Someone Is Impersonating Your Business Online: How to Investigate Fake Websites, Profiles and Emails

Online impersonation can damage a business long before its owners realise what is happening. A fake website may copy the company’s branding, a fraudulent social media profile may contact customers, or an email address using a lookalike domain may redirect payments to an unauthorised account.

These incidents are not simply reputation problems. They can involve phishing, payment diversion, identity misuse, customer data exposure and organised fraud.

The challenge is that the visible fake account or website may be only one part of a wider operation. A convincing investigation needs to establish what is being impersonated, how the activity is reaching victims, what evidence exists and which response steps are appropriate.

This guide explains how to investigate suspected business impersonation, preserve useful digital evidence and reduce the risk of further harm.

What Does Online Business Impersonation Look Like?

Business impersonation occurs when someone uses a company’s name, branding, identity or other identifying information without authorisation to create a misleading impression of legitimacy.

The objective may be to deceive customers, suppliers, employees or business partners. In some cases, the impersonator wants to collect payments. In others, the aim is to obtain login credentials, distribute malicious links or damage the organisation’s reputation.

Common examples include:

• Fake business websites: A website copies the company’s logo, colours, service descriptions or contact details.
• Lookalike domains: A domain uses a slightly altered spelling or different extension to resemble the legitimate business.
• Fake social media profiles: An account copies the company’s branding and claims to represent its official support or sales team.
• Email impersonation: A message appears to come from a company employee, executive or department but originates from an unauthorised address or compromised account.
• Fake customer support accounts: Fraudulent profiles contact customers who are seeking assistance and direct them to unofficial websites or payment channels.
• Payment redirection: A customer or supplier receives altered payment instructions that send funds to an account controlled by someone else.

The same incident can involve several channels. A fake website may be promoted through social media, while email messages direct victims to the cloned domain.

Why Identifying the Fake Account Is Only the Beginning

Finding a suspicious website or profile is useful, but it does not necessarily explain who is operating it, how long it has been active or whether customers have already been affected.

A proper investigation should address several questions:

1. What legitimate business, employee or service is being impersonated?
2. Which websites, domains, email addresses and social media accounts are involved?
3. When did the suspicious activity begin?
4. How are customers or business partners being directed to the impersonator?
5. What information or payments are being requested?
6. Is there evidence of compromised legitimate accounts?
7. What records can be preserved before they disappear?
8. Which organisations or authorities should receive a report?

These questions help separate confirmed observations from assumptions. For example, a newly registered lookalike domain may be suspicious, but its registration alone does not prove who controls it or establish criminal intent.

Step 1: Identify Every Impersonation Channel

Start by documenting the full range of suspected activity.

Do not focus exclusively on the first fake website or social profile reported to you. Search for connected domains, alternative account names, email addresses, telephone numbers, messaging handles and payment instructions.

Create an incident inventory containing:

• The legitimate company name and official website.
• The suspicious domain or full URL.
• Social media platform and profile URL.
• Email addresses and relevant message details.
• Telephone numbers and messaging accounts.
• Dates and times when the activity was observed.
• A short description of what the suspicious account is doing.
• Any customer or supplier reports associated with it.

Record exact URLs rather than relying on display names. A social media account can change its visible name, and a website can redirect visitors to another address.

Also distinguish between a confirmed fake and an account that is merely unfamiliar. An employee may have created an authorised campaign account that is not widely known internally. Verify ownership before making public accusations.

Step 2: Examine Fake Websites and Lookalike Domains

A cloned website can look convincing. It may reproduce the original company’s logo, navigation, product descriptions, contact details and even legal notices.

Begin with a careful comparison between the official website and the suspicious one.

Look for:

• Misspellings or unusual domain extensions.
• Extra words, hyphens or substituted characters in the domain.
• Different contact details or payment instructions.
• Recently created pages that copy established company content.
• Unexpected login forms or requests for sensitive information.
• Links that lead to unrelated websites.
• Different terms, privacy notices or business addresses.
• Inconsistent branding or copied images.

A secure connection indicator or HTTPS certificate does not establish that a website is legitimate. Fraudulent websites can also use HTTPS.

Where appropriate, technical review may include publicly available domain registration information, DNS records, certificate details, hosting information and historical website records. These sources can help build a timeline and identify technical relationships, but they have limitations.

