Malte ZanderContents
- What is a brand protection program?
- Who should own brand protection?
- What do you protect?
- Where do you look for fakes?
- How do you decide what to act on?
- Which playbooks do you need?
- What should you measure?
- Should you build, buy or combine?
- What do the first 90 days look like?
- How does AI Fraud Protect help?
- FAQ
A brand protection program is the standing process that finds fakes of your brand, decides what to do about them and gets them removed, again and again. Start with one owner, a list of what you protect, a few reliable detection sources, a playbook per case type, an evidence standard and four metrics. Add channels and automation once the basics run.
- In the fourth quarter of 2025 alone, phishing campaigns targeted 866 different brands (APWG).
- Since 5 April 2024, registrars for generic domains must promptly act on actionable evidence of phishing, which gives every program a reliable lever (ICANN).
- Online platforms in the EU must treat notices from trusted flaggers with priority; national Digital Services Coordinators award the status (European Commission).
- An EU trade mark covers all member states; the online application costs EUR 850 for one class (Austrian Patent Office).
What is a brand protection program?
It is the difference between reacting to fakes and managing them. Without a program, a fake site becomes a fire drill: someone notices, several people forward emails, nobody knows who reports where, and the same copy returns a month later. With a program, every find enters the same process, gets the same evidence and ends in a documented removal.
A program has six parts: an owner, a scope, detection, decision rules, playbooks for the response and metrics. Tools support each part, but none of them replaces the decisions you write down at the start.
Who should own brand protection?
One person owns it, several teams contribute. Ownership often sits with brand and marketing or with security, depending on where the most cases start. What matters is that one person can decide, escalate and report:
| Role | Responsibility |
|---|---|
| Program owner | Sets scope and rules, decides on unclear cases, reports to management |
| Legal | Trademark portfolio, power of attorney for reports, dispute procedures and court action |
| Security and IT | Technical analysis, email authentication, login security, incident response |
| Customer support | Collects reports from customers, answers questions, flags patterns |
| Communications | Warnings to customers and partners, press questions |
| External provider | Detection, evidence and reports at scale, depending on how much you buy in |
Write down who may send reports in the brand's name. Hosts and registrars act faster on reports from the rights holder or someone with its written mandate.
What do you protect?
You protect what people use to recognize you. An asset register keeps it in one place and is the basis for every detection rule:
Asset register: [company]
Brand names and spellings: [names, abbreviations, former names]
Registered trademarks: [mark, number, office, classes, owner]
Official domains: [domains, including country domains and defensive registrations]
Pages that are copied most: [login, checkout, verification page, support page]
Official channels: [support phone numbers, email addresses, social media accounts, apps]
People whose names are misused: [executives, support staff]
Partners and resellers allowed to use the brand: [names and domains for the ignore list]
Registered trademarks deserve a line of their own. A registration makes every report stronger and is a prerequisite for dispute procedures such as UDRP. An EU trade mark covers all member states with one application (Austrian Patent Office).
Where do you look for fakes?
You look where a fake has to appear before it can reach anyone. Each source catches a different kind of case:
| Source | What it finds | Effort |
|---|---|---|
| New domain registrations | Lookalike domains, often before they go live | Low once automated |
| Certificate Transparency logs | New HTTPS certificates for lookalike names | Low once automated |
| Search ads | Fake ads that bid on your brand | Medium |
| Social media and marketplaces | Fake profiles, fake support, counterfeit offers | Medium to high |
| Reports from customers and verifiers | Hidden pages that only appear with the right link | Low with a report widget |
| Support tickets | Payments you never requested, emails you never sent | Low if support knows what to flag |
| DMARC reports | Emails sent in your name from servers you do not use | Low once set up |
DMARC reports only arrive once your domain publishes a DMARC record, which you need anyway: since February 2024, Gmail requires senders of more than 5,000 messages a day to use SPF, DKIM and DMARC (Gmail).
Start with three sources that fit your typical cases and add more once you can handle the volume. A program that finds more than it can process creates a backlog, not protection.
How do you decide what to act on?
You decide with rules written before the first case, not during it. Rate every find by what it can do to people right now:
| Level | Example | Response |
|---|---|---|
| Critical | Live phishing page or fake verification page in use | Same day: evidence, parallel reports, customer warning if needed |
| High | Cloned website or fake shop that is online but not yet promoted | Within days: evidence and reports |
| Medium | Lookalike domain with a parked page or no content | Watchlist: check regularly, act when content appears |
| Low | Fan site, review, legitimate reseller | No action, document the decision |
The response times are internal targets you set, not guarantees from providers. Keep partners and resellers on an ignore list, and let a person confirm every report before it goes out. A wrong takedown against a partner costs more trust than a slow one against a fraudster. That is how you avoid false positives in brand protection before they hit a partner.
