §1114 and §1125(a)), and §1125(d) targets cybersquatting. In the UK, the Trade Marks Act 1994 protects registered marks and the common-law tort of passing off protects goodwill without registration. In the EU, an EU trade mark registered with the EUIPO is enforceable in every member state, and the Digital Services Act requires hosting services to offer a way to report illegal content. Using a fake brand page to take money is fraud almost everywhere. This page is general information, not legal advice: talk to an intellectual property lawyer about your case.