A fake account using your business name can do real damage in a short time. Scammers copy logos, photos and posts so the page looks genuine. Then they message your followers with offers, prizes or payment requests. Your customers lose money and your brand takes the blame.
The good news is that most of the defence is simple housekeeping. Secure the accounts you already have. Keep an eye out for copies. Tell customers how you really contact them, and act fast when something turns up.
How business impersonation works on social media
Scamwatch, the ACCC’s scam information service, describes social media scams as fake profiles used to gain trust and take money. Its guide to social media scams notes that scammers pose as real businesses and may use their logos. They also use other people’s photos to build profiles that look believable. Anything you post publicly can be copied in minutes.
A common pattern is a lookalike page with a name that is one letter off. It may comment on your real posts or reply to customers who left a question. The fake page then moves the chat into private messages. From there it asks for card details, a deposit or a “processing fee” for a prize.
Scamwatch lists warning signs that apply here too. These include competitions, limited time offers and prices that look far too low. A new profile with few followers and little history is another red flag. Teach your team to spot these signs as well.
Lock down the accounts you already own
A hacked real account is worse than a fake one, because followers already trust it. The Australian Government guide to securing social media on cyber.gov.au calls multifactor authentication one of the best ways to add extra security. Turn it on for every platform you use. The guide says to turn it on for any email address linked to those accounts too.
The same guide suggests a passphrase of four or more random words for each account. Use a different one for every login and never share them. A reputable password manager makes this far easier to manage. Treat the answers to security questions as secrets, since they may be needed to recover the account later.
It also helps to review who has admin access to your pages. Former staff, old contractors and past suppliers should be removed. Keep a short written list of who can post and who can change settings. That list is your first stop if something strange appears.
Watch for copies of your brand
ASIC has published advice to protect your business and customers from scams. It suggests monitoring who mentions your company online and on social media, including your business name and contact details. Free alert tools can do some of this work for you. A quick manual search of each platform once a week also catches a lot.
ASIC also suggests tracking when your domain names expire and renewing them early. An expired domain can be bought by anyone, including scammers. It is worth checking the ASIC registers now and then for company or business names that closely resemble yours. Keeping your own ASIC records current means you receive its correspondence and alerts.
Think about what your profiles reveal as well. ASIC warns that details like staff email addresses and job titles can help scammers sound credible. Share what customers need and leave out the rest. A tidy profile is harder to copy convincingly.
Tell customers how you really contact them
Customers are much harder to fool when they know your normal habits. Say clearly on your website and pages how you contact people and what you will never ask for. If you never send payment links in direct messages, say so. Repeat it in your bio and in a pinned post.
A clear, honest message like this also supports website transparency and trust. People feel safer buying from a business that explains its process. It costs nothing and it can be written in an afternoon. Update it whenever you change how you take orders or payments.
Regular, genuine activity helps as well. A page that posts on a steady schedule is easier to tell apart from a sudden copy. If you are unsure about your rhythm, read our piece on how often to post on social media. Consistency makes the real account familiar to your audience.
What to do when a fake account appears
Move quickly, because every hour gives the fake page more reach. The steps below follow advice from Scamwatch, ASIC and cyber.gov.au. Keep this list somewhere the whole team can find it.
- Take screenshots of the fake profile, its posts and any messages customers forward to you.
- Report the profile through the platform’s own reporting tool, and block it from your real pages.
- Post a clear warning on your real accounts and your website, with a link to Scamwatch for help.
- ASIC suggests placing the word FAKE or SCAM across any images of the impersonating material you share.
- Report the scam to Scamwatch, and report hacked accounts or other cyber incidents through cyber.gov.au.
Keep your warning calm and factual. Tell people what the fake page looks like and what it asks for. Explain what to do if they have already paid, starting with contacting their bank straight away. Scamwatch also points people who have been scammed to IDCARE for free support.
Some of the worst damage comes from slow or confused replies. Our article on social media marketing mistakes covers other habits that hurt a page. Have a short plan written down before you need it. Then anyone on the team can act if you are away.
Build it into your website too
ASIC suggests a scam alerts page linked from your homepage, plus a warning banner when there is an active scam. A small business does not need anything elaborate. One plain page with your real account links and contact habits is enough. Point every social profile back to that page.
If you built your own site, check that this page is easy to find on a phone. The trade offs of doing it yourself are covered in the pros and cons of DIY web design. A footer link and a link in your main menu usually work well. Keep the page up to date whenever an account changes.
Frequently asked questions
Can I stop someone copying my business page?
You cannot stop every copy, but you can make them easier to spot and quicker to remove. Monitor your name, report fakes through each platform and warn your followers. Clear customer messages do most of the protective work.
Where do I report a fake account?
Report it to the platform first through its reporting tool. Report the scam itself to Scamwatch. If your real account was hacked, report the incident through cyber.gov.au.
What if a customer has already paid the scammer?
Ask them to contact their bank or card provider straight away. Scamwatch also suggests changing passwords on affected accounts. Free support is available through IDCARE.
Is multifactor authentication worth the hassle?
Yes. The cyber.gov.au guide calls it one of the best ways to add security to social media accounts. It takes a few minutes to set up on each platform.