What to do if someone impersonates you online

We probably all know someone who’s been impersonated on Facebook, Instagram, or another social network. Crimes based on impersonation have increased dramatically in the last year.

Most commonly, you, a trusting friend, would be the victim. The impersonator might ask (posing as your ‘friend’) to borrow money, for personal information, or for you to do something else that benefits them. Some attackers even ask for in-person meet-ups — so it could be more dangerous than it first appears. Other times, particularly when businesses or public figures are impersonated, the criminals may seek to cause reputational damage.

Using the trust that an individual or business has, and either monopolizing on it for personal gain or seeking to destroy it, is, of course, illegal. But what should you do if you fall victim to it? And are there ways to prevent it from happening in the first place?

Let’s take a look at the ways impersonation and identity theft enter our lives and how you can take action against it.

Social media impersonation 

Firstly, this is not to be confused with your account being hacked. While there may be some cases of impersonators utilizing an account they’ve hacked, the vast majority opt for the far more straightforward task of creating a look-a-like account. The better ones might steal information from your real profile, commandeering your pictures, life events, and statistics. Others put less work into their act. These might only go as far as using your name, and use the pretense to your friends that this is ‘your new’ account.

If you’re concerned your account has been hacked, take a look at this article about hacked email and social accounts, as there are serious implications if your account has been compromised. 

Presuming your account hasn’t been hacked, there are several things you can do.

1. Report the fake account

It seems obvious, but this is the first port of call. Here are links for easy instructions on how to report impersonation on Facebook/Instagram and Twitter. Complete the simple process to report the fraud account. (There is also another form on Facebook for if you’re reporting on behalf of someone else or don’t have a Facebook account yourself but have still been impersonated on the platform.)

To stop the abuse of the tool itself (people reporting non-fake profiles to spite someone, for instance), the process does involve review by a person. This means the fake profile could potentially be online for a while before anything is done about it. So, what can you do in the meantime?

2. Post about it

Post to all your social accounts about the impersonation to let them know there’s a fake account resembling your own. We’ve all seen posts like this, and they aren’t that big of a deal. You could even check in with the most vulnerable of your friends/followers to ensure they don’t fall for the scam being perpetrated. 

If you want to do something more in the meantime, you could reach out to customer support on the social platform.

3. Report any libel content or thefts correctly

If you can, keep a record of any posts made as ‘you’, and records of any messages you find out about that were sent to friends or followers. If any money was stolen from your friends, gather all the information you can about this. 

If money has been stolen, be sure to contact the authorities, but also your bank. Sometimes they can reverse transactions or flag recipient accounts. However, this Guardian article offers a fascinating insight into the lengths scammers go to to get away with things, including buying ‘mule’ accounts from students to get around strict banking regulations.

Any evidence you gather can be submitted to online fraud prevention bodies in your country. For example, USA.gov contains links detailing where to report various types of cybercrime in the US, or Action Fraud in the UK has areas specifically for reporting online crime.

While it’s unlikely your report alone would lead to an arrest or conviction, the chances are, the person who targeted you is a repeat offender. If enough people report similar things and provide supporting evidence, a pattern of behavior can become evident that may help in the long run.

4. Don’t make prolonged contact with the impersonator

While you may find it therapeutic to make the criminal aware you are on to them, avoid conversing with them. Often, they have psychological tactics prepared especially for this scenario — let’s face it, seasoned fraudsters are going to have been confronted by impassioned account owners before.

Tactics they use might include making you take pity on them, selling a sob story whereby you feel guilty enough to actually help them. They may even be more direct, asking for money to make them delete the account. Don’t be drawn in by these kinds of strategies. Go through the various authorities we’ve already mentioned

5. Take precautions to prevent future impersonations

Because impersonators usually use duplicate accounts, there’s not an awful lot you can do to ‘prevent’ it as such (for example, to prevent hackers from accessing your account, a stronger password might do the trick, but there’s no direct equivalent for impersonation). 

Here are some things you can do:

• Turn up the privacy settings on your account — so you’re only visible to people who know you. This stops strangers from being able to access personal details that might better deceive your friends.
• Only accept requests from people you know — this prevents would-be impersonators from getting hold of that vital information about you. The stuff that could fool even your closest friends.
• Get business accounts/influencer profiles verified with the ‘blue tick’ — by verifying your account is official, you can both deter people from impersonation, or help those who may have been targeted realize that it’s not your real account.

