What to do when scammers impersonate your company to your customers

A customer forwards you an email. It has your logo, your signature block and a new bank account for their next payment. You didn't send it. When criminals impersonate your business to your customers, your own mailboxes may be untouched, but your reputation and their money are at risk. This guide covers the four jobs: close the spoofing you can close, spot the impersonation you can't prevent, get it taken down, and talk to customers.

How do criminals impersonate a business to its customers?

Several ways, and each needs a different response. Ask the customer for the original email with full headers, then check the real sender with the Email Header Analyzer.

The last row is different. If the mail really came from your systems, you have a security incident, not just an impersonation problem. Follow signs an email account is compromised before anything else.

Step 1: Stop criminals using your exact domain

This is the part you control completely. CISA's joint phishing guidance tells organizations to "ensure DMARC is set to 'reject' for sent emails," which it says "provides robust protection against other users receiving emails that impersonate a domain" (CISA, NSA, FBI, MS-ISAC). The FTC gives small businesses the same advice in plainer words: make sure your email provider offers email authentication, so receiving servers can confirm an email is really from you (FTC).

1. Check your current policy with the DMARC Checker.
2. If you're at p=none or have no record, follow our staged path from p=none to p=reject.
3. Cover every domain you own, including old brand names and domains that never send mail. Our guide to protecting parked domains has the three records each one needs.

In our scan of the Tranco top 1,000 domains in October 2026, 38.3% didn't enforce DMARC. Customers of those companies can receive forged mail from the real domain.

How to stop email spoofing of your domain covers the full rollout. The rest of this guide is about what DMARC can't do.

Step 2: Watch for lookalike domains and fake sites

RFC 9989, section 2.2 is clear that DMARC "does not address the use of visually similar domain names or abuse of the RFC5322.From human-readable display name." Once your real domain is locked, criminals switch to names that look like it.

You can't prevent someone registering a lookalike, but you can find out sooner:

• Customer and staff reports. The cheapest sensor you have. Publish an address for reporting suspicious mail that uses your name, and make sure someone reads it.
• Certificate Transparency logs. Most publicly trusted TLS certificates are recorded in public Certificate Transparency logs, a mechanism described in RFC 6962, so a fake site using HTTPS usually leaves a public record. Search those logs, or use a monitoring service, for new certificates containing your brand name.
• New domain registrations. Monitoring services watch newly registered domains for names similar to yours.
• Search and ads. Search for your brand plus words like "login", "pay" or "invoice" now and then.

When you find a candidate, check whether it's set up for email with the MX Lookup. A lookalike with MX and SPF records is being prepared to send or receive mail, which is a stronger warning sign than a parked page.

Defensive registration of your most obvious lookalikes removes the easiest options. Our guide to lookalike domain phishing covers which ones to register and how to lock them down.

Step 3: Get fake domains and sites taken down

Takedown works best with good evidence sent to the right places at once.

Collect the evidence first

• The full email with headers, saved as a file, not a forward.
• The complete URL of any fake site, including the path.
• Screenshots of the email and site next to your real ones.
• Dates, times and how many customers reported it.

ICANN's compliance advisory gives examples of useful evidence for phishing: "a screenshot showing a phishing attempt with an indication of what the phish is against" and "the complete URL where the abuse is located" (ICANN).

Where to report

ICANN requires accredited registrars to maintain "an abuse contact to receive abuse reports involving domain names sponsored by the registrar," and to take "reasonable and prompt steps to investigate and respond appropriately" (ICANN). Under the 5 April 2024 amendments to the Registrar Accreditation Agreement, a registrar with actionable evidence that a domain is used for DNS abuse, which includes phishing, "must promptly take the appropriate mitigation action(s)." ICANN says there's no fixed deadline for "prompt," and that registrars act at the domain level, so the host is often the faster route for a hacked legitimate site.

In the UK, the NCSC says it "has the power to investigate and remove scam websites" and acts on every report (NCSC). In the US, the FTC recommends reporting to ReportFraud.ftc.gov and the FBI's IC3, and notes that you can also forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org.

Keep a log of each report and its outcome. If the same criminals come back with a new domain, you can send the next report faster.

Step 4: Warn and support your customers

Silence helps the criminals. The FTC's advice is to "warn your customers as soon as possible" by mail, email or social media, and, if you email them, to "send an email without hyperlinks" so your warning doesn't look like phishing itself (FTC).

A good notice is short and specific:

1. What's happening: "Some customers have received emails that pretend to be from us and ask for payment to a new bank account."
2. How to tell real mail: "We only email from @brightwater.com. Messages from any other address, including similar-looking ones, are not from us."
3. What you never do: "We will never change our bank details by email, or ask for your password or card number by email or text."
4. What to do: "If you're unsure, call us on the number on your contract or our website. Don't use contact details in the email."
5. What to do if they paid: contact their bank immediately and tell you.

Then make it permanent:

• Add a page to your website listing the domains you send from and your payment-change policy.
• Put the payment-change rule on invoices and in onboarding emails.
• Brief the people customers will call: reception, accounts and support. Give them a script.

If customer data was stolen, the FTC points affected people to IdentityTheft.gov for a recovery plan.

If a customer has already paid the criminals

Speed matters more than blame. Ask the customer to contact their bank straight away and request a recall of the payment, and to report it to the FBI's IC3 (US) or, in England, Wales and Northern Ireland, to Report Fraud, the City of London Police service that replaced Action Fraud in December 2025. Give them copies of the fake emails with headers, and confirm in writing which account details are genuine. Check internally whether the criminals knew things only your systems held, such as invoice numbers or contact names. If they did, treat it as a possible breach of your own mailboxes. Our guide to vendor invoice fraud covers the payment side in more depth.

Does BIMI help customers spot fakes?

A little. BIMI shows your verified logo next to authenticated mail in mailbox providers that support it, and it requires DMARC at p=quarantine or p=reject. A lookalike domain can't display your verified logo. But most people won't notice a missing logo, and support varies by provider. Add BIMI after you reach enforcement, as a recognition aid, not a defense. BIMI explained covers requirements and certificate costs, and the BIMI Checker tests your record.

An impersonation response checklist

1. Get the original message with full headers and identify the real sending domain.
2. If it's your exact domain, check DMARC and fix gaps; if it came from your systems, start incident response.
3. Collect URLs, screenshots and samples.
4. Report to the registrar, host, email provider and browser blocklists the same day.
5. File reports with the FTC and IC3 (US) or NCSC (UK) as appropriate.
6. Warn customers without links, and brief your front-line staff.
7. Block the lookalike domain in your own inbound filter so staff can't be fooled by replies.
8. Record what happened and review your monitoring.

Next steps

• Run the DMARC Checker on every domain you own and plan the move to p=reject where it's missing.
• Publish your real sending domains and payment-change policy on your website.
• Set up a reporting address for suspicious mail that uses your name.
• Register and lock down your most obvious lookalike domains.
• Keep your own DNS from drifting. iBlockSpam's domain monitoring alerts you when your MX, SPF or DMARC records change: weekly on Protect, daily on Protect Plus.

To hear about a fake domain early, iBlockSpam's Lookalike Domain Watch checks daily for look-alike names, using DNS and public certificate logs, and alerts you when one appears.

Browse our other phishing and threat guides.