DemoSee the dashboard, report widget and takedown live
DE Log in Free fraud scan
Playbooks and productChecklist

Brand protection RFP: a checklist for choosing a provider

Coverage, evidence, reporting channels, human review, data protection: the questions to ask brand protection providers before you decide.

Malte ZanderWritten with AI, reviewed by the author 6 min read
Contents
  1. How should you approach the selection?
  2. The checklist in eight areas
  3. Which answers are warning signs?
  4. How to test providers in the demo
  5. How does AI Fraud Protect help?
  6. FAQ
In short

A good brand protection provider finds fakes where they appear, delivers evidence that holds up with providers and in court, reports through every relevant channel and carries each case through to removal. Assess providers in eight areas: coverage, detection, assessment, evidence, takedown, human review, data protection and reporting. The checklist contains the questions that reveal the differences and the warning signs that should make you dig deeper.

Key facts
  • In a study of 286,237 phishing URLs, Google Safe Browsing detected only 18.41% of the pages (Lee et al., WWW 2025). Detection is not a solved problem.
  • In a study of 112,005 phishing sites, 31.3% showed their content only under certain conditions (CrawlPhish).
  • A notice to a host under the EU Digital Services Act needs four elements: an explanation, the exact URL, a name and email address, and a statement of good faith (DSA, Article 16).
  • Online platforms must prioritize notices from trusted flaggers, a status awarded by the national Digital Services Coordinators (European Commission).

How should you approach the selection?

In five steps, before you compare offers:

  1. Define the scope: which brands, domains, countries and risks? Phishing against customers, fake shops, fake verification pages?

  2. Build a shortlist of three or four providers that fit your scope.

  3. Send the questionnaire with the questions from the checklist below.

  4. Ask for a demo with your own case, not with the provider's sample data.

  5. Agree on a test, such as a scan of your brand, and compare the results.

The checklist in eight areas

1. Coverage

  • What kinds of fakes do you detect: lookalike domains, cloned websites, login pages, verification pages, ads, marketplaces?
  • Which domain endings do you cover, including country endings such as .de or .co.uk?
  • In which languages and countries do you report?

2. Detection

  • How often do you scan, and how many variants of our domains do you check?
  • How do you find pages that are only visible with certain parameters, for example behind a QR code?
  • How can customers, verifiers and staff report suspicious links?

3. Assessment

  • How do you tell a fake from a partner, an article or an empty domain?
  • Do you explain for each finding what was copied and why it is dangerous?
  • Who reviews inconclusive cases, a machine or a person?

4. Evidence

  • What does the evidence package contain: screenshots, registration data, DNS, hosting, TLS certificate, trademark evidence?
  • Is evidence captured with timestamps, and are earlier versions kept?
  • Can we export the evidence package, for example for our law firm? See The evidence package your law firm actually needs.

5. Takedown

  • Which channels do you report to: host, registrar, DNS provider, Google Safe Browsing, platforms?
  • Do your notices meet the requirements of the Digital Services Act?
  • Do you report in parallel, and how do you track responses, follow-ups and escalations?
  • What happens when a copy comes back after removal?
  • How do you hand cases over to our law firm, for example for a domain dispute?

6. Human review and mandate

  • Who approves a report before it is sent in our name?
  • Do you require a mandate and power of attorney from the rights holder?
  • Is it documented who made which decision and when?

7. Data protection and security

  • Is there a data processing agreement, and where is our data processed?
  • How do you handle personal data of suspected perpetrators and of people who report?
  • How is access for our team secured?

8. Reporting and collaboration

  • Which metrics do we see, and can they be broken down by brand?
  • How long does setup take, and what do you need from us?
  • Who is our contact, and how quickly do you respond?

Which answers are warning signs?

Five answers that should make you dig deeper:

  • Guaranteed removal times. How long a takedown takes is decided by hosts and registrars, not by the provider. See How long does a website takedown take?.

  • Automatic sending without review. Reports in your brand's name should be approved by a person. See Human in the loop takedowns.

  • No evidence export. Without an export, your cases stay with the provider, even after you switch.

  • No mandate required. Anyone reporting in your name without authorization acts without a clear basis.

  • Findings only, no cases. A provider that delivers alerts but doesn't pursue removal is a monitoring service. See Brand monitoring vs takedown.

How to test providers in the demo

Ask every provider to show four things using your own case:

  1. The path from finding to case: how is it assessed, and what does your team see?

  2. The evidence package: complete, timestamped, exportable?

  3. A sent report and the replies: what does the text look like, and where does the correspondence end up?

  4. A copy that came back: how quickly can the takedown be started again?

How does AI Fraud Protect help?

This is how AI Fraud Protect answers the key questions on the checklist: it detects lookalike domains, cloned websites, phishing pages and fake verification pages, through a domain scanner that checks up to 20,000 variants on a schedule and through the report widget for hidden pages. The AI compares every finding with your real page and names what was copied, and a person reviews inconclusive cases. The evidence package contains screenshots, including archived ones from earlier scans, WHOIS, DNS, hosting and IP, the TLS certificate, the AI analysis report and your trademark evidence, and it can be downloaded as a ZIP. Reports go out in parallel to the host, registrar, DNS provider and Google Safe Browsing, every message is reviewed and sent by a person, and only with a written mandate and power of attorney. Setup takes about 15 minutes.

Compare using your own case.

Start the free fraud scan for a short report within 48 hours, or request a demo to see a complete case in the app.

Start the free fraud scanRequest a demo

FAQ

How many providers should we compare?

Three or four is usually enough. More providers add effort without improving the decision.

Should we require a provider with trusted flagger status?

The status helps with online platforms, which must prioritize such notices. For hosts and registrars, it matters less than a complete, well-documented report. Ask about it, but don't make it a knockout criterion.

How do we recognize a fair pricing model?

By predictability. You should know in advance what a year costs and understand what you are paying for, for example per brand, per domain or per scope. Also ask about costs for setup, additional brands and procedures with your law firm.

How hard is it to switch later?

That depends mainly on whether you can export cases and evidence. Clarify this before signing, not afterwards.

Sources

More in this series

Back to the blogAuf Deutsch lesen