A fake account is impersonating my business. What should I do?

Establish whether the account is copied or compromised

A profile using your business name and photographs does not necessarily mean your real account has been hacked. Compare the full URLs, usernames and your team's access to official accounts. The distinction matters: removing an external impersonator will not restore control of a compromised business profile.

If permissions or posts on your genuine account have changed, use the platform's official recovery process. Review sessions and permissions and secure the associated email account. Do not give login codes or passwords to people offering unofficial recovery. Treat access security and the impersonation report as separate workstreams where both problems are present.

Assess what the profile is asking customers to do

A confusingly similar name and a profile collecting deposits for fictional bookings carry different risks. Examine visible offers, links and messages supplied by customers. Do not send money or stage a purchase merely to test the operator. Describe observable conduct instead of assuming a motive from the name alone.

Consider an illustrative hotel profile asking guests to pay outside the official booking process. The evidence should show both the copied identity and the payment request. This is a hypothetical example, not an MB client case. Similarity alone is not enough to justify a public accusation against a named individual.

Build a clear comparison with official channels

Record the suspicious profile URL, username, displayed name and observation date. Capture the claims that suggest an official relationship. Add the genuine company website and official social profiles, identifying the copied logo, images or language. A reviewer should understand the comparison without having to assemble it from unrelated screenshots.

Keep customer messages securely and minimise personal information in shared copies. If the platform requests evidence of identity or authority, submit only what is necessary through its official route. Do not publish identity documents in comments or public requests for help. Maintain a record of who supplied and accessed sensitive material.

Report the account and its advertisements separately

Use the relevant account or Page reporting path and an accurate impersonation category where offered. Facebook and Instagram procedures may differ, as may requirements for individuals, businesses and authorised representatives. Follow the current official instructions instead of assuming that one form fits every type of affected entity.

Record any advertisements or external scam sites as separate objects. An account complaint does not replace documenting paid distribution or a fraudulent checkout. Save report confirmations and case references. Assign one person to track responses so several colleagues do not unknowingly duplicate submissions while leaving follow-up unattended.

Give customers a reliable verification route

Publish the correct website and contact channels on your genuine properties. Explain any relevant rule, such as not requesting payment through private messages. Keep the warning practical and avoid driving traffic to the suspicious profile. Staff should use the same message across reception, sales and customer support.

If someone has already paid, do not promise that reporting the account will recover their money. Encourage prompt contact with their bank and the appropriate authorities. In Poland, suspicious domains can also be reported to CERT Polska. Collect useful incident details without asking customers to send complete card data or unnecessary identity documents.

Monitor new versions without treating every mention as abuse

A copied profile may return with a small spelling change, another location name or a reused photograph. Include these patterns in follow-up checks, but verify results individually. Legitimate partners, commentary and fan activity should not automatically be labelled impersonation merely because they mention the business.

Maintain an internal list of authorised profiles, agencies and distributors. This reduces false alarms about your own campaigns. Public searches cannot cover every private conversation, so customer reporting remains valuable. Specify where those reports go and what information makes them actionable: a URL, date and relevant message are more useful than a vague warning.

Make one person accountable for the case

Someone should own evidence collection, statement approval and review of platform decisions. Marketing can prepare documentation, support can collect customer reports and legal advisers can assess disputed rights or further action. Without ownership, the process can stall after a screenshot is posted in a team chat.

When appointing an external partner, provide the agreed scope and necessary authority rather than unrestricted credentials. Expect a report containing addresses, statuses and next actions. The number of complaints submitted is not, on its own, evidence that customers have stopped encountering the impersonator or that new copies are being identified.

Frequently asked questions

Is an identical name always impersonation?

No. Context, presentation and conduct matter. Identify specific misleading claims rather than relying on name similarity alone.

Does reporting the copy secure my real account?

No. Review your own access, sessions, email security and authentication separately. Reporting an external account addresses a different problem.

Sources and reporting routes

Reporting guidance checked on 13 October 2026. Platform options and requirements may change.

This guide covers technical and organisational steps, not individual legal advice. Rights, claims and formal evidence requirements should be assessed by an appropriate legal professional.