For example, privacy-protected registration details may conceal the registrant’s personal information. Hosting providers may operate infrastructure for many unrelated customers. Shared technical infrastructure does not, by itself, prove that two websites have the same operator.

Step 3: Investigate Fake Social Media Profiles

Fraudulent social profiles often imitate the official business account or a recognisable employee.

They may use copied profile photographs, company logos, similar usernames and descriptions that imply an official relationship. Some accounts directly message customers, while others publish misleading announcements or advertise fake promotions.

Document the profile before reporting it.

Capture:

• The complete profile URL.
• Username and display name.
• Profile photograph and banner.
• Account description and visible contact information.
• Relevant posts, comments and replies.
• Direct messages, where lawfully accessible.
• Dates and times of observations.
• Any links or payment instructions shared by the account.

Preserve the surrounding context. A screenshot of a single message may not show which account sent it, when it was received or what conversation preceded it.

If a customer provides evidence, ask them to retain the original conversation and avoid deleting messages. Do not ask customers to engage with the suspected impersonator to obtain more information.

Report the account through the relevant platform’s impersonation or abuse process. Provide the legitimate business profile, evidence of ownership where requested and specific examples of the misleading conduct.

Step 4: Examine Suspicious Emails and Payment Instructions

Email impersonation can be particularly damaging because a fraudulent message may appear to come from a trusted employee, supplier or executive.

One common method uses a lookalike domain. For example, a legitimate company might use examplebusiness.com, while an impersonator registers a visually similar domain with an additional word or altered character.

Another possibility is that a genuine business email account has been compromised. These are different scenarios and require different investigative steps.

Preserve the original email whenever possible, preferably in its native format with full headers. Forwarding a message as ordinary text may remove or alter information useful for technical examination.

Relevant details can include:

• Sender and reply-to addresses.
• Message ID and timestamps.
• Routing information in the email headers.
• Authentication results such as SPF, DKIM and DMARC.
• Links and attachment names.
• Payment instructions and account details.
• The recipient and any reported actions taken.

Email authentication results can help assess whether a message was authorised by a domain, but they do not independently establish the sender’s identity or prove that the content is genuine.

For a more detailed examination of suspicious messages, see Cyb3rsect’s guide to Email Forensics.

If the message requests a change to supplier bank details or urgent payment, verify the request through a previously established telephone number or trusted communication channel. Do not use contact details supplied in the suspicious message.

Step 5: Preserve Digital Evidence Before It Disappears

Online impersonation evidence can be changed or removed quickly. A fake profile may be renamed, a domain may stop resolving, and a fraudulent website may be replaced.

Preservation should begin as soon as the incident is identified.

Create a structured evidence record containing:

1. Screenshots and screen recordings

Capture the complete browser window where practical, including the URL, visible content and relevant timestamps. Record the steps taken to reach the suspicious page.

2. Original messages

Retain emails in their original format, including headers and attachments. Preserve messaging conversations through the platform’s available export or download functions where lawful.

3. URLs and domain information

Record the full address, redirects, relevant DNS observations and the date and time each item was collected.

4. Customer and supplier reports

Keep original submissions, correspondence and supporting files. Record when each report was received and who provided it.

5. Internal incident records

Maintain a timeline of discoveries, reports, account changes, customer notifications and mitigation actions.

6. Evidence handling records

Where the material may be used in legal, regulatory or disciplinary proceedings, record who collected it, when it was collected, how it was stored and any subsequent transfers or examination.

For a practical explanation of evidence preservation, see Digital Evidence Preservation: How to Preserve Digital Evidence for Cybercrime and Fraud Investigations.

Preserve evidence lawfully. Do not access accounts, systems or private information without appropriate authority. Avoid attempting to break into the suspected operator’s infrastructure.

Step 6: Determine Whether the Legitimate Business Has Been Compromised

Not every impersonation incident involves a fake account operating independently. Sometimes the attacker has gained access to a genuine company account.

This possibility deserves particular attention when customers receive suspicious messages from an established business email address or an official social media account begins publishing unexpected content.

Review relevant security records, subject to your organisation’s authority and retention arrangements:

• Recent account sign-ins and unusual login locations.
• Multi-factor authentication events.
• Password resets and account recovery activity.
• Newly authorised applications or connected services.
• Email forwarding rules and mailbox delegates.
• Changes to account administrators.
• Unexpected posts, messages or profile edits.
• Endpoint alerts and relevant security logs.

