Malte ZanderContents
- What is brand impersonation?
- Which forms does brand impersonation take?
- Why does brand impersonation work so well?
- Who gets impersonated?
- What does impersonation cost you?
- How do you find impersonation early?
- How do you get a fake site removed?
- Which laws and rules help brand owners?
- How do you make your brand harder to copy?
- How does AI Fraud Protect help?
- FAQ
Brand impersonation means criminals pose as your organization online: with lookalike domains, copies of your website or login page, fake support channels and ads that use your name. They want credentials, money or credibility for forgeries. You stop it by finding copies early, securing evidence and reporting each copy to the host, the registrar and the browsers at the same time.
- APWG counted about 3.8 million phishing attacks in 2025, slightly more than the roughly 3.76 million in 2024 (APWG).
- In the fourth quarter of 2025 alone, phishing campaigns targeted 866 different brands (APWG).
- Since 5 April 2024, registrars for domains such as .com must promptly act on actionable evidence of phishing (ICANN).
- In the EU, hosting providers must run a notice-and-action mechanism and decide on notices in a timely, diligent and objective manner (DSA, Article 16).
What is brand impersonation?
Brand impersonation is any attempt to make people believe they are dealing with your organization when they are not. The impersonator borrows what people recognize: your name, logo, design, wording and the places where they expect to meet you.
The victim is usually your customer, partner or employee. The damage still lands on your brand, because people remember the name they trusted, not the criminal behind it.
Which forms does brand impersonation take?
Most cases fall into seven forms. Name the form first, because it decides which report is strongest and who has to act.
| Form | What it looks like | What the criminal wants | Guide |
|---|---|---|---|
| Lookalike domain | yourbrand-login.com, yourbrnad.com, yourbrand.support | A believable address for every other form | Lookalike domains |
| Cloned website | A copy of your site, often a fake shop or a fake investment firm | Orders, payments, leads | Clone sites vs phishing pages |
| Phishing login page | A copy of your sign-in page | Passwords, one-time codes, session cookies | Cloned login pages |
| Fake verification page | A page that confirms forged certificates as valid | Credibility for forgeries | Certificate fraud |
| Fake support channel | A help page, phone number or social account in your name | Remote access, payment data, account takeover | Fake support pages |
| Fake ad | A search or social ad that uses your brand | Traffic for all of the above | Impersonation in search ads |
| QR code lure | A QR code in an email, a letter or on a sticker | A click that bypasses email filters | Quishing |
Emails, texts and direct messages in your name carry most of these lures to people. From email to landing page follows one campaign through every step.
Why does brand impersonation work so well?
It works because trust is a shortcut. People recognize a logo and a familiar layout and stop checking the address bar, especially on a phone.
Three developments have made that shortcut cheaper to exploit:
Copies take minutes. In July 2025, Okta reported attackers using the generative AI tool v0 to build working replicas of sign-in pages from simple text prompts (Okta). More in AI-built phishing sites.
Kits do the rest. Phishing-as-a-service platforms rent out finished templates. Europol's 2024 operation against LabHost linked that one service to at least 40,000 phishing domains and about 10,000 users (BleepingComputer). See Phishing kits.
Domains cost a few euros. A replacement domain is registered the same day, so removing one copy rarely ends a campaign.
Who gets impersonated?
Any organization whose name unlocks something: a login, a payment, a parcel, a certificate. In the fourth quarter of 2025, the most targeted sectors were social media and SaaS or webmail brands (20.3% each), followed by telecom (18.7%) and financial institutions (9.3%) (APWG).
Smaller names are not safe either. Training providers, universities, test centers and chambers get copied because their pages confirm something valuable, such as a qualification. Read more in our certificate fraud guide.
What does impersonation cost you?
The direct loss usually hits your customers: stolen passwords, payments to the wrong account, forged documents accepted as real. The follow-up costs land with you:
Support load: every confused customer becomes a ticket, a call or a complaint.
Account takeovers: stolen credentials lead to fraud inside real accounts, which can become a data protection matter.
Lost trust: people tricked in your name connect the experience with your name.
Legal work: evidence, notices and sometimes proceedings take time from legal and security teams.
How do you find impersonation early?
You find it by watching the places a fake has to pass before it reaches anyone. No single source catches everything, so combine four:
New domains. Watch registrations that contain your name, common typos or lookalike characters. See how to find newly registered domains.
Certificate logs. Chrome requires publicly trusted TLS certificates to be logged in public Certificate Transparency logs (Chrome). A fake site with HTTPS therefore leaves a searchable trace.
Your own traffic. Copies often load your logo, fonts or scripts from your servers. Unknown referring domains in your logs can point to a clone.
