Field notes on digital identity exposure

Most impersonation succeeds because a customer has no authoritative way to check. They receive a message from an account bearing your name, and the only thing they can compare it against is their memory of your brand.

An official-channels page fixes that asymmetry cheaply. Publish a single page on your primary domain listing every domain you operate, every social profile that is genuinely yours, every support address you send from, and — just as importantly — a plain statement of what you will never do. “We will never ask for payment by direct message” closes more attacks than most monitoring tools.

Then link it from your support correspondence and your email footer. When someone is unsure, they need a destination, not an instinct.

This is the first recommendation in a large share of Guardian reports, and it is the one customers most often implement the same week. We are telling you here because you should do it whether or not you ever buy anything from us.

A threat counter answers a question nobody has. What you need to know is what was examined, over what period, from which sources, what was found, and how confident anyone is in each item.

Ask any monitoring vendor four questions. Where did you look — specifically, which source families? Over what period? For each finding, what is the source URL and the observation timestamp? And which findings have been reviewed by a human against stated criteria?

If those answers are not available, the count is not a measurement. It is a number in a dashboard, and it will not survive contact with a platform's abuse team, who will ask for exactly the things the dashboard did not record.

The reason this matters commercially is simple: you cannot submit a counter. You can submit a dossier.

A look-alike registration on its own is common and often meaningless. Three checks tell you whether to care.

First, does it resolve, and what does it serve? A domain serving a cloned checkout is an active problem. A parked domain is a watch item. A domain that does not resolve at all is, for now, a note.

Second, has a certificate been issued for it recently? Certificate transparency logs are public, and a fresh certificate on an imitative name usually means someone intends to serve content over HTTPS — which usually means they intend to be believed.

Third, is it used for mail? A look-alike domain configured to send email is a phishing capability regardless of what its website shows, and it is the case most likely to reach your customers directly.

A registration that fails all three checks is worth recording and re-observing in thirty days. It is not worth an emergency. Treating it as one is how teams burn out on their own monitoring.

Most impersonation reports fail on paperwork rather than merit. Before you file, assemble five things.

Proof that the genuine identity is yours — the verified account, the registered mark, or the domain you control. Reviewers need to establish the authentic side before they consider the imitation.

The specific URL of the impersonating asset, not a search result or a screenshot of an app. Reviewers work from identifiers.

A timestamped capture of the content as it appeared when you observed it, because it will change.

A precise statement of what is being imitated: the name, the imagery, the biography, the claim of affiliation. “This is fake” is not actionable; “this account uses our registered mark and reproduces our founder's biography verbatim” is.

And the harm, stated concretely. A profile soliciting payment from your customers is a different report from one that merely exists.

Assembling this well is most of the work in a response, which is precisely why the Action Pack exists — but nothing stops you doing it yourself, and this checklist is the whole of it.