If compromise is suspected, follow your incident response procedure. Secure affected accounts, revoke unauthorised sessions and tokens where appropriate, reset credentials, review administrator access and enable or strengthen multi-factor authentication.

Preserve relevant logs before making changes where practical. Some security records may be overwritten or retained only for a limited period.

A review of What to Do After a Cyber Incident can help guide the initial response.

Step 7: Build a Timeline and Assess the Evidence

Once the evidence has been collected, organise it into a chronological sequence.

A timeline may include:

• Domain registration or first observed appearance.
• First known fake profile activity.
• Initial customer complaint.
• First suspicious email.
• Changes to payment instructions.
• Reports submitted to platforms or service providers.
• Account security actions.
• Customer notifications.
• Any further related activity.

The timeline can reveal patterns. For example, a fake website may have appeared shortly before customers received messages directing them to it.

However, correlation is not proof of common control. Similar wording, shared hosting or overlapping dates may justify further examination, but conclusions should reflect the strength and limitations of the available evidence.

A professional report should distinguish confirmed facts, technical observations, reasonable inferences and unresolved questions. See Digital Forensic Report: What a Professional Forensic Report Should Contain for more on presenting digital findings clearly.

Step 8: Report the Impersonation and Reduce Further Harm

Once the evidence has been preserved, take action through the appropriate channels.

Depending on the incident, this may include:

• Reporting a fake profile to the relevant social media platform.
• Submitting an abuse report to the domain registrar or hosting provider.
• Reporting phishing activity to the relevant email provider or security service.
• Contacting your bank or payment provider if payment diversion is suspected.
• Notifying affected customers, employees or suppliers.
• Consulting legal counsel about trademark, privacy, defamation or other relevant issues.
• Reporting suspected criminal conduct to the appropriate law enforcement or cybercrime authority.

The correct reporting route depends on the jurisdiction and nature of the incident. A platform report does not guarantee that a profile will be removed immediately, and a registrar or hosting provider may require specific evidence before taking action.

Customer communication should be accurate and practical. Explain which channels are official, how customers can verify payment requests and where they should report suspicious contact.

Avoid publishing unverified claims about the identity of the suspected operator. Public accusations can create additional legal and reputational risks.

Can an Online Impersonator Be Identified?

Sometimes technical and documentary evidence can help establish links between accounts, domains, infrastructure and communications. However, identifying the person behind an online operation is not always possible from publicly available information.

Operators may use privacy services, compromised accounts, shared hosting, disposable email addresses or infrastructure located in multiple countries.

Some records are held by third-party providers and may only be available through appropriate legal or regulatory processes. IP addresses and domain registration information should not be treated as automatic proof of an individual’s identity.

A responsible investigation explains what the evidence supports, what remains uncertain and what additional records may be needed.

How Cyb3rsect Can Help With an Online Impersonation Investigation

When a business discovers a fake website, profile or email operation, it may need more than a screenshot and a platform report. It needs an organised view of the incident and the available digital evidence.

Cyb3rsect focuses on digital investigations and evidence-led analysis. Depending on the agreed scope, available records and lawful authority, an investigation may involve:

• Reviewing suspicious websites, domains and online profiles.
• Examining relevant email evidence and message headers.
• Organising customer reports and incident records.
• Establishing a chronology of observed activity.
• Reviewing authorised technical records for indicators of account compromise.
• Documenting findings, limitations and recommended next steps.

The scope of any investigation depends on the evidence available and the access the client is authorised to provide. No investigation should promise guaranteed identification, removal of every fake account or recovery of funds.

If your business is dealing with suspected impersonation, visit Cyb3rsect to discuss the situation and the evidence you have preserved.

Protect Your Business Identity Before the Next Incident

Online impersonation can spread across websites, social platforms, email and messaging services. The longer it remains undiscovered, the more opportunities an impersonator may have to mislead customers or business partners.

A measured response starts with verification, evidence preservation and a clear understanding of what has happened. Secure genuine accounts, report fraudulent channels through the appropriate providers and communicate with affected people using trusted contact details.

Most importantly, do not confuse a suspicious indicator with a proven identity. Careful documentation and evidence-led analysis provide a stronger foundation for decisions, reporting and any further investigation.