The people who see the link. Customers, partners and employers often meet a fake before any scanner does, for example when it hides behind a long subdomain or parameters from a QR code. Give them one easy place to report it.
How do you get a fake site removed?
You get it removed fastest by sending complete reports to every party that can act, at the same time. Waiting for one answer before sending the next report costs days.
Secure evidence first. Capture the full URL, screenshots on desktop and mobile, WHOIS or RDAP data, DNS records, hosting and IP, the TLS certificate and a timestamp. Pages change or vanish once reported. Our evidence guide lists everything.
Notify the hosting provider. In the EU, a notice under Article 16 of the Digital Services Act explains why the content is illegal, gives the exact URL, names the sender and confirms good faith (DSA).
Notify the registrar. For generic top-level domains, registrars must publish an abuse contact and promptly take appropriate action on actionable evidence of phishing (ICANN).
Report to the browsers. Google Safe Browsing and Microsoft accept reports of unsafe sites. Their warnings protect visitors while the host is still reviewing.
Escalate where needed. If a registrar ignores a documented report, ICANN Compliance accepts complaints. For trademark cases, dispute procedures such as UDRP can transfer the domain.
For every channel by country, read How to report a phishing website in Europe. For the complete process, see How to take down a fake website.
Which laws and rules help brand owners?
| Rule | What it gives you | Scope |
|---|---|---|
| Digital Services Act, Article 16 | Hosts must accept electronic notices, confirm receipt and decide on them in a non-arbitrary way | Hosting services in the EU, applicable since 17 February 2024 (StreamLex) |
| ICANN registrar agreement, Section 3.18 | Registrars must act on actionable evidence of DNS abuse, which includes phishing | Generic top-level domains such as .com, .net and .online |
| Trademark law and UDRP | Grounds against lookalike domains and ads, and a route to transfer a domain | Registered trademarks; UDRP for generic top-level domains |
| Copyright | Grounds against exact copies of your texts, images and design | Cloned websites |
This overview is not legal advice. Your legal team or law firm decides on cease-and-desist letters and proceedings.
How do you make your brand harder to copy?
You cannot prevent copying, but you can make copies less convincing and less profitable:
Publish your official channels. One page that lists your real domains, support numbers and social accounts gives people something to check against.
Authenticate your email. Since February 2024, Gmail requires senders of more than 5,000 messages a day to use SPF, DKIM and a DMARC record (Gmail). An enforced DMARC policy makes spoofing your exact domain much harder.
Move logins to phishing-resistant methods. CISA calls FIDO/WebAuthn the only widely available phishing-resistant authentication (CISA). See why 2FA doesn't stop every phishing page.
Keep QR codes and verification pages on your own domain. Print the domain next to the code so people can compare. See Quishing.
Own the obvious typos of your main domain where that is cheap and plausible. See defensive domain registration.
How does AI Fraud Protect help?
AI Fraud Protect finds lookalike domains, cloned websites, phishing pages and fake verification pages that use your name. The AI compares every find with your real page and names what was copied, and the evidence package is compiled automatically. Reports go to host, registrar, DNS provider and Google Safe Browsing in parallel, and a person reviews and sends every message. A report widget on your website lets customers and partners report suspicious links in one place.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
What is the difference between brand impersonation and phishing?
Phishing is the method: tricking people into handing over credentials or data. Brand impersonation is the disguise that makes the trick believable. Most phishing pages impersonate a brand, but impersonation also covers fake shops, fake support and fake verification pages.
Is brand impersonation illegal?
In most cases, yes. Depending on the facts it can be fraud, trademark infringement, copyright infringement or a data protection violation. The legal ground you can prove decides which report is strongest. This is not legal advice.
How long does it take to remove a fake website?
In AI Fraud Protect's experience, between two and fourteen days. It depends mainly on the hosting provider, the registrar and the country. Browser warnings can protect visitors before the page is gone.
Can I report a fake site if I don't own the brand?
Yes. Anyone can report phishing to Google Safe Browsing, to the hosting provider or to national reporting services. Brand owners have extra levers, such as trademark complaints and domain dispute procedures.
Is monitoring enough to stop impersonation?
No. A find without a report changes nothing for the people who receive the link. Detection, evidence and parallel reports belong together, and closed cases need watching because copies return on new domains.
Sources
APWG Phishing Activity Trends Report, Q4 2025, published 18 February 2026
ICANN advisory: DNS abuse obligations in the registrar and registry agreements, 5 February 2024
Digital Services Act, Article 16, with the official text on EUR-Lex
Okta Threat Intelligence: v0 AI tool used to build phishing sites, 1 July 2025
BleepingComputer: LabHost phishing service disrupted, 18 April 2024
CISA: Implementing phishing-resistant MFA, October 2022