Which playbooks do you need?
You need one short playbook per case type, so nobody improvises under pressure. Each playbook names the framing, the evidence, the channels and the customer communication:
Phishing page: evidence, reports to host, registrar, DNS provider, Google Safe Browsing and Microsoft, customer warning if links circulate. See Phishing in your name: a response plan for the first 24 hours.
Cloned website or fake shop: copyright and trademark framing, host and registrar, payment providers where visible. See Clone sites vs phishing pages.
Fake support or fake ad: ad platform report, landing page takedown, official contact details pushed in search. See Fake support pages and Brand impersonation in search ads.
Fake verification page: certificate forgery framing, takedown, warning to verifiers.
Parked lookalike domain: watchlist, defensive registration or dispute procedure if it threatens your brand.
The steps that every playbook shares are described in How to take down a fake website, and the evidence standard in Securing evidence of a fake website.
What should you measure?
Measure speed, effect and recurrence. Four numbers tell management whether the program works:
| Metric | What it shows | How to measure |
|---|---|---|
| Time to detect | How long a fake was live before you found it | Find date minus first seen date, where visible |
| Time to removal | How fast your process ends harm | Removal date minus find date, per channel |
| Removal rate | Whether your reports work | Removed cases divided by reported cases |
| Recurrence | Whether operators come back | New cases linked to earlier ones |
Report open cases and risks alongside the numbers. A monthly one-page summary is enough for most leadership teams.
Should you build, buy or combine?
Most teams combine. Detection and evidence scale badly by hand; decisions and relationships with your legal team do not belong outside. Compare the options honestly:
| Option | Strengths | Limits |
|---|---|---|
| In-house only | Full control, deep brand knowledge | Detection and follow-ups do not scale, knowledge leaves with people |
| Fully outsourced | Coverage and routine from day one | Less control over framing and tone, risk of reports you did not approve |
| Combined | Tools find and prepare, your team decides | Needs a clear owner and agreed rules |
Before you buy, ask how a provider collects evidence, which channels it reports to, whether a person reviews every report and how it protects partners from wrong takedowns. These questions are the core of any brand protection RFP checklist.
What do the first 90 days look like?
| Phase | Goal | Tasks |
|---|---|---|
| Days 1 to 30 | Foundation | Name the owner, fill the asset register, check trademark coverage, run a baseline scan |
| Days 31 to 60 | First cases | Write playbooks for your two most common case types, set up three detection sources, take down active fakes |
| Days 61 to 90 | Routine | Add a report channel for customers and verifiers, start the monthly metrics, review the rules with legal |
How does AI Fraud Protect help?
AI Fraud Protect covers the parts of a program that do not scale by hand. It scans for lookalike domains, cloned websites, phishing pages and fake verification pages, collects reports from customers and verifiers through the report widget, and builds an evidence package for every case. Reports to host, registrar, DNS provider and Google are prepared in parallel, and a person reviews and sends each one. Partners stay on the ignore list, and the activity history documents every step for your metrics.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
What does a brand protection program cost?
It depends on scope and volume. Fixed costs are trademark registrations, for example EUR 850 for an EU trade mark in one class, plus tools and staff time. Small programs often start with one owner, a few hours a week and a monitoring tool.
Do small companies need a brand protection program?
Yes, in a lighter form. Small brands are copied because their certificates, logins and payments are rarely checked against the source. One owner, a short asset register and a takedown process already cover most risks.
Who should own brand protection?
One person with the authority to decide and escalate, usually in brand and marketing or in security. Legal, support and communications contribute, but a program without a single owner stalls at the first unclear case.
Can takedowns be fully automated?
Detection, evidence and the preparation of reports can be automated. The decision to send a report in your brand's name should stay with a person, because a wrong report against a partner or a legitimate site damages trust.
What is the first step?
A baseline: list your official domains and trademarks, then find out which fakes already exist. The result shows which case types matter most for you and where the first playbooks should go.
Sources
APWG Phishing Activity Trends Report, Q4 2025, published 18 February 2026
ICANN advisory: DNS abuse obligations in the registrar and registry agreements, 5 February 2024
European Commission: trusted flaggers under the Digital Services Act