18 September 2026

Your business has been impersonated: cloned sites, fake profiles and ads in your name

When we talk about AI-assisted scams, we almost always assume the company will be the victim: somebody calls you with a supplier's cloned voice, or sends you a fake invoice. But there is a version that does even more damage and is hardly ever discussed: scammers using your company's name to defraud other people.

Your trading name, your logo and the text on your website are public. With today's tools, copying all of it and putting together a believable replica of your business is a matter of minutes. And the first warning usually does not reach you: it reaches your customers.

What this looks like in practice

An electrical supplies shop started getting odd calls: customers asking about an order paid by bank transfer that did not exist in any of their records. Somebody had registered a domain almost identical to theirs — with a hyphen in the middle — and copied the entire website onto it: catalogue, photos, address, even the landline number. The only change was the bank account for transfer payments.

The shop had done nothing wrong. Nobody had broken into any system, no password had been stolen. They had simply copied what anyone can see from the digital street. The cost, though, landed on the shop: angry customers, hours on the phone, and a reputation bruised for weeks.

The three most common forms

The cloned website. A domain that looks like yours (a changed letter, a hyphen, a .online instead of your usual extension) with your content copied and a different payment method.

Fake profiles. An Instagram or Facebook account with your logo announcing clearances and giveaways that do not exist, or a WhatsApp Business account in your name that answers customers and asks them for a deposit.

Ads and job offers. Paid ads carrying your brand that lead somewhere else, or fake job adverts asking for an ID document and a bank account number "for payroll".

Warning signs

Because the copy does not live inside your company, the warning always comes from outside. Pay attention if:

• A customer chases you about an order, a payment or a promotion you have no record of.
• Somebody thanks you for service you did not provide, or complains about treatment that is not yours.
• You receive bounced emails from addresses that are not yours but carry your name.
• People call asking about a job advert you never published.
• Your business appears in search results with an address, phone number or opening hours that are not yours.

A single case already deserves a check. Two in the same week are not a coincidence.

The ten-minute check, once a month

You do not need to buy anything to do this round:

1. Search your company name on Google, on your phone and logged out, and look at the first three pages of results.
2. Search the name on Instagram, Facebook, TikTok and LinkedIn, and check how many profiles show up carrying your logo.
3. Run an image search with a photo of your premises or your flagship product.
4. Check that your Google business listing has the right phone number, address and website.
5. If you sell online, look for domains similar to yours registered recently.

Note the date of each round. If one day you have to report something, being able to say "on the 3rd this was not there" is worth gold.

If it has already happened: what to do in the first hours

Document it before it disappears. Screenshots with the date visible, the full address of the site or profile, and copies of any messages you have received.

Warn your customers through your usual channels. A short, undramatic message: what your real website is, what your bank account is, and that you never request payments through any other channel.

Report it to whoever hosts the copy. Social networks have brand impersonation forms; domains have a registrar and a hosting provider you can complain to. It takes time, but it works more often than you would think.

Report it to the authorities. To the police. If money is involved, tell the bank the same day. In Spain, INCIBE answers questions on 017 and will guide you through the steps.

Review your own access. Even though the copy is external, take the opportunity to change passwords and switch on two-factor authentication on the brand's accounts.

And three things that do not help: playing deaf and hoping it goes away, writing to the scammer to demand they take it down, and buying the fake domain off them at whatever price they ask.

The part you can control

You cannot stop somebody copying what is public, but you can make it harder and spot it early: have clear, visible official channels, tell customers in writing how you take payment and how you never take payment, and run the monthly check. That is half an hour a month which saves weeks of grief.