Scammers often pretend to be something they’re not. In fact, according to the Federal Trade Commission, impersonation scams have been the most frequently reported category of fraud for several years, costing consumers billions of dollars.1 And, while scammers most often impersonate large, recognizable companies, small and local businesses can also be targeted.
And the consequences go beyond running up bills on the company credit cards. If scammers have enough information to impersonate a legitimate business, they can defraud customers or trick employees and business partners into sharing sensitive information or sending money to fraudulent accounts. Even if the business itself doesn’t lose money, its reputation and relationships with customers may suffer.
How Scammers Impersonate Businesses
Scammers use a variety of tactics to impersonate legitimate businesses. Two of the most common are phishing and spoofing, which can be used separately or in tandem to trick people into sharing sensitive information or sending money. These tactics can also play a role in a particularly damaging type of fraud known as business email compromise.
Phishing
Phishing involves using deceptive emails, text messages, phone calls, or other communications to trick people into revealing sensitive information or taking harmful actions. These messages may appear to come from a trusted company or person. For example, a scammer might pose as a vendor requesting an urgent payment or updated account information.
Often, these fraudulent messages try to get victims to act quickly and click on something without thinking. But clicking a malicious link or opening an attachment could trigger a malware download or send someone to a fraudulent website designed to steal their information.
Spoofing
Spoofing is the act of disguising an email address, phone number, website, or other identifying information to make it appear legitimate. A spoofed website might be identical to your own except for a slight change to the URL. When visitors enter their usernames and passwords on the fake site, they’re actually handing that information to the scammer.
If scammers obtain legitimate login credentials, they may be able to access company email accounts or other systems, allowing them to steal information, impersonate employees, or carry out additional fraud.
Business Email Compromise
Business email compromise (BEC) is an especially damaging form of fraud in which scammers impersonate trusted business contacts to trick people into sending money or sharing sensitive information.2 They might use a spoofed email address or gain access to a legitimate business email account, allowing them to send convincing messages to employees, customers, or business partners.
In all cases, the aim is to use a legitimate organization’s trusted good name to fool victims into giving up their sensitive information, their money, or both.
Immediate Actions
If you discover that your business is being impersonated online, focus your immediate response on containing harm, alerting any affected people, reporting the incident, and protecting any compromised accounts. Take the following actions as soon as possible:
1. Document the Impersonation
Before attempting to have a fraudulent website or account removed, gather evidence of the scam. Save screenshots, website addresses, suspicious emails, and any other relevant communications. Keep a record of any fraudulent transactions or customer reports, too. This information can help you report the impersonation and address any damage it may have caused.
2. Check and Secure Your Accounts
If you determine that scammers have gained access to any of your business accounts, update the login information and review recent activity for anything suspicious. Update the passwords on any other accounts that use the same credentials, and enable multifactor authentication wherever possible. Don’t assume that a given account or app is safe.
If financial accounts or payment information have been compromised, contact your financial institution immediately to report the situation and discuss protective measures.
3. Notify customers, employees, business partners, and financial institutions
As tempting as it may be to keep the attack under wraps, don’t—even if you are worried about how it might reflect on your business. Tell your employees, contractors, customers, business partners, and everyone else who could be affected by the attack so they, too, can take appropriate precautions.
Explain how scammers are impersonating your business and what suspicious communications might look like. If you know for sure that any specific accounts or personal information have been compromised, tell the affected people and explain what steps they should take.
4. Report Scammers to the Authorities
If a scammer is impersonating your business online, report them to the authorities as soon as you can. Contact the Federal Trade Commission and the FBI’s Internet Crime Complaint Center at IC3.gov.3 You can also report the incident to local law enforcement.
If the scam involves phishing emails, encourage recipients to forward suspicious messages to the Anti-Phishing Working Group at [email protected].4
Report fraudulent websites, social media profiles, or business listings to the platforms or service providers hosting them, too.
Even if the authorities can’t identify the specific scammers impersonating your business, the reports help investigators and cybersecurity professionals detect fraud patterns and emerging threats.
Long-Term Practices
Once you’ve addressed the immediate threat, take some time to review your business’s security practices and look for ways to protect yourself against future attacks.
1. Review and Update Your Security Practices
Take a look at how your business protects its accounts and information. Enable multifactor authentication for sign-ins if you haven’t already, and consult with your IT department or a cybersecurity professional about ways to strengthen your defenses.
If your business uses its own email domain, ask your IT provider about email authentication tools such as SPF, DKIM, and DMARC, which can help protect against scammers sending messages that appear to come from your business.
While you’re at it, review old accounts and credentials your organization no longer uses. Deactivate accounts belonging to former employees, remove access to unused apps or services, and delete unnecessary accounts when appropriate. In general, this is good digital housekeeping and gives future scammers fewer opportunities to exploit.
2. Monitor Social Media and Other Online Accounts
If someone’s impersonated your business, it’s possible they’ve created one or more social media accounts using your business name or some variation of it. Track them down, report them, tell people to unfollow them, and make sure these accounts are deleted.
Even after reporting the fraudulent accounts, continue monitoring the internet and social media platforms for new imposters. Keep an eye out for fake websites and business listings. Make sure customers can easily find and recognize your official website, social media profiles, and contact information.
3. Consult with Legal Counsel
Depending on the severity of the impersonation, you may want to speak with an attorney about your options moving forward. This is especially important if someone is infringing on your intellectual property or the scam has resulted in financial losses or exposure of sensitive information.
4. Provide Regular Cybersecurity Training
Everyone in your organization (including you) can benefit from regular refreshers on cybersecurity best practices. Knowing how to identify a phishing email or spot a spoofed website are important skills for everyone.
Make sure your employees know how to verify suspicious requests, particularly those involving payments, account changes, or sensitive information. Establish clear procedures for reporting suspicious activity and reporting potential scams. Just as important, create an environment where employees feel comfortable speaking up, even if they’ve already clicked a suspicious link or shared information by mistake. Encourage prompt reporting without fear of blame or embarrassment so your team can respond before a problem gets worse.
Even if you think you can spot spam texts or scam phone calls from a mile away, keep educating yourself and your team. Scammers are always updating their methods, which means there’s always more to learn.
- FTC Press Release. (2026, October). FTC highlights efforts to combat imposter scams and protect consumers, Federal Trade Commission ↩︎
- FBI.gov How We Can Help You, Business Email Compromise, Federal Bureau of Investigation ↩︎
- FTC Business Blog (2025, September) Small Business? Know how to stop a would-be business impersonator, Federal Trade Commission ↩︎
- apwg.org Report Phishing Emails Here to Warn the World, Anti-Phishing Working Group ↩︎