Malte ZanderContents
In takedowns, automation is strong at finding, comparing, capturing evidence and preparing. A person should decide: whether a finding is a case, how it is framed and whether a report goes out in the brand's name. Every report is a statement by the rights holder, false reports damage partners and credibility, and providers act on complete, solid reports. Well prepared, approval takes a single click.
- A notice to a host under the EU Digital Services Act includes a statement that the information is accurate and complete to the best of the notifier's knowledge (DSA, Article 16).
- Hosts must decide on notices in a timely, diligent, non-arbitrary and objective manner, and disclose when they use automated means to do so (DSA, Article 16).
- As actionable evidence of phishing, ICANN cites, for example, a screenshot showing what the page imitates and the complete URL (ICANN).
- The detection system Phishpedia found 1,704 phishing sites in one month, 1,133 of them previously unknown (USENIX Security 2021).
What does human in the loop mean for takedowns?
A clear division of labor: the machine handles everything that happens fast, uniformly and at volume. The person handles everything that needs judgment, context and accountability. For takedowns, that means the software finds fakes, compares them with your real page, captures evidence and prepares reports. A person reviews, decides and sends.
That is not a compromise born of caution, but the fastest approach that works reliably. A false report sent automatically costs more time than any approval.
What machines do better, and what people do
| Task | Machine | Person |
|---|---|---|
| Find new domains and variants | Thousands per day, on a schedule | Not feasible |
| Compare a finding with the real page | Fast and consistent, on desktop and mobile | In unclear cases |
| Capture evidence | Complete and timestamped | Check whether anything is missing |
| Frame the case | Suggestion | Decision |
| Write the report | Draft with fitting grounds | Adjust and approve |
| Partner, fan page or fake | Hints from the ignore list | Judgment when in doubt |
| Escalation and legal action | Provide the documents | Decision with the law firm |
Why not send everything automatically?
Because a takedown report is not a technical message but a statement made in the rights holder's name. Five reasons favor human approval:
Accountability: whoever reports declares that the information is accurate and complete. A person who has seen the case should make that declaration.
Partners and resellers: a domain with your name may belong to a dealer, an agency or a subsidiary. A false report hurts the relationship more than any fake.
Edge cases: news, reviews, criticism and fan pages use your name without posing as you. They are usually not a case.
Credibility: abuse teams handle a great many reports. Whoever reports falsely again and again loses trust there, which can delay legitimate reports too.
Quality: providers act on solid evidence. A person sees whether the screenshot, link and grounds fit together.
False positives in brand protection shows how to keep false alarms from arising in the first place.
Where exactly does a person decide?
At six points in the life of a case:
Case or no case: is the finding a fake, a partner or something harmless?
Framing: phishing, brand forgery or certificate forgery. See Takedown framing.
Channels and wording: which providers, which grounds, which changes?
Sending: every message only goes out after a deliberate click.
Escalation: follow-ups, complaints to the registrar or ICANN, handover to the law firm.
Closing: is the page really offline, and does the case stay under watch?
How does the person stay fast?
By having the machine prepare everything needed for the decision:
Ready-made reports for every channel, with grounds that fit the framing and the evidence package attached.
Clear rules on when a finding is a case and which framing applies.
A maintained ignore list with your domains and partners, so these cases never come up.
Priority by risk, so critical cases are reviewed first.
Edit instead of rewrite: the draft can be adjusted before sending.
That way an approval takes seconds rather than minutes. In takedowns, the delay almost never comes from your own review but from waiting for providers. That is why reporting in parallel pays off, see One find, many reports.
Who decided what, and when?
Your law firm asks this when a case goes to court, and your leadership asks it when a partner complains. So document every decision: who initiated a takedown, changed a status or sent a report, and when. Together with the evidence package, that creates a traceable file, see Chain of custody for digital evidence.
How does AI Fraud Protect help?
In AI Fraud Protect, detection runs automatically and sending never does. The AI finds and assesses fakes, names what was copied and compiles the evidence package. The reports to host, registrar, DNS provider and Google are prepared to fit the framing, can be reviewed and edited before sending, and every message is reviewed and sent by a person, by email or through the provider's form. Inconclusive cases go to manual review, your domains and partners sit on the ignore list, and the activity history records every step. Reports are only made with a written mandate and power of attorney from the rights holder.
Start the free fraud scan for a short report within 48 hours, or request a demo to see the approval step in the app.
FAQ
Does AI Fraud Protect send anything automatically?
No. Every message is reviewed and sent by a person, by email or through the provider's form. Nothing goes out without a click.
Who is responsible for a false report?
Whoever reports declares that the information is accurate and complete to the best of their knowledge. That is why approval belongs with a person who has reviewed the case. This is not legal advice.
Does human review slow down the takedown?
Hardly, if everything is prepared. Approval then takes seconds. Most of the time passes while providers review, and you shorten that with parallel reports and solid evidence.
Do we need legally trained staff for approvals?
Not for standard cases with clear rules. For edge cases, escalations and legal action, involve your legal department or law firm.
Sources
ICANN: advisory on compliance with DNS abuse obligations, 5 February 2024