Malte ZanderContents
Warn customers as soon as a fake is confirmed and reaching people, not after it is gone. A calm warning names the fake address, gives the real one, says what you never ask for and explains what to do if someone already entered data. Send it through channels you control, leave clickable links out of the warning and give people one place to report what they see.
When should you warn customers?
When a fake is confirmed and is reaching people, or is about to. Signs are phishing emails, texts or ads in your name, or a live copy of your login or payment page.
Don't warn about every parked lookalike domain. That creates noise and trains people to ignore you. Watch those quietly and warn when a domain goes live or starts being distributed.
Don't wait for the takedown either. In AI Fraud Protect's experience, removal takes between two and fourteen days, and a warning protects people during that gap.
What must a good warning contain?
Six elements, each in one or two sentences:
What is happening: fraudsters send emails that imitate your brand and link to a fake login page.
How to recognize the fake: the fake address, the pretext and, if useful, a screenshot. Write the address so that it cannot be clicked, for example yourbrand-login[.]com.
Your real channels: your real domain, app and support number.
What you never ask for: passwords, one-time codes or card details by email, text or phone. Reputable providers never request confidential customer data that way, as the Bavarian state's service portal puts it (BayernPortal).
What to do if affected: change the password, contact support, call the bank if card details were entered.
Where to report: one address or form for suspicious messages and pages. Consumer centers advise people to forward phishing emails to the company concerned, so make sure that address exists (Verbraucherzentrale NRW).
How do you avoid causing panic?
With facts, not alarm. Specific information calms people, while vague danger makes them anxious.
Be concrete: one fake address and one pretext beat a general warning about online fraud.
Use neutral words: fake website, fraudulent emails. Say hack or data breach only if that is what happened, because that is a different message with different duties.
Say what you are doing: we have reported the site and are working to have it removed.
Keep it short: under 150 words in an email, with details on a help page.
Never blame the customer.
Avoid everything that looks like phishing: no countdowns, no attachments, no login buttons, no act now.
Which channels should you use?
Channels you control and that people already trust. Match them to the reach of the campaign.
| Channel | Use it when | Tip |
|---|---|---|
| Help or security page | Always, as the single source of truth | Refer to it by name in other channels: visit yourbrand.com/security |
| Notice on the login page | Logins are targeted | Seen exactly where people enter credentials |
| Email to affected customers | You know who was targeted | No links or buttons; ask people to type your address. Send from your usual, authenticated domain |
| In-app message | You have an app | A channel the fake cannot imitate |
| Social media | The campaign is broad or uses fake profiles | Pin the post and point to the help page |
| Support script | Always | Every agent gives the same answer |
| Partners and resellers | They are imitated too | Give them the same text |
Authenticated email matters here: Gmail requires bulk senders to publish a DMARC record and to align their From domain with SPF or DKIM (Gmail). A warning that lands in spam protects nobody.
What does a good warning template look like?
Adapt the brackets and keep the length. This version works for email, a help page and a pinned post.
Subject: Warning: fake [Brand] website in circulation
We have seen emails and text messages that imitate [Brand] and lead to a fake website at [fake-domain[.]com]. The page copies our login page and asks for your password.
Our real website is [yourbrand.com]. We never ask for your password, one-time codes or payment details by email, text message or phone. Please type our address into your browser or use our app instead of clicking links in messages.
If you entered your details on the fake page, change your password right away and contact us at [support number]. If you entered card details, please also call your bank.
We have reported the fake site and are working to have it removed. If you see a suspicious message or page in our name, please report it at [yourbrand.com/report].
[Name], [Team]
What should your support team say?
The same thing every time. Give agents a short script:
Thank the customer and ask for the exact link or a screenshot, without opening the link again.
If data was entered, guide them through the password reset and signing out of all sessions, and point them to their bank for card details.
Log the report in the incident case, with time and link.
Don't speculate about breaches or causes. Refer to the help page.
The full incident sequence is in our 24-hour response plan.
When is the warning over?
When the fake is offline and the emails or ads have stopped. Update the help page with the date, and keep a short archive of past warnings. A visible record shows customers that you take impersonation seriously, and it helps support teams answer late questions.
Request a demo to see how AI Fraud Protect takes fakes offline through host, registrar and browsers at once.
FAQ
Should we name the fake domain in the warning?
Yes, because it helps people recognize the fake. Write it so it cannot be clicked, for example with brackets around the dot.
Won't a warning make customers distrust our real emails?
The opposite, if you stay consistent. A clear statement of what you never ask for gives people a rule they can apply to every message.
Should the warning email contain a link?
Better not. Ask people to type your address or open the app. That habit protects them from the next fake too.
Do we need to warn if no customer has been affected yet?
If distribution has started, yes. A warning that arrives before the first victim is the best possible case.
Should the warning come from security or from customer service?
From the team customers know, usually customer service, with wording agreed with security and legal.