# Fake copyright infringement emails: how to spot DMCA phishing

URL: https://iblockspam.com/blog/fake-copyright-infringement-phishing
Last updated: 2026-10-12
Published: 2026-10-12
Topic: Phishing & threats
Author: iBlockSpam Team

> How fake copyright and DMCA notices deliver malware and steal logins, what a real notice must contain under US law, and how to check a claim safely.

## Short answer

Fake copyright infringement emails claim you used someone's photo or content illegally and push you to open 'evidence' or sign in to avoid a lawsuit or page removal. The link or file usually installs malware or steals a password. Never open the evidence from the email. Check the claim through your web host, platform account or a lawyer.

"Hello, I'm a professional photographer. Your website uses my images without permission. You could be sued for this. Here is the evidence, download it and see for yourself." A message like this lands in a small business's contact form inbox and looks, at first, like a real legal problem. It's a common lure for malware and password theft. This guide explains the main types of fake copyright emails, what a genuine notice looks like under US law, and how to check a claim without opening anything dangerous.

## What is fake copyright infringement phishing?

Fake copyright infringement phishing is an email or web-form message that falsely accuses you of using someone's copyrighted content, so you'll open a malicious link or file, hand over a password, or pay a fake settlement. It works because the threat of a lawsuit or account removal makes people act quickly, and because businesses really do get genuine copyright complaints.

The main variants:

| Variant | Typical sender claim | What it's after | Primary source |
|---|---|---|---|
| Contact-form photo claim | A photographer or illustrator whose images you used | Malware via an "evidence" download | [Microsoft](https://www.microsoft.com/en-us/security/blog/2021/04/09/investigating-a-unique-form-of-email-delivery-for-icedid-malware/) |
| Fake lawsuit from a law firm | A law firm filing a copyright suit against you | Malware in an attachment or link | [CISA (US-CERT)](https://www.cisa.gov/news-events/alerts/2010/03/26/copyright-infringement-lawsuit-email-scam) |
| Fake platform violation | Facebook, Instagram or another platform removing your page | Account login and two-factor code | [Facebook Help](https://www.facebook.com/help/166863010078512) (general phishing advice) |
| Fake government or IP office | The Copyright Office, WIPO or another IP office | Payment or personal details | [Copyright Office](https://copyright.gov/rulings-filings/agencies/Impersonation%20NPRM%20R207000.pdf), [WIPO](https://www.wipo.int/en/web/paying-for-ip-services/w/news/2026/warning-fraudulent-emails-impersonating-wipo-and-major-ip-offices) |

## How do fake copyright emails deliver malware?

One well-documented campaign used website contact forms. In April 2021, [Microsoft Threat Intelligence](https://www.microsoft.com/en-us/security/blog/2021/04/09/investigating-a-unique-form-of-email-delivery-for-icedid-malware/) described "an influx of contact form emails targeted at enterprises by means of abusing companies' contact forms." According to Microsoft:

- "The messages consistently mention a copyright claim lure by a photographer, illustrator, or designer." They claimed the recipient had used images without consent and warned "you could be sued."
- Each message included a link to a `sites.google.com` page to view the alleged stolen photos. That page asked the recipient to sign in with Google credentials, then "automatically downloads a malicious ZIP file, which contains a heavily obfuscated .js file."
- The JavaScript file downloaded IcedID, malware Microsoft says "can lead to additional malware payloads, including ransomware."

Why it worked: each email "appears trustworthy as it was sent from trusted email marketing systems," because the attacker filled in the victim's own form and the victim's own website sent the email. Microsoft also noted the sign-in step: "Because of this added authentication layer, detection technologies may fail." It suggested attackers may have used a tool that automates form submission "while circumventing CAPTCHA protections."

The same lure arrives by ordinary email too, sometimes with a PDF or HTML attachment. Our guides to [PDF phishing attachments](https://iblockspam.com/blog/pdf-phishing-attachments) and [HTML smuggling](https://iblockspam.com/blog/html-attachment-phishing-html-smuggling) cover those formats.

### An example of a fake contact-form claim

This is an illustrative example based on the patterns above, not a real message.

```
From: Website Contact Form <noreply@yourcompany.com>
Subject: New message from your website

Name: Mia Laurent
Email: mia.laurent.photo@gmail.com
Message:
Hello! I am a professional photographer and your site uses
my images without my permission. This is not legal and you
could be sued. I have collected all the evidence here:
https://sites.google.com/view/[random]-evidence-photos
Download it right now and check this out for yourself.
```

The From address is your own, because your website sent it. Everything that matters is in the message body.

