Overview
Table of Contents
At first glance, some fake social media accounts are almost impossible to distinguish from the real thing.
The logo matches. The bio checks out. The posts look familiar. Sometimes the account has years of genuine history because it was compromised rather than created from scratch.
We've previously looked at phishing websites designed to look almost identical to real social media login screens. The same attention to detail now shows up in the accounts themselves.
That leaves surprisingly little for customers to catch, and an obvious problem for fraud teams relying on them to report what they find.
These four social media impersonation scams, identified by Netcraft researchers during real investigations, show just how convincing fake accounts can be and, importantly, what still gives them away.
Social media impersonation examples at-a-glance
Example | Platform | Impersonation lure | Key warning sign |
|---|---|---|---|
Poses as brand support | Instant response to a complaint | ||
Uses trusted publications and celebrity endorsements | Sudden activity from a compromised account | ||
Truth Social | Poses as a financial expert | Moves conversation off-platform | |
WhatsApp, Telegram | Poses as an employer or recruiter | Contact stays on messaging apps rather than email or LinkedIn |
1. Fake Facebook account that replies before the brand can
Cybercriminals created a fake support profile for EVRi, a U.K.-based shipping and logistics company, on Facebook, complete with the company's imagery, logo, bio and posts. They then contacted people who had publicly complained about the brand.
Posing as customer support, the scammers directed victims toward malicious links or asked for account details and personally identifiable information (PII). This technique is commonly known as angler phishing: attackers find public complaints and respond while posing as the company involved.
Impersonation signals to watch for:
Instant responses: A reply arriving seconds after a public complaint may be automated.
Handle and verification problems: Check the account name carefully and compare it with the brand's official profile.
Suspicious requests: Requests for direct payments, credentials or sensitive information should raise immediate concerns.
Fake Facebook profile page impersonating customer support for EVRi.
The timing makes this form of brand impersonation effective. The victim is already waiting for help, so an apparently relevant response can feel entirely natural.
Read the full analysis: Social Media Impersonation: How Phishing Evolved as Email Defenses Improved
2. Facebook account takeover promoting a weight-loss scam
In this campaign, attackers created a fake news article about a weight-loss drug on a site using domain spoofing, added deepfakes and fake celebrity endorsements, then used social media account hijacking to distribute it through compromised Facebook accounts.
The goal was to convince victims to pay for nonexistent products, download malware, or provide information that could facilitate identity theft.
Impersonation signals to watch for:
Fabricated news domains: Check the URL rather than relying on familiar publication branding.
Compromised account signals: A long-standing profile suddenly bulk-posting identical promotional content can indicate an account takeover.
Compromised social media profile advertising a fake weight loss drug.
This form of online impersonation layers several trusted identities together: the publication, celebrity and person whose social account was compromised. That borrowed credibility makes the scam more convincing and can cause reputational damage for every legitimate brand involved.
Read the full analysis: New Year, New Scams – Health product scam campaigns abusing cheap TLDs
3. Cryptocurrency expert impersonation on Truth Social
On Truth Social, scammers posed as cryptocurrency experts and financial advisers, using social engineering to build relationships with potential victims.
Attackers sent friend requests, started conversations and, in some cases, used stolen names and photographs to create convincing fake social media profiles. This type of personal account impersonation, which can include executive impersonation, relies heavily on the credibility of the person being copied.
Victims were then moved to WhatsApp and encouraged to deposit money into fraudulent investment platforms.
Impersonation signals to watch for:
Moving off-platform: A quick request to switch to a private messaging app.
Guaranteed returns: Claims of high returns with little or no risk.
Questionable credentials: Stolen photos, new accounts and little authentic engagement behind impressive professional claims.
Threat actor entices victim to invest in cryptocurrency.
These impersonation attacks show why checking a logo or company page isn't enough. An individual identity can provide all the credibility a scammer needs.
Read the full analysis: The Truth of the Matter: Scammers Targeting Truth Social Users
4. Telegram and WhatsApp recruitment scams impersonating employers
Netcraft researchers documented three threat actors impersonating legitimate tech employers, a logistics recruitment agency, and the Government of Singapore.
Victims received job offers with generous pay and flexible terms. The scams then moved toward advance-fee fraud or attempts to steal identity information and Telegram account details.
Impersonation signals to watch for:
Messaging-only contact: Communication remains on WhatsApp or Telegram rather than moving to company email, LinkedIn, a call or an interview.
Upfront fees: Legitimate employers don't require candidates to pay to start working.
Implausible terms: Pay and flexibility that bear little resemblance to the role or market.
Threat actor posing as a recruitment consultant makes first contact via WhatsApp.
Private messaging makes these scams particularly difficult for the impersonated organization to see. Unlike public fake social media accounts, the conversation can happen entirely between the scammer and victim.
Read the full analysis: Diving Into the Talent Pool: Threat Actors Target Job Seekers with Complex Recruitment Scams
What these examples reveal about social media impersonation at scale
Across all four cases, scammers use trust the victim already has in a brand, person or familiar interaction.
The account may sit on Facebook, TikTok, LinkedIn, or another platform the impersonated organization doesn't control. Fake accounts are also cheap to create and can return under new handles after removal.
For online brand protection teams, that makes visibility and speed important. Detecting one account and taking it down solves one instance of the problem. Monitoring for new and recreated accounts helps address the campaign behind it.
What to do if you find accounts impersonating your brand
Organizations and individuals often find out about impersonation through user reporting. But by that time, attackers will likely have launched multiple accounts targeting victims.
If you discover an account impersonating your organization:
Preserve the evidence: Save screenshots, URLs, account handles and timestamps before reporting it.
Report it quickly: Start the platform's takedown process and report malicious content at report.netcraft.com.
Warn affected customers: Prioritize anyone who may have shared credentials, payment details or other sensitive information.
Monitor for recurrence: Look for the same photos, bios, naming patterns and tactics appearing in new accounts.
Performing a takedown is only part of the job. Effective brand protection also means finding impersonation customers haven't reported and watching for accounts that return after removal.
That’s the Netcraft approach to social media brand protection, and one we’ve applied across more than 50,000 takedowns to date, with a 99.8% success rate.
Learn more about protecting your brand on social media. Get in touch.
FAQs about social media brand impersonation
What is social media brand impersonation?
Social media impersonation happens when scammers create or compromise accounts and use another person's or organization's identity to deceive people. Fake social media profiles may copy names, logos, photographs, posts and other details to support fraud, phishing or identity theft.
What should I do if someone is impersonating my brand on social media?
Capture evidence before reporting the account, then use the platform's impersonation or abuse process. Warn customers who may have interacted with it and continue monitoring for replacement accounts.
If the impersonation involves financial fraud or other cybercrime in the US, victims can also report it to the FBI's Internet Crime Complaint Center.
Can impersonation accounts be removed?
Yes. Social platforms provide reporting processes for impersonation, fraud, and compromised social accounts, although requirements and response times vary. Effective takedown should also include monitoring for recurrence, as cybercriminals can recreate accounts after removal.
