Start with verified facts, not an accusation. Treat a possible fake account, lookalike domain, or copied asset as a lead to check. Preserve what you can see, confirm whether the use is authorized, then choose a response based on confidence, likely harm, urgency, your authority to act, and the asset or channel involved.
A resemblance or match alone does not settle who owns the rights or whether a use is permitted. The right next step may be to monitor, gather more information, contact a known authorized party, report content under a platform policy, or ask a qualified security or legal professional to review it.
- Possible fraud or account compromise: involve your security or incident-response team promptly, even if some details remain uncertain.
- Unclear permission or ownership: pause before making a public allegation or submitting a rights-based complaint.
- Clear platform-policy concern: check who may submit that type of report; rights-based complaints should come from the rights holder or an authorized representative.
Preserve the evidence you can verify
Save the public page or profile URL, the account or domain name, the date and time you found it, and screenshots showing the relevant text, logo, offer, or contact details. Keep an unedited copy of each capture and note how you found it. If a post directs people to pay, share credentials, or contact a different address, record that exact instruction. Do not bypass access controls to collect evidence.
For content copying, keep the original asset and the suspected copy together with any available creation, licensing, assignment, or publication records. This evidence checklist covers the records that can help a reviewer understand what appeared, where, and when.
Classify the asset before choosing a route
| What you found | What to verify | Likely next review |
|---|---|---|
| A profile or channel that appears official | Who controls it, what it claims, whether it is confusing people, and whether it asks for money or sensitive information | Check the platform’s impersonation policy; involve security if the account could put customers or staff at risk |
| A lookalike domain or marketplace listing | The exact URL or seller, the product or service shown, whether a reseller or partner is authorized, and any customer-facing risk | Ask the relevant brand, sales, or security owner to verify the relationship and select the appropriate provider or marketplace route |
| A copied image, video, text, or other asset | Whether the files are actually the same work, who owns or controls the relevant rights, and whether a license or permission covers this use | Ask the rights holder or authorized representative to review the asset and its context before a rights-based report |
| A logo or name used in a way that may be legitimate | Whether the use is by a distributor, customer, reviewer, news source, or other authorized party—and what the agreement permits | Check internal agreements and contact a known authorized party before escalating |
Domain or trademark misuse and copying a particular piece of media are different problem types, so they may require different evidence and response paths. The MarkMonitor and InCyan comparison explains that distinction. For a stock-photo match, check the page context and license records before treating the match as unauthorized; see the guide to checking suspected stock-photo use.
Weigh five factors before you act
| Factor | Questions to ask | What raises the need to act or review |
|---|---|---|
| Confidence | Do several independent details support the concern, or is the conclusion based on a similar logo or name alone? | Several corroborating details can support a credible concern, but they do not by themselves establish a policy violation. Check that the platform’s route fits the conduct and that you are eligible to submit that type of report; a rights-based complaint should come from the rights holder or an authorized representative. |
| Likely harm | Could someone be misled into paying, sharing personal information, or relying on a false official statement? | Customer, staff, payment, or account-security risk raises the priority even while attribution is being checked. |
| Urgency | Is the activity live and reaching people now, or is it old, inactive, or limited in reach? | Active requests for money or credentials need a faster internal response than an inactive, low-impact mention. |
| Ownership and authority | Who owns the name, mark, image, or text? Are you the owner or authorized to represent them? | Unclear rights, licensing, assignments, or agency authority are reasons to pause and ask the right owner—not to assume permission or infringement. |
| Asset and channel | Is this an account, domain, listing, copied media, or a use of a mark? Which policy or specialist fits that type? | Use a route designed for the particular platform and issue; a report about impersonation is not automatically the right route for a licensing dispute. |
Match the response to confidence and risk
- Low confidence, low apparent harm: save a baseline record, check for permission or an authorized relationship, and set a date to review whether anything changes.
- Some evidence, but rights or authority are unclear: hold off on public accusations and rights-based reports. Ask the brand owner, licensing contact, partner manager, or counsel to resolve the uncertainty.
- Credible concern and a relevant platform rule: check who may submit the report. Use the platform’s route for impersonation, trademark misuse, or the relevant content category; rights-based complaints should come from the rights holder or an authorized representative. Keep the report and the platform’s response with the evidence; a report does not guarantee a particular outcome.
- Potentially serious or active fraud or security risk: alert the security or incident-response lead promptly while preserving the available evidence. Use a verified channel to give customers practical guidance if the team decides a warning is needed; avoid naming a suspected actor as responsible before the facts support it.
- Potential legal dispute, demand, or disputed rights: seek qualified legal advice before making a legal claim or deciding on a formal response.
Use the platform route that fits the conduct
Platform rules are not interchangeable. Under the X and YouTube guidance available in November 2026, X’s impersonation guidance says a person or authorized representative can report an account posing as them or their brand, and directs businesses reporting trademark misuse to its trademark policy. YouTube’s impersonation policy covers deceptive copying of a person, entity, or channel and provides a way to report an impersonating channel. Read the relevant platform’s current instructions and choose the category that matches what happened; the platform decides whether its policy applies.
For a lookalike website, find the right reporting contact
A lookalike website needs a different route from an impersonating social account. Under the UK National Cyber Security Centre’s brand-impersonation guidance available in November 2026, organizations should identify the domain registrar and hosting provider, then contact the relevant abuse team directly. Keep evidence such as screenshots to support the report, and follow the provider’s current instructions. See the NCSC guidance on brand impersonation.
Example: a lookalike account asks customers to pay
A customer sends a screenshot of a social account using your logo and asking for payment to a different account. You have not yet confirmed who controls the profile. The logo and payment request make the possible harm and urgency high, but they do not prove who created the account or whether it is connected to an authorized reseller.
Save the profile link and screenshot, alert your security lead, and verify the account against your internal list of authorized sellers or partners. If the evidence supports impersonation, check whether the platform allows you to report it; if the route requires brand authority, ask the brand or an authorized representative to submit it. If customers need a warning, communicate through a verified company channel without making claims about a named person or organization that you have not confirmed. Reassess when the platform or your internal review provides new information.
When uncertainty calls for another review
Pause for a second review if the match is weak, a license or reseller agreement is missing, the rights holder is not clear, or a report could affect a customer, partner, or legal position. Ask a reviewer with the right context—brand operations for authorization, the rights holder for ownership, security for a suspicious account or domain, or qualified counsel for a legal dispute. Keep the question narrow: what is known, what remains uncertain, and who has authority to decide?
The aim is a proportionate response: act quickly when people may be at risk, but let verified evidence and the right decision-maker guide any accusation or enforcement step.
