Brand Impersonation Phishing: How It Works and How to Stop It

Brand impersonation is phishing in which criminals pose as a well-known company, such as a bank, retailer, telecom provider or government service, to trick its customers or staff. They use lookalike domains, spoofed emails, fake social media accounts, cloned apps and fake support numbers. Stopping it takes email authentication, constant monitoring and fast takedowns of everything that copies your brand.

For the brand, the damage lands twice. Customers lose money or data, and then they blame the company whose name was on the message. Support teams field the complaints, fraud teams handle the losses, and trust takes longer to recover than any single incident.

How common brand impersonation is

Impersonation is now the main form of threat on social media. In the Anti-Phishing Working Group’s Q1 2026 Phishing Activity Trends Report, contributor ZeroFox found that impersonation, meaning content falsely claiming to be from a real person, brand or organisation, made up 43.8% of all social media threats, and that threat volume rose on every platform during the quarter. Telecom and SaaS or webmail brands were the sectors phishers targeted most.

Why attackers impersonate brands

• To steal logins. A fake banking or webmail page collects usernames, passwords and OTPs, which are used to move money or take over accounts.
• To collect personal and card data. Fake shops, refund forms and KYC pages gather details that are sold or used for fraud.
• To take payments directly. Fake invoices, delivery fees, fines or “account reactivation” charges go to the criminal’s account.
• To spread malware. Cloned apps and fake software downloads install banking trojans or remote access tools.
• To reach a company’s staff. Impersonating a supplier, the CEO or IT support opens the door to business email compromise.

The four main brand risks

Domain infringement

Attackers register domains that look like yours: misspellings (typosquats), extra words such as “secure”, “verify” or “support”, a different ending, or your name as a subdomain of something else. These domains host phishing pages and send email that passes its own authentication checks, because the attacker controls the domain. Domain name monitoring catches them as they are registered.

Fake social media profiles

Bogus “help” or “offers” accounts copy a company’s name and logo, then reply to real customers who complain publicly, inviting them to a direct message or a link. We cover this pattern in social media impersonation.

Executive and VIP impersonation

Here the fake profile or email belongs to a person, often a CEO, CFO or senior manager. It is used to ask staff for urgent payments or gift cards, or to approach partners and investors with fake deals.

Rogue and malicious mobile apps

Copies of a company’s app appear on third-party stores, in links sent by text, or occasionally in official stores. They capture credentials, read SMS messages to steal OTPs, or simply show ads under the brand’s name.

How attackers make the impersonation convincing

• Sender forgery. The From address or display name is faked. Without a DMARC reject policy on the real domain, a forged message can show the brand’s exact address.
• Lookalike links. Link text shows the brand’s real address while the actual link points elsewhere, or the domain differs by one character.
• Copied design. Phishing kits copy logos, fonts, layouts and even cookie banners from the real site.
• Paid ads and search results. Fake support numbers and fake login pages are promoted through ads, so they appear above the genuine result.
• Real context. Messages refer to real events: a recent outage, a tax deadline, a sale the brand is actually running.

How to defend your brand: what to do

1. Lock down your own domains. Publish SPF, DKIM and DMARC, and move to a reject policy so nobody else can send mail as your exact domain. Do the same for parked domains that never send mail.
2. Monitor everything that copies you. Watch new domain registrations, certificate logs, social platforms, app stores and paid ads for your brand name, logos and executives’ names.
3. Take down fast. Each phishing site does most of its damage in its first hours. Report to registrars, hosts, platforms and browser blocklists, and keep chasing until the content is gone. A takedown service handles this at scale: TIKAJ and Hunto handle more than 100,000 takedowns a year for over 150 enterprise customers.
4. Tell customers what you never do. Put a clear line in emails, on your website and in your social bios, for example “We will never message you asking for your password, OTP or card PIN.”
5. Make it easy to report. Give customers a simple address or form for suspicious messages, and route those reports straight to the team that files takedowns.
6. Protect your executives. Monitor for fake profiles of senior staff and require call-back verification for any payment request made by email or chat.
7. Use two-factor authentication on customer and staff portals so stolen passwords alone are less useful.

Brand impersonation vs brand infringement

The two overlap but aren’t the same. Brand infringement is the unauthorised use of a trademark, which can include counterfeit goods or a competitor using a similar name, and is mostly a legal and commercial issue. Brand impersonation is a security issue: someone pretends to be the brand in order to deceive and defraud. Many cases are both, which is why legal, security and marketing teams need to share what they find.

FAQ

What is brand impersonation in phishing?

Brand impersonation is a phishing attack in which criminals pretend to be a known company, using its name, logo, domain lookalikes and writing style. They send emails or texts, run fake websites, social accounts or apps, and use them to steal logins, card details or money from the company’s customers or staff. The company itself is never breached.

How can a company detect brand impersonation?

Monitor newly registered domains and certificates containing your brand name, scan social platforms, app stores and search ads for copies of your logo and executives, and read your DMARC reports for unknown senders. Customer and staff reports are just as valuable, so make reporting simple and route every report to the team that handles takedowns.

How long does it take to take down an impersonating website?

It depends on the host, the registrar and the evidence provided. Some phishing pages come down within hours of a well-documented report, while others on uncooperative hosts take days and repeated escalation. Because most victims are caught in the first hours, the speed of detection matters as much as the takedown itself.