Someone is impersonating my business online — the first 48 hours

Why the first two days matter#

Impersonation is a race against disappearance. The account that is messaging your customers today may be renamed tomorrow and deleted the day after — taking with it the proof of what it did. The people behind it know this; it is why they move quickly and why they rely on their targets to panic. A business that spends the first morning arguing with the impostor, asking friends to mass-report the account, and posting angry warnings has usually lost the evidence by the afternoon and achieved nothing the platform can act on.

The sequence below is designed to reverse that. Preserve first; report through the channels that have power; warn your customers once, calmly; then track. It applies equally to a cloned Instagram or Facebook page, a look-alike WhatsApp Business profile, a copied YouTube channel, an X account using your name, a fraudulent listing on a marketplace or map, or a website that mirrors yours. It is not legal advice. Where money has been taken or threats made, the police are the right authority, and a qualified lawyer should advise on anything beyond the platform and police reports.

Hour zero: stop, do not engage#

Do not message the impostor. Do not comment on their posts. Do not block them yet — blocking can hide the account from you and complicate your own evidence-gathering. Do not ask your followers to report the account en masse; coordinated reports without evidence rarely help and can look like harassment. Do not pay anything to anyone who promises to "get it removed" or to reveal who is behind it; the first is a false promise and the second is something only a court or competent authority can direct a platform to do.

Tell one person in your organisation, and make them the owner of the incident. In Spy Monk, that person opens an impersonation case with URGENT priority, which notifies the team in-app and gives everything that follows one home.

Hours zero to two: preserve#

Capture everything before you touch anything.

• The profile or page itself: full-page screenshots that show the URL or handle, the display name, the profile picture, the bio, follower counts and the date and time on your screen. Several screenshots as you scroll are better than one.
• Every post, story or listing the impostor has published, especially offers, prices, payment requests and anything that uses your logo, photographs or copy.
• Every message the impostor has sent to you, your staff or your customers that you can obtain. Ask affected customers to forward screenshots with the sender's details visible.
• Payment details the impostor has shared: UPI IDs, bank account numbers, phone numbers, QR codes. These matter most to the police.
• Your own genuine assets: screenshots of your real profiles and website, with dates, so platforms can compare.

In Spy Monk, each file is fingerprinted with SHA-256 and timestamped on upload, and the case timeline starts at the moment you found the account. Add a URL and Spy Monk also attempts an HTML snapshot of the page. The point is not technical elegance; it is that in three weeks, when a platform or a police officer asks what the account looked like on the day, you can show them, and show that the file has not changed since.

Hours two to twelve: report to the platform#

Every major platform has an impersonation policy and a dedicated reporting route, and they share a logic: impersonation of a person or organisation is prohibited; parody, commentary and fan accounts are permitted only when they say so clearly and do not mislead; and the platform acts on reports from the impersonated party or an authorised representative, usually after seeing proof of identity or authority.

Meta's Community Standards on authentic identity cover Facebook and Instagram, which provide in-app and web forms for reporting an account or page pretending to be you or your business; expect to supply a government ID for a person or business documents for an organisation. X's authenticity policy prohibits posing as individuals, groups or organisations to deceive, permits parody and fan accounts only with clear labels, and directs those being impersonated to a specific report form. YouTube's impersonation policy covers channels that copy another channel's name or branding and the use of a real person's likeness or AI-generated voice to mislead, allows fan channels only when the name or handle says so, and removes channels established to impersonate; reports go through its channel-report form. Google Maps' content rules prohibit using Maps to impersonate a person or organisation, and a business can report a listing or review that does so.

Use the specific impersonation form, not a generic "report spam" button. State the facts the policy cares about: that the account uses your name, logo and images; that it is not labelled as a fan or parody account; that it is soliciting money or contacting your customers. Attach your identity or authority documents. Note the reference number or confirmation in the case.

Indian law gives this report teeth. Under rule 3(2)(b) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended with effect from 20 February 2026, an intermediary must, within two hours of receiving a complaint from an individual, take reasonable and practicable steps to remove or disable access to content that is in the nature of impersonation in an electronic form, including artificially morphed images, as well as content showing the person in a private act. Separately, under rule 3(2)(a) the platform's grievance officer must acknowledge any complaint within 24 hours and resolve it within 7 days. Record the time you filed. If the platform does not act within its legal window, you have a documented grievance and, through a lawyer, further options.

Hours two to twelve, in parallel: report to the police where money or threats are involved#

If the impostor has taken payments from customers, asked for OTPs or credentials, or made threats, this is a crime as well as a platform violation. Cheating by personation and identity theft are offences under sections 66D and 66C of the Information Technology Act, 2000, and cheating by personation is an offence under section 319 of the Bharatiya Nyaya Sanhita, 2023; the police and the courts decide what applies. Report at the National Cyber Crime Reporting Portal, cybercrime.gov.in, or call the 1930 helpline — for financial fraud, the earlier the report, the better the chance of freezing funds. Complaints are routed to the relevant State or Union Territory police. Keep the acknowledgement number in the case.

Encourage affected customers to file their own complaints, with their transaction details, and offer them your evidence. A platform report says "this account is not us"; a police complaint says "this account has defrauded people". Both should exist.

Hours twelve to twenty-four: warn your customers, once#

Now — and not before — tell your audience. One notice, posted on your genuine channels, approved by the person responsible for communications. It should say which accounts and numbers are genuine, that you never request advance payments or OTPs by direct message (if that is true), that an impostor account is being reported, and where customers who have been contacted can reach you. Do not name the impostor account in a way that drives traffic to it; do not speculate about who is behind it; do not promise that it will be removed by a particular time.

In Spy Monk, draft the notice in the case, record the approval, and post it once. Resist the urge to post updates every few hours; a single pinned notice, updated when something material changes, is calmer and more credible.

Day two: track, verify, and widen the net#

By the second day you should have a platform reference, possibly a police acknowledgement, and a pinned notice. Now check the platform's action: has the account been removed, labelled or left in place? Record the outcome. If a platform has not acted within its legal window, note that and consider, with a lawyer, a formal grievance to its grievance officer.

Widen your search. Impostors rarely stop at one platform; look for the same name and images on other networks, on marketplaces, in app stores and on look-alike domains. Add each one to the case as linked evidence with its own report. A Spy Monk monitoring project with your brand name, misspellings and product names will surface new mentions in news, search and video sources where the providers are enabled; direct detection of look-alike social profiles needs the Phase 2 connectors, so until then this remains a human task supported by your customers' reports.

Finally, close the loop with customers who were defrauded: acknowledge them, point them to the police route, and record their cases. How you treat the victims of an impersonation is itself a reputation event.

What Spy Monk does and does not do here#

DRS gives the incident one home: an urgent impersonation case with fingerprinted evidence, our guides' lists of what each platform's form asks for, the legal timelines to record against, an approval step for the customer notice, and a timeline from discovery to verified outcome. It does not remove accounts, does not file reports or police complaints on your behalf, does not identify who is behind an account, and does not yet detect look-alike profiles automatically. Those limits are stated throughout the product.

When to consult a lawyer#

This guide is general information, not legal advice. Consult a qualified lawyer promptly when money has been taken from customers; when the impostor is making threats or demanding payment from you; when a platform has not acted within its legal timelines; when the impersonation involves a regulated profession such as medicine or law, where additional rules apply; when you are considering any legal notice or proceeding; or when you need to pursue a court direction for disclosure of the account holder. Preserve the evidence first so that the advice starts from a complete record.