Malte ZanderContents
- What is a false positive in brand protection?
- Where do false positives come from?
- What do false positives cost?
- The ignore list: what belongs on it?
- Clear rules: when is a finding a case?
- When does a person review?
- Watchlist instead of takedown
- Measure and reduce false positives
- How does AI Fraud Protect help?
- FAQ
A false positive is a finding that looks like a fake but isn't: a partner's domain, an old campaign site of your own, an article about your brand. False positives cost time and, if they get reported, trust with partners and providers. You prevent them with a complete ignore list, clear rules on when a finding is a case, a watchlist for borderline cases and human review before every report.
- Online platforms in the EU must suspend processing notices from anyone who frequently submits manifestly unfounded notices, after a prior warning and for a reasonable period (DSA, Article 23).
- Anyone sending a notice to a host under the Digital Services Act declares that the information is accurate and complete to the best of their knowledge (DSA, Article 16).
- ICANN reports that many complaints about DNS abuse were incomplete (ICANN).
What is a false positive in brand protection?
A finding that has the hallmarks of a fake but deceives no one. A domain scanner looks for your name, for misspellings and for add-ons like login or shop. Along the way it inevitably finds domains that belong to you, to your partners or to people who write about you. The skill is not having no such findings at all, but sorting them out quickly and safely before anyone reports them.
Where do false positives come from?
From six sources, each with its own fix:
| Source | Example | What helps |
|---|---|---|
| Your own domains | Old campaign sites, country domains, subsidiaries | A complete ignore list |
| Partners and dealers | Resellers, agencies, franchisees with your name in their domain | A partner list, maintained regularly |
| Coverage and opinion | Press, review sites, criticism, fan pages | Rule: no impersonation, no case |
| Same names and generic terms | Another company with a similar name in a different industry | Review by a person |
| Empty or parked domains | A domain for sale, a placeholder page unrelated to you | Watchlist instead of takedown |
| Already neutralized domains | Domains taken over by security researchers or authorities | Check current content and registration |
What do false positives cost?
More than the time it takes to sort them out:
Relationships: a partner who gets reported remembers it longer than any joint campaign.
Credibility: abuse teams and platforms handle a great many reports. Anyone who frequently reports without good reason even risks, with online platforms, having their notices left unprocessed for a while.
Legal risk: an unjustified report can trigger claims from the party affected. Your legal team decides in each case.
Attention: a team that sees harmless findings every day overlooks the dangerous ones more easily.
The ignore list: what belongs on it?
Everything that belongs to you or your partners and must never be reported:
All of your own domains, including country, campaign, test and legacy domains.
Domains of subsidiaries and sister companies if you are part of a group. See Multi-brand protection.
Partners, dealers and resellers who use your name with your consent.
Agencies and service providers that run campaign sites or landing pages for you.
Give the list an owner and review it regularly. When a partnership ends, the domain goes back under observation. When a partner lets a domain lapse, it can fall into someone else's hands.
Clear rules: when is a finding a case?
A finding becomes a case when all three conditions are met:
Impersonation: the page poses as you, with your name, logo, design or copy.
Deception: visitors are meant to believe they are dealing with you, not with a third party talking about you.
Harm: the page asks for data, sells something, confirms certificates or redirects to pages that do.
If one condition is missing, the finding is usually not a case for a takedown. An article about you fails the first two conditions, and an empty domain with your name doesn't meet the third yet and belongs on the watchlist. Takedown framing shows how to classify real cases afterwards.
When does a person review?
Before every report, and especially carefully in three situations:
Unclear cases where the AI gives no clear assessment.
Domains that look like partners, for example with city names or dealer terms.
Cases with possible legal implications, such as companies with the same name or criticism.
For high-impact cases, such as a report against a domain that might belong to a well-known company, a second pair of eyes pays off. Human in the loop takedowns explains why the person in the process is indispensable.
Watchlist instead of takedown
Many borderline cases are neither false positives nor cases, but risks. A parked domain with your name, a domain for sale or a page under construction with your favicon belongs on the watchlist. There it is reassessed with every scan. As soon as content, a form or mail servers appear, the risk becomes a case.
Measure and reduce false positives
Record how many findings you sort out and why: own domain, partner, coverage, same name, empty. If one reason keeps growing, something is usually missing from the ignore list or the rules. Review these numbers monthly and adjust the list and rules. Measuring takedown success shows how to build your metrics overall.
How does AI Fraud Protect help?
In AI Fraud Protect, your own domains and partners are on the ignore list and are never reported. The AI compares every finding with your real page, rates the risk and names what was copied. Inconclusive cases go to manual review. Domains without content but with risk stay on the watchlist and are reassessed with every scan, and low-risk findings can be ignored. Detection runs automatically, sending never does: every message is reviewed and sent by a person.
Start the free fraud scan for a short report within 48 hours, or request a demo to see the ignore list, watchlist and review in the app.
FAQ
How many false positives are normal?
That depends on your brand, for example on how common your name is and how many partners use it. The trend matters more than any number: with a maintained ignore list and clear rules, false positives should drop clearly after the start.
What if a partner was reported by mistake?
Withdraw the report with the provider immediately, inform the partner, apologize and add their domains to the ignore list. Then check which rule let the mistake through.
Are fan pages and criticism a case?
Usually not, as long as they don't pose as you. Whether a page crosses the line into deception or infringement is something to clarify with your legal team. This is not legal advice.
Can a domain on the ignore list still become dangerous?
Yes, if a partner gives it up and someone else registers it. That is why the ignore list needs regular checks that every entry is still current.