Brand Impersonation: Types, Examples and How to Spot It

What is brand impersonation?

Brand impersonation is when someone poses as your business to deceive your customers. They copy your name, logo, website or email address so that shoppers believe they are dealing with you. The goal is usually money, card details or login details.

For an online store, the most common forms are a clone of your store, a lookalike web address, and email that appears to come from you. Business impersonation, brand spoofing and impersonation scams all describe the same problem.

The customer is the direct victim, but the brand pays too. The shopper who was deceived often blames the name they saw, and that name is yours.

What are the types of brand impersonation?

Brand impersonation shows up in five main places. One campaign often uses several at once: an ad leads to a lookalike domain, which hosts a copied store, which sends order emails from a spoofed address.

Type	What it looks like	Learn more
Fake store	A clone of your storefront on another address, taking orders it never fills	Cloned websites
Lookalike domain	An address one typo, letter swap or ending away from yours	Typosquatting, lookalike domains
Email spoofing	Mail that shows your domain or name in the sender line	Email spoofing
Fake social accounts and ads	A profile or ad using your name and photos to send shoppers elsewhere	Report through the platform’s impersonation process
Fake customer support	A “support” number, chat or account that asks customers for refunds, codes or card details	Publish your real support routes clearly

What are real examples of brand impersonation?

The 2026 Shopify Brand Protection Report scanned 2,000 leading Shopify stores in June 2026 (edition 2026.6). Three findings show how much room impersonators have.

Lookalike addresses are everywhere. The report counted 38,487 lookalike domains registered by third parties against the 2,000 stores. society6.com alone had 103 registered lookalikes. A lookalike is not proof of a scam, because many are parked or for sale. But each one is an address that could start serving a fake page.

Some swaps are almost invisible. The report found 150 character swaps affecting 114 brands, such as hue1.com for huel.com and decath1on.com for decathlon.com. In most fonts, the “1” and the “l” look the same.

Email is often unprotected. In the follow-up scan (edition 2026.7), only 17.7% of stores had DMARC set to reject unauthorised mail across their whole domain. Without that, someone can send mail that shows the store’s exact address.

The brands named are the subjects of these registrations, not the people behind them.

How can you check if someone is impersonating your business?

Most brands find out from a customer. You can also look on purpose. These checks take about 20 minutes:

1. Search your brand name with words like “shop”, “official”, “sale” and “support”. Look for results on domains you do not own.
2. Reverse image search your three best product photos. Look for them on stores you do not recognise.
3. Check lookalike addresses. Try your name with one letter changed, a hyphen added, or a different ending such as .shop, .store or .co.
4. Search ad libraries. The Meta Ad Library shows active ads on Facebook and Instagram. Search your brand name.
5. Read your support inbox. Questions about orders you cannot find, or sales you never ran, are the clearest early sign.

Our guide How to check if your Shopify store is cloned explains each check in more detail.

How do you spot a fake domain name?

Read the whole address, slowly, from the right. Scammers rely on people reading the start of an address and skipping the rest.

• Check the ending. yourbrand.shop is not yourbrand.com.
• Check every letter. Look for a “1” in place of an “l”, an “rn” in place of an “m”, or a doubled letter.
• Check for extra words. yourbrand-official.com and shop-yourbrand.com add a word instead of changing a letter.
• Check where you land. A link can show one address and send you to another. Look at the address bar after the page loads.

A close address on its own does not prove fraud. Many lookalikes are parked, for sale, or owned by the brand itself. Look at what the page shows and asks the visitor to do.

Why does brand impersonation matter to an online store?

The money a scam takes goes to the scammer. Most of the other costs land on you:

• Support load. Your team answers tickets about orders you have no record of.
• Reputation. A deceived shopper often leaves a bad review or warns friends about your name.
• Wasted ad spend. Ads that use your name can compete with your own campaigns.
• Email trust. Spoofed mail from your domain can make inbox providers trust your real mail less.

What should you do when you find an impersonator?

1. Save the evidence first. Take dated screenshots with the address bar visible, and save any redirect chain. Pages often change once someone notices.
2. Name the behaviour you can show. Copied photos, misuse of your trademark, a fake checkout, or a phishing page each have a different reporting route.
3. Report to every company that can act. That can include the host or platform, the domain registrar, the payment provider and the ad platform. If the clone runs on Shopify, see how to report a fake Shopify store. For other channels, see reporting brand abuse.
4. Tell your customers. Post your official address and support email. Do not name a suspect you have not confirmed.
5. Keep watching. Removed pages can return on a new address.

How do you protect your brand from impersonation?

You cannot stop someone from copying what is public. You can make impersonation harder to pull off and quicker to spot:

• Register the few lookalike domains that matter most. See defensive domain registration.
• Enforce DMARC on your real domain, so forged mail from your exact address gets rejected. See DMARC.
• Publish your official channels — website, support email and social accounts — in your footer and order emails.
• Register your trademark. It makes platform trademark reports possible and stronger.
• Monitor for new lookalikes and clones, so you find them before your customers do the finding for you.

How Recon helps

Recon is a Shopify app that covers three of the five forms above: fake stores, lookalike domains and email settings.

• Fake stores. With Recon’s optional theme block, Recon records when your copied theme code loads on another domain.
• Lookalike domains. Recon checks variations of your address and shows what each one serves: nothing, a redirect, or a live page.
• Email. Recon checks your SPF, DKIM and DMARC settings and shows what to fix. It does not read or monitor your mail.

Recon does not watch social media, ads or marketplaces. It does not remove sites or file reports for you. Each finding comes with the evidence and reporting contacts, and a prepared notice you review and send, on every plan.

FAQ

Q: Does a close domain prove that someone is impersonating us?

A: No. Treat it as a lead. Check the page content, where it redirects, and what it asks visitors to do before you report it as active abuse.

Q: Is brand impersonation illegal?

A: Often, but the law depends on what was done and where. Taking payment for goods never sent is fraud. Copying your photos can infringe copyright. Using your name to confuse shoppers can infringe your trademark. For a contested case, talk to a lawyer.

Q: Can I prevent my store from being copied?

A: Not completely, because anything shoppers can see can be copied. You can make clones easier to spot, watch nearby domains, publish your official address, and keep a response plan ready.

Q: How long does removal take?

A: There is no standard timetable. It depends on the platform, the jurisdiction, the evidence and the type of report. Keep monitoring the site while the report is reviewed.