A Fake Account Is Using Your Company's Name. Don't Report It Yet

2026-11-02 · Philip Choo · AI9OS

A company discovers an account trading under its name. A fake customer-service profile collecting login details. A page promoting counterfeit products. A profile impersonating a named executive to solicit payments.

The instinct is to report it to the platform at once and get it taken down.

That instinct, acted on first, destroys the evidence. In impersonation work the order of operations is the whole method.

Why reporting first loses the case

A report to a platform is not a private act. It can prompt the operator to change the account, delete its history, or disappear before anyone has recorded what it was doing. Once it is gone, what it said, who it contacted and how it was connected to anything else is gone with it.

And an impersonation is often not one account. Report one account in a network, and the operator is warned that the others are at risk. They move the rest to new handles before those can be reported.

Capture first

Before any report is filed, for every account under suspicion:

• Record the full profile, the post history and any linked pages as images.
• Record them as structured data as well: the web address, the account identifier and the handle, and the timestamp of every post. An image of a profile is useful. An image plus the identifiers that let someone find the same account again, and prove it was the same account, is evidence.

This is ordinary preservation discipline, applied to the most perishable kind of source there is. The same logic runs through chain of custody for digital material: capture it in a form that can be shown later to be what it was.

Map the network before reporting any of it

Impersonation is frequently a campaign run through several accounts. The signals that tie accounts together include:

• accounts created at around the same time;
• posting that is synchronised across accounts;
• shared registration patterns, and linked contact details where these can lawfully be seen;
• the same links, images or phrasing recurring in ways that go beyond coincidence.

Accounts that share two or more genuinely independent signals can be treated as one campaign.

The discipline is to keep the test honest. Many unrelated low-effort scammers copy the same script. Two accounts using identical wording is not proof they are run by one person. Shared creation timing and shared registration details are much stronger than shared words. Where the target is a named executive rather than the brand, the two problems overlap, and the verification side is set out in verifying an executive is who the email says they are.

Report the whole network at once

Once the network is mapped, report every account in it at the same time, with the evidence of coordination attached where a platform's standard report route is slow.

Reporting one at a time is how a network survives: the first report warns the operator, and by the time the second is filed, the account it concerns has moved.

Expect it to come back

After a takedown, expect the operator to return under a new handle. That is normal behaviour for a live campaign, not a sign the report failed. Monitor for a defined period afterwards, and treat reappearance as a monitoring finding.

A single account reported on its own often simply goes quiet and returns days later with a new name. When that happens, the answer is to map the network more deeply before the next report, not to repeat the same single report.

What not to do

• Do not contact or engage the impersonating account. It warns the operator before documentation is complete.
• Do not try to gain access by requesting to follow, or by pretending to be someone else, in order to see non-public content.
• Do not attempt to unmask the real operator beyond public, platform or lawfully available information. A genuine attempt to identify the person behind a campaign is a separate matter that needs its own legal footing, and the lines are set out in whether doxxing is illegal in Singapore.

The distortions to watch

• A verified-looking profile or a large following is not proof of legitimacy. Social proof is exactly what an impersonator fakes or buys first.
• Several fake accounts telling the same story are not independent sources agreeing. That pattern is more likely one operator with several accounts. The pattern is the finding, not evidence that the story is true.
• Not every negative mention is an attack. A company under pressure can want all criticism treated as impersonation. Ordinary criticism of a brand is not a campaign, and should not be reported as one.

If it is your brand

"Before we report this, have we captured everything, and have we found all of it?"

Two questions, asked in that order. Reporting fast feels decisive. Reporting completely is what actually removes the campaign.