Log in Request a demo

How To Defend

How To Respond To Fake Social Media Accounts.

A fake social account alert means someone is using your brand name, logo or staff identity on a social network. Save proof first, then check whether the account is contacting customers or staff. Report it through the platform's impersonation form and warn your own people not to engage with it.

  • Brand
  • Raised by Brand Impersonation & Social Media Takedown
Alert area
Brand
Raised by
Brand Impersonation & Social Media Takedown
First 24 hours
7 steps
Investigation
7 checks
Who acts
Brand protection analyst, Social media manager, Customer support lead and 4 more
Last updated October 17, 2026

What This Alert Means.

A fake social account alert means a profile, page or group is posing as your company, your support team or someone who speaks for you. The module page lists fake brand pages, fake support accounts and influencer impersonation among the cases it covers.

MITRE describes this as an attacker technique: creating social media personas that may be fictitious or may impersonate real people, then using them to connect with targets. The usual aim is fraud, phishing or stolen logins.

First 24 Hours.

Capture proof, find out who is being targeted and start the report. Do these in parallel where you can.

Do now
  1. Brand protection analyst Open the alert from the Brandefense brand impersonation module and save screenshots, the profile address, creation date and every postScreenshot before reporting, as the profile may vanish
  2. Social media manager Check whether the account is messaging customers or tagging your real accountsNote which users replied
  3. Customer support lead Prepare a short reply for customers who ask if the account is realPoint them to your verified channels only
  4. Communications Post a notice on your official pages naming the real account handlesDo not link to the fake
  5. IT admin Check whether the fake sends people to a lookalike domain or login pageAdd any links found to your blocklist
  6. Fraud team Look for payment requests, giveaways or support scams run by the fakeRecord any victims
  7. Legal Ask which notices apply for this platform and countryCheck with your legal counsel before sending anything formal

Investigation Checklist.

One fake rarely stands alone. Look for the whole set.

Check the fake account
  • Does the handle copy your name with small changes, such as swapped letters or an added word?List every variant
  • Does the same name, logo or bio appear on other platforms?Check each major platform
  • Is the account verified or paid for, or does it only look official?Check the platform's own badge rules
  • What does it ask for: direct messages, payments, logins, documents?This sets the urgency
  • Who follows it, and are your staff or customers among them?Warn those people directly
  • Does it link to a website, form or chat app outside the platform?Pivot to the domain or hosting provider
  • Are there fake accounts for your executives or support staff?Report those under executive impersonation too

Containment And Removal.

Most removals start with the platform. Keep a log of each report, its date and any reply. Where a report stalls, add more evidence rather than resubmitting the same form.

  • Platform impersonation form: use the platform's own report option for impersonation or fake accounts. Name the real brand, point to your verified profile and attach your screenshots. Some platforms ask the rights holder to file, so ask your legal counsel whether the brand owner or a representative should submit it.
  • Trademark route: many platforms have a separate trademark complaint channel. Ask your legal counsel whether your marks are registered where needed.
  • Linked website: if the fake sends people to a site, report the domain to the registrar abuse contact and the site to the hosting provider. ICANN says registrars must publish an abuse email address and take reasonable and prompt steps to investigate reports.
  • Search or ad platform: if the fake appears in paid ads or search results, report it through that platform's ad policy channel.
  • National CERT or law enforcement: in Turkiye, report through USOM (usom.gov.tr), which says its services, including incident reports, now continue on the Cyber Security Directorate site (siberguvenlik.gov.tr). In the US, victims of fraud can file a complaint with the FBI IC3. In the UK, NCSC takes reports of scam websites and messages.
TipAsk staff and customers to report the fake as well, from their own accounts. Several clear reports can help the platform see the scale.

Longer-Term Hardening.

You cannot stop anyone creating an account, but you can make the real one easy to recognize.