Website impersonation

Whole websites can be cloned for nefarious reasons. Other times, websites might steal your design, logo, or intellectual property in an attempt to impersonate you. 

In the case of bigger companies, the crooks do this to target customers with phishing attacks (we’ve probably all had them from banks we don’t even bank with). I’ve seen some fairly passable PayPal knockoffs in my time, but there are usually telltale giveaways. In these cases, the impersonators are simply casting a wide net, knowing that some of the random recipients will indeed bank with (or use the business) they are impersonating.

The most likely issue small businesses face, though, is where fraudsters, or even competitors, open a similar kind of shop or site to theirs in order to trade off of their positive reputation. This can be difficult to counteract, particularly if they make it just about different enough (using some lookalike features, or similar, but not identical, logo or name). Where trademarked properties are protected in their own right by more direct laws, simpler designs, names, and logos are harder to ‘own’. 

The Internet is awash with such cases of stolen pictures and text. But when a whole website is mimicked, using your text, images, logo, or even personal identity, there is more you can do. First, make contact with a ‘cease and desist’ letter. You can find free templates available for these online. They are essentially a formal request for someone to cease what they are doing or risk further legal action. 

Clearly, in cases that go beyond this, you need to report the website. Firstly, find out the hosting company. You can do this by going to the ICANN lookup tool and typing in the website you want to find out about. Then, if a contact email address isn’t listed on ICANN already (it usually is), you can look up who to contact about abuses for that hosting company.

The hosting company should conduct an investigation to see if a violation has occurred. There are various other processes you can try if you are unhappy with the result. There are also legal firms that specialize in helping with these sorts of cases (but we don’t endorse any in particular).

Impersonation vs. parody or fan accounts

It’s not unheard of for the ‘parody’ argument to be used when it comes to accusations of impersonation. 

While it’s unlikely to (legitimately) be a problem for most businesses, you may find yourself subject to a parody account, especially if you’re an influencer (or similar). To be classed as a parody, a website/profile should make it clear that they aren’t the real deal. They also need to use humor to be classed as a parody over a straight-up impersonation. Finally, they must tread the careful line between a joke and libel content. They can’t make false claims where it may not be clear it is part of a joke. 

Sometimes, parody accounts will be obvious anyway, but that isn’t always the case. Fan accounts for celebrities are often particularly bad at stating they aren’t the real deal. Presumably, it’s quite tempting to take things one step further (from a fan account to a direct impersonation) in order to reap the potential reward of thousands more loyal followers. We’ve all seen this, especially when a celebrity doesn’t have an official account. 

If you believe someone is using parody as a guise to commit libel or siphon your customers, you can report the websites to their hosting providers as mentioned above.

Identity theft

We’ve focused mainly on online impersonation, but it’s worth having a quick look at other types of impersonation. Variations of identity theft are nothing new.

Where large sums of money, stock, power, or influence are concerned, there will always be fraudsters willing to exploit it. If anything, it’s become harder over time. In the past, there were fewer regulatory bodies in place, so assuming someone else’s identity was comparatively easy.

And just because times have changed, some of the most successful attempts at impersonation are still carried out in person or over the phone. It’s in our nature as humans to respond to a friendly or distressed voice by giving them what they request. The more detailed the story they spin, the more likely we feel the person really is who they say they are, despite having lost their ID, not remembering where they grew up, and so on. 

People could use these kinds of cunning techniques to try to target your suppliers, banks, or even your customers by pretending to be the CEO or another important figure within your business. There are some great tips on how to keep your business safe from other types of impersonation on the Actionfraud website. 

It’s worth drawing attention to the fact that having your identity stolen can be a traumatic event. Even online impersonation can cause massive reputational damage, and it’s totally normal to feel big emotions surrounding it. 

If you’ve had your identity stolen, there are many articles that go into more detail about what to do in this situation.

Don’t worry unnecessarily about online impersonation

Online impersonation isn’t going anywhere, but with any luck, it’s getting tougher. Everyone, from social media companies to law enforcement, is taking it more seriously than ever. Some social media platforms recently suggested they will require a passport to set up an account in the future. 

What we’ve seen is that impersonations and identity thefts can happen to even the most vigilant and you can only do your best and deal with it if you are unlucky enough to be a victim of it. Hopefully, the tips you’ve learned here will help. All we can really do is remain vigilant and keep our most valuable data hidden where we can.