The Impostor Window: A 48-Hour Runbook for Brand Impersonation

A fake profile using your logo is not merely a social media problem. It is a communications incident with a short window in which evidence can be lost, customers can be misled and internal effort can fragment. The impostor does not need to be sophisticated. A copied profile photograph, a plausible handle and a direct message to a handful of customers is often enough to create confusion.

The temptation is to hand the matter to whoever is running the social accounts that morning. That is understandable, but it is not a durable response. Impersonation touches brand monitoring, customer service, security, legal and sometimes finance. A documented 48-hour runbook gives the organisation a single sequence of actions, a named owner and a record of what was reported, where and when.

Treat the fake profile as an incident, not a post

The first decision is whether the organisation is dealing with impersonation or account compromise. If an official profile has been accessed by someone else, the priority is credential reset, session revocation and platform recovery. If a separate profile is copying the brand, the priority is evidence capture, reporting and customer communication.

Either way, the response should run through one incident channel. A shared inbox, incident log and named lead are enough to begin. The lead does not need to be a security specialist. A communications or operations manager can coordinate the work, provided the remit is clear and the log is kept current.

Hours 0 to 2: name an owner and open a log

The opening phase is about containment and record-keeping. The organisation should nominate an incident lead and a scribe. The lead owns the sequence of actions. The scribe records times, platform names, URLs, handles, account identifiers and the names of people who have been informed.

Front-line staff should be told that a suspected impersonation is under review. They should not message the fake account from a corporate profile, as this can alert the operator and prompt deletion. Scheduled posts do not need to be paused wholesale, but any post that could be confused with the impostor's message should be reviewed.

A simple incident log should include the first report time, the platform, the profile URL, the display name, the handle, the account ID if visible, screenshots and the customer contact route that has been affected. The log should also record whether the matter involves a fake profile, a spoofed email address, a cloned website, a lookalike domain or a spoofed WhatsApp handle. These are different problems with different reporting routes.

Hours 2 to 6: capture what will disappear

Impostor accounts often vanish when challenged. Evidence should therefore be captured before reports are filed. Screenshots should include the browser address bar, the profile name and the visible posts or messages. For messaging apps, capture the number in international format, the profile name and photograph, the message timestamps and the full thread where a customer has forwarded it.

Email impersonation requires full message headers, not just a screenshot of the body. Website clones should be captured with the URL, page content and any payment or contact details shown. Evidence should be stored in a shared incident folder rather than on personal phones, with a file-naming convention that includes the date, platform and account identifier.

The organisation should also check whether the impostor has approached customers, suppliers or staff. A short search of mention alerts, direct message queues and customer service notes will show whether the incident is still contained or already spreading. Brand-monitoring tools and saved searches for company name variants, common misspellings and campaign hashtags are useful here, but they must be set up before the incident to be useful during it.

Hours 6 to 12: file platform reports in a fixed order

Platform reporting routes change, and none should be treated as a guaranteed takedown service. The runbook should nonetheless specify an order. For Meta properties, report the profile through the impersonation option and, where available, use the business support route. For LinkedIn, report the profile as fake or as pretending to be a business. For X and TikTok, use the impersonation reporting flow. For WhatsApp, report and block the account, and warn customers through official channels. For fake Google Business Profiles, use the listing redress route.

Each report should be logged with the platform, report reference, time submitted and any stated review window. The organisation should not rely on a fixed 24-hour removal. The target of the runbook is documented action within 48 hours, not a promise that every platform will act within that period.

Hours 12 to 24: get ahead of customer conversations

Customer communication should begin before the impostor's messages become the story. A holding statement should be factual, short and free of speculation. It should say that the organisation is aware of accounts or messages that are not operated by it, list the official channels, and state clearly that the firm will not request payment or credentials through direct messages.

The statement can live on the website help page and be linked from official social profiles. Front-line staff should have a short script for customers who ask whether a message is genuine. The script should direct them to the official contact route and ask them to preserve any suspicious message. If customers may already have shared payment details, the incident lead should involve finance and legal immediately.

Hours 24 to 48: escalate, then close the loop

If there is a financial loss, a fraudulent payment attempt or a clear cybercrime element, report the matter to Action Fraud and record the crime reference. If the conduct is a misleading commercial practice, the organisation can report it through the Citizens Advice consumer service, which routes concerns to Trading Standards. Legal advice should be considered where trademarks, passing off or defamatory content are involved. The Information Commissioner's Office should be involved only where personal data has been compromised.

The final phase is a short review. The incident lead should record how the impersonation was first detected, how long evidence capture took, which platform reports were filed, which customers were contacted and what monitoring gaps remain. The organisation should add lookalike handles, common misspellings and campaign-specific searches to its monitoring. It should also run a tabletop exercise so that the next incident does not begin with three people searching for the login details to a reporting portal.

The impostor's advantage is speed. The organisation's advantage is a runbook that turns a scattered reaction into a recorded, repeatable communications response.