## What does a real copyright notice look like?

A real copyright takedown notice identifies the exact work and the exact material it says infringes, and gives full contact details. US law sets this out. Under [17 U.S.C. § 512(c)(3)](https://www.law.cornell.edu/uscode/text/17/512), a takedown notice to an online service provider must include, in substance:

1. A physical or electronic signature of a person authorized to act for the copyright owner.
2. Identification of the copyrighted work claimed to be infringed.
3. Identification of the material claimed to be infringing, with information "reasonably sufficient" to locate it.
4. Contact information, such as an address, telephone number and, if available, an email address.
5. A statement of good-faith belief that the use isn't authorized.
6. A statement that the information is accurate and, under penalty of perjury, that the sender is authorized to act for the owner.

These notices are sent to the service provider's **designated agent**, the contact a host or platform registers for this purpose, and the statute requires the Register of Copyrights to keep a public directory of those agents. So if someone else hosts your site, a formal DMCA notice about it is normally addressed to your host rather than to you. Hosts usually pass it on through your account, and [section 512(g)](https://www.law.cornell.edu/uscode/text/17/512) protects a host that removes a subscriber's material after such a notice from the subscriber's claims only if it "takes reasonable steps promptly to notify the subscriber." The law also has teeth for false claims: section 512(f) makes anyone who knowingly misrepresents infringement liable for damages.

Rights holders can also write to you directly, and genuine photo-licensing demand letters do exist. The difference is that a real claimant tells you what and where. A scammer hides it behind a download.

| Detail | Genuine claim | Fake claim |
|---|---|---|
| Identifies the work | Names or links to the specific original work | "My images," "my illustrations" |
| Identifies your material | Exact URL or page on your site | None, or "see the evidence" |
| Evidence | Visible in the message or on a normal web page | ZIP, JS, HTML, PDF or a sign-in-gated link |
| Sender | Named person or firm you can look up independently | Free webmail, or your own contact form |
| Route | Your host, platform dashboard, or a lawyer's letter | Contact form or unsolicited email only |
| Demand | Remove the material, license it, or respond to counsel | Download now, sign in now, or pay now |

## How do I check whether a copyright claim is real?

Check the claim using information you already have, never the links in the message.

1. **Don't open the evidence.** No downloads, no sign-ins, no attachments.
2. **Look for specifics.** Does the message name the exact page and image on your site? If not, there's nothing to act on.
3. **Visit your own site** by typing its address, and look at the page or image mentioned, if any.
4. **Check your host and platforms.** Sign in to your hosting control panel and your social media accounts directly. A formal DMCA notice or platform removal shows up there.
5. **Look up the claimant independently.** Search for the photographer or law firm and contact them through details you find yourself.
6. **Inspect the email.** For direct emails, paste the headers into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) and check the real sending domain and the [Reply-To](https://iblockspam.com/blog/reply-to-header-mismatch-phishing).
7. **Talk to a lawyer** if a specific, verifiable claim remains. This guide isn't legal advice.
8. **Report the message** to IT and with your mail app's report button.

## What about fake Copyright Office, WIPO and platform notices?

Fake government and platform notices use authority instead of a lawsuit threat. In a [December 2022 comment to the FTC](https://copyright.gov/rulings-filings/agencies/Impersonation%20NPRM%20R207000.pdf), the US Copyright Office said some actors were "issuing fraudulent certificates bearing the Office's seal," and that "Others have impersonated the Office and its staff to make copyright infringement demands on individuals." The Office added that it "does not have law enforcement authority."

[WIPO warned in April 2026](https://www.wipo.int/en/web/paying-for-ip-services/w/news/2026/warning-fraudulent-emails-impersonating-wipo-and-major-ip-offices) that "Intellectual property holders should exercise extreme caution" over fake payment demands sent in the name of WIPO and other IP offices, from addresses such as `admin@wipo-office.com`. WIPO says its genuine addresses end in `@wipo.int`. Our guide to [domain renewal scams](https://iblockspam.com/blog/domain-renewal-scam-emails) covers the related "brand conflict" emails.

Social media versions threaten your business page. They say your page will be removed for a copyright violation unless you appeal through a link, which leads to a fake form asking for your password and two-factor code. [Facebook says](https://www.facebook.com/help/166863010078512) its email comes only from its own domains, such as `facebookmail.com` and `meta.com`, and asks you to report phishing to `phish@fb.com`. Check your page's real status from inside the app.

## What should you do if you already clicked or downloaded?

Treat a downloaded "evidence" file as a malware incident.

1. **Disconnect the device** from the network and tell IT immediately.
2. **Don't sign in to anything else** on that device.
3. **IT: isolate and investigate.** Check for the downloaded ZIP or script, unknown processes and persistence, and look for follow-on tools. Microsoft linked this delivery chain to IcedID and further payloads.
4. **Reset passwords from a clean device**, starting with any account you signed in to on the fake page, and revoke active sessions.
5. **Search other mailboxes** for the same message and remove it.
6. **For a stolen social media login**, use the platform's account recovery flow and review page admins.

