The first hour, how to get each kind of fake taken down, and how to make the next one harder.
Resources / Someone is impersonating my business online. What can I do?
Warn your customers first, on the channels they already trust, then report each fake to the platform that hosts it: the social network, Google, or the fake website's host and domain registrar. You cannot stop someone copying your logo, but you can make a fake short-lived, and you can make it obvious to customers which channels are really you. Takedowns take days. Warnings work in minutes.
Warn them before you chase the platforms
Every fake, with its address and the date
Where a complaint about a .au domain starts
The most common version is a fake social media page using your name, logo and photos, messaging your followers about a competition they have won or a deal that needs a quick payment. Close behind are lookalike websites that copy your site and take orders or card details, and fake Google listings for your business with a scammer's phone number on them.
Then there is email from an address one letter off from yours, usually sending invoices with new bank details to your customers. And, less often, fake job ads in your name that collect applicants' personal details or charge them a fee.
None of this is about you having done something wrong. Impersonators copy businesses that customers already trust, because the trust is what they are stealing.
Most businesses find out from a confused customer. You can find out sooner: set up a free Google Alert for your business name, search for it on the main social platforms every month or so, and ask your team to pass on anything odd a customer mentions, such as a message they did not expect or a price that does not sound like you.
Take screenshots of everything: the fake page or site, its full web address, any messages customers have forwarded to you, and the date. Platforms, banks and police all ask for evidence, and fakes can disappear and reappear under a new name.
Then warn your customers where they already find you: a pinned post on your real social pages, a short banner on your website, and a note to your email list if you have one. Say which accounts are really yours, and say plainly what you will never do, such as asking for payment by message or changing your bank details by email.
If anyone has already paid a fake, tell them to call their bank straight away and to report it through ReportCyber at cyber.gov.au.5 Speed matters for any chance of getting money back.
For a fake social media page, report it from the page itself using the platform's impersonation option, and do it from your business's real account where you can. Ask a few loyal customers to report it too. Include your business name, ABN and a link to your real page.
For a fake Google listing, report it in Google Maps as misleading business information or fraudulent activity. Where the name, phone number or website on a listing looks designed to mislead, Google also has a Business Redressal Complaint form.1
For a fake website, report it to Google Safe Browsing, which can make Chrome and other browsers warn people before the page opens.2 Then report it to the company hosting the site and the registrar that sold the domain. Our free Domain Checker shows who the registrar is. For a .au domain, a complaint must go to that registrar first.3 If the domain is confusingly similar to your business name or trade mark, the holder has no legitimate interest in it, and it was registered or is being used in bad faith, auDA's dispute process, the auDRP, can transfer or cancel it.4
Because platforms handle enormous volumes of reports and act fastest on the clear ones. A report that shows the fake, links to your real account, and includes your ABN or business registration is much easier to act on than one that just says it is fake.
Keep a simple log of what you reported, where and when, and follow up if nothing happens within a few days. A registered trade mark makes every one of these requests stronger, and it is the thing a domain dispute will ask about first.
In the meantime, your warnings are doing the real work. A customer who has seen your pinned post is far less likely to fall for the fake, whether or not it is still up.
Claim your name everywhere that matters, even on platforms you barely use, so the obvious handles are yours. Keep your Google Business Profile verified and up to date. Register the obvious versions of your domain, typically the .com.au, the shorter .au and the .com, so nobody else can.
Protect your email domain with SPF, DKIM and DMARC records. Once DMARC is enforced, at quarantine or reject, they let receiving systems refuse email that fakes your exact address, which closes the most convincing kind of fake. Our free Email Security Checker shows whether yours are set.
And tell customers, on your website and your invoices, how you will and will not contact them. A customer who knows you never ask for payment by message has a reason to pause when someone does.
When customers are losing money, it is a crime, and it should be reported through ReportCyber as well as to the platforms. Keep your evidence log, because it is what investigators and banks will ask for.
When the impersonator looks like another business trading on your name rather than a scammer, it is usually a legal question about business names, trade marks and misleading conduct. That needs advice for your circumstances; this article is general information only.
If you have cyber insurance, tell your insurer early. Policies often require prompt notice of an incident, and some include access to specialist help, so it is worth checking what yours covers before you spend money on fixing it yourself.
The invoice arrived with new bank details. Is it a scam?: The email version of impersonation, and the two-minute check that stops it.
Free Domain Checker: Find who holds a lookalike domain and which registrar to report it to.
Free Email Security Checker: Check whether your SPF, DKIM and DMARC are set, so your exact address is harder to fake.
Screenshot it with its web address, post a pinned warning on your real page saying which account is yours, and report the fake using the platform's impersonation option, from your business's real account if you can. Ask a few customers to report it too.
Report it to Google Safe Browsing so browsers warn visitors, then to the hosting company and the domain registrar. For a .au domain, complaints start with the registrar of record, and auDA's dispute process can deal with names confusingly similar to your business name or trade mark.
Report it in Google Maps as misleading business information or fraudulent activity, and use Google's Business Redressal Complaint form where the listing's name, phone number or website is designed to mislead. Keep your own Google Business Profile verified and current.
Not completely, but you can make it harder: claim your name on the main platforms, register the obvious domain variations, set SPF, DKIM and DMARC on your email domain, and tell customers how you will and will not contact them.
That depends on the circumstances and needs advice for your situation. What helps straight away is telling affected customers to call their bank and report through ReportCyber, warning everyone else on your real channels, and keeping a record of what you reported and when.
Tell us what you have found. We will help you work out where to report each fake, lock down your domain and email so they are harder to copy, and word the warning to your customers. Free 30-minute call, no obligation.
Prefer to talk? Call (02) 9053 8789.
Belivanis Information Systems