  • Publish a list of official accounts on your website and link to it from every profile.
  • Get your own accounts verified where the platform offers it, and secure them with strong login controls. CISA advises enforcing multifactor authentication.
  • Write a support policy that says your team never asks for passwords or payment in direct messages.
  • Register handles that are close to your brand on major platforms, where it is practical.
  • Monitor for new accounts claiming your name. MITRE suggests watching for personas that claim to work for your organization, and for new accounts sending many connection requests to your staff.
  • Train staff to treat unknown contact requests with care. NCSC also advises reviewing social media privacy settings.

How To Measure That It Worked.

Use figures from your own case log.

  • Number of fake accounts found, reported, removed and still live.
  • Time from alert to first report, from your own log.
  • Customer complaints that mention a fake account.
  • Reports from staff and customers, as a sign of awareness.
  • Repeat accounts from the same person or set of links.
  • Share of your official accounts that are verified and use multifactor login.

Common Mistakes.

These slow removal or put people at risk.

  • Reporting without saving screenshots and the profile address first.
  • Replying to the fake account or contacting its owner, which may lead them to rename or delete it.
  • Posting a public warning that links to the fake and spreads it.
  • Reporting only one profile and missing copies on other platforms.
  • Ignoring the website the fake points to.
  • Sending legal threats before counsel has reviewed them.
  • Failing to tell customer support, so staff answer the fake's victims badly.

Questions.

  • How do I report a fake social media account pretending to be my company?

    Use the platform's impersonation or fake account report form. Name your brand, link your verified profile and attach screenshots. If the platform has a separate trademark complaint route, ask your legal counsel whether to use it as well.

  • What should I do first when I find a fake brand account?

    Save screenshots, the profile address and its posts before you report, because the account may disappear. Then check whether it is contacting customers, and warn them through your official channels.

  • Why does MITRE care about fake social accounts?

    MITRE lists creating social media accounts as an attacker technique. The accounts may be fictitious or may impersonate real people, and they are used to connect with targets. MITRE notes such accounts can come before spearphishing.

  • Who can remove a fake account besides the platform?

    If the fake links to a website, the registrar and the hosting provider can act on abuse reports. In Turkiye you can also report to USOM. In the US, victims of fraud can file a complaint with the FBI IC3.

  • Should I reply to the fake account?

    No. Replying can warn the owner, who may delete it and set up a new one. Keep your evidence, report through the platform and tell customers where your real accounts are.

Sources

  1. 1 MITRE ATT&CK T1585.001: Social Media Accounts
  2. 2 ICANN: Registrar abuse reports
  3. 3 USOM
  4. 4 NCSC: Phishing and scams
  5. 5 CISA: Avoiding social engineering and phishing attacks
  6. 6 FBI IC3: Business email compromise

This page is general security guidance. It is not legal advice. Notification duties and takedown rights depend on your country, your contracts and the facts of the case, so ask your legal counsel before you act on them.

More Playbooks.

All Playbooks
Brand Counterfeit product promotion A counterfeit promotion alert means a post, shop page, listing or ad is selling fake goods under your name. Save proof of the page and the seller first. Then report it to the platform's brand protection channel, check whether the shop is also taking card details, and ask your legal counsel about the next legal steps. Open Brand Fake mobile apps A fake mobile app alert means someone has published an app that copies your name, icon or look, in an app store or on a download site. Do not install it on a normal phone. Save proof of the listing, then report it to the store and warn your customers where to find the real app. Open Brand Fraudulent ads using your brand A fraudulent ad alert means a paid ad uses your brand name, logo or keywords to mislead people. It may point to a fake login page, a counterfeit shop or a malware download. Save the ad and its landing page first without clicking through on a normal device, then report both to the ad platform. Open

Keep Exploring.

Knowledge Hub
Glossary term Spear Phishing Spear phishing is phishing aimed at a chosen person or group instead of a large crowd. Open Glossary term MITRE ATT&CK MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. Open

Browse The Library.