Our [email security incident response plan](https://iblockspam.com/blog/email-security-incident-response-plan) has a fuller playbook.

## How can a business block fake copyright emails?

A business blocks most fake copyright emails by filtering risky files, scrutinizing contact-form mail and training the people who read the public inbox.

- **Filter dangerous file types.** Block or quarantine script files such as `.js` and archives that contain them. See [dangerous email attachment types](https://iblockspam.com/blog/dangerous-email-attachment-types).
- **Don't exempt your own website from filtering.** Microsoft advised reviewing mail flow rules "for broad exceptions, such those related to IP ranges and domain-level allow lists." If your form mail bypasses scanning, a fake claim gets a free pass.
- **Harden the contact form.** Use rate limits and spam protection on the form, and consider sending form submissions to a dedicated mailbox rather than a senior person's inbox. Our guide to [website form emails going to spam](https://iblockspam.com/blog/website-form-emails-going-to-spam) covers form mail setup.
- **Use phishing-resistant sign-in** for social media and Google or Microsoft accounts, so a fake appeal form can't capture a usable code.
- **Agree a legal-mail route.** Tell staff that any legal claim, copyright or otherwise, goes to one named person who checks it before anyone clicks.

## Next steps

1. Forward this guide to whoever reads your contact form submissions and shared inboxes.
2. Check that your mail filtering scans contact-form email and blocks script attachments.
3. Turn on strong two-factor authentication for every business social media account.
4. Get a second layer for inbound mail. iBlockSpam filters mail for the whole domain, including [attachment-type filters](https://iblockspam.com/how-it-works), and holds suspicious messages in [quarantine](https://iblockspam.com/features/quarantine-and-digests) for review.

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Is a DMCA takedown notice sent by email always a scam?

No. Rights holders and their lawyers do send genuine notices and demand letters by email. Under 17 U.S.C. 512, a formal takedown notice goes to a service provider's designated agent and must identify the work and the infringing material. A real notice tells you exactly what and where. A fake one hides the details behind a link or download.

### Why do copyright scam emails arrive through my website contact form?

Because a message sent through your own form arrives from your own website, so it looks trustworthy and can slip past filtering. Microsoft described attackers submitting contact forms with fake photographer copyright claims and links to so-called evidence that downloaded IcedID malware, which can lead to ransomware.

### What should I do if I opened the evidence file from a copyright email?

Disconnect the device from the network and tell IT straight away. Don't log in to anything else from it. IT should isolate it, scan it, check for unknown processes and persistence, and reset any passwords used on it from a clean device. Files delivered this way have installed banking malware and ransomware loaders.

### Does the US Copyright Office email people about infringement?

The Copyright Office told the FTC in 2022 that people have impersonated the Office and its staff to make copyright infringement demands, and have issued fraudulent certificates bearing its seal. The Office also says it has no law enforcement authority. Treat an infringement demand in its name as suspect and check through copyright.gov directly.

### How do fake Facebook copyright violation messages steal pages?

They warn that your page will be removed for a copyright violation unless you appeal through a link. The link leads to a fake appeal form that asks for your login and two-factor code. Facebook says its email comes only from its own listed domains, and asks you to report phishing to phish@fb.com.

## Sources

- [Microsoft Threat Intelligence: Investigating a unique 'form' of email delivery for IcedID malware (April 2021)](https://www.microsoft.com/en-us/security/blog/2021/04/09/investigating-a-unique-form-of-email-delivery-for-icedid-malware/)
- [17 U.S. Code § 512: Limitations on liability relating to material online (Cornell LII)](https://www.law.cornell.edu/uscode/text/17/512)
- [US Copyright Office: Comment to the FTC on the Impersonation NPRM (December 16, 2022)](https://copyright.gov/rulings-filings/agencies/Impersonation%20NPRM%20R207000.pdf)
- [CISA (US-CERT): Copyright Infringement Lawsuit Email Scam](https://www.cisa.gov/news-events/alerts/2010/03/26/copyright-infringement-lawsuit-email-scam)
- [WIPO: Warning: Fraudulent Emails Impersonating WIPO and Major IP Offices (April 2026)](https://www.wipo.int/en/web/paying-for-ip-services/w/news/2026/warning-fraudulent-emails-impersonating-wipo-and-major-ip-offices)
- [Facebook Help Center: Protect yourself from phishing on Facebook](https://www.facebook.com/help/166863010078512)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker): Check an IPv4 or IPv6 address, or your mail servers, against public spam blocklists, with policy and delisting links.

---

Source: iBlockSpam, https://iblockspam.com/blog/fake-copyright-infringement-phishing (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt