Your Name Is Worth Stealing

Someone Is Using Your Name

Right now, someone you have never met is probably using your business’s name.

They might run a website that looks almost exactly like yours, with one letter changed in the address. They might send emails that appear to come from your domain, asking your customers to update their payment details. They might answer a phone number listed under your business name on a directory you have never heard of.

You built your reputation over years of honest work, and that reputation is exactly what makes your name worth stealing. Impersonators do not want your products or your office. They want the trust your customers already place in you, because trust is the one thing a criminal cannot build quickly on their own.

The good news is that you are not powerless. You cannot stop every criminal on the internet, but you can make your real identity so clear, so consistent, and so well confirmed that impostors stand out instead of blending in. Let’s explain how business impersonation works, why it succeeds, and the practical steps you can take with canonical identity and PerfectReputations’ tools to fight it.

What Impersonation Looks Like Today

Business impersonation is any attempt to deceive people by pretending to be your business. It used to mean a crude fake letterhead or a scam phone call. Today it takes many forms, and most of them happen online, where a convincing copy costs almost nothing to make.

• The most common form is the lookalike website. Criminals register a domain that differs from yours by a single letter, a hyphen, or an extra word (called “typodomains”), and they copy your logo, photos, and wording. Visitors who mistype your address or click a link in a fake email land there and hand over payments or personal details.
• The second form is email spoofing. Without the right security records in place, anyone can send an email that appears to come from your domain. Your customers see your name in the sender line, so they trust the message, open the attachment, or pay the fake invoice.
• The third form is the fake listing or profile. Impersonators create social media pages, directory listings, and business profiles using your name, often with their own phone number. When a customer searches for your support line, the criminal’s number may appear first.
• The newest form uses artificial intelligence. Criminals now clone voices from short recordings, create deepfake videos, and write flawless messages in any language. A caller who sounds exactly like your owner, or a video that shows your spokesperson endorsing a fake investment, is no longer science fiction. These AI/SI tools make impersonation faster, cheaper, and far more believable than ever before.
• There is one more form you might not expect: impersonation on your own website. When attackers break into a website, they often plant hidden links, fake pages, or comments that borrow your site’s trust to promote their scams. In each case, the criminal is using your name and your authority to deceive.

Why Impersonators Succeed

Impersonators succeed for one reason above all others: confusion. When your customers cannot tell which version of you is real, the fake version gets a fair chance. Every inconsistency in how your business appears online widens that opening.

Think about how your business looks across the web today. Your website might list one phone number while an old directory lists another. Your address might read “Suite 400” in one place and “#400” in another. A profile you set up years ago might still show a former name. Each of these differences seems small, but together they teach your customers that your business looks a little different everywhere. Once they expect variation, a fake listing with a new phone number does not seem strange at all.

This problem is called identity drift, and it is now more dangerous than ever because of how AI/SI systems work. When someone asks an AI assistant how to contact your business, the system does not simply show a list of links. It tries to work out which business you are, gathers what it knows about you, and composes an answer. If your facts conflict across the web, the system has to guess. If an impersonator has planted enough fake listings, the system can repeat the impersonator’s phone number or website as if it were yours.

Machines can also conflate your business with another one. A common name, a past rebrand, or a shared address can lead an AI/SI system to merge two businesses or split one into several. When the boundaries of your identity are blurry, an impostor can slip inside them.

The lesson is simple. Impostors thrive in the gaps between scattered, inconsistent versions of your business. The more clearly and consistently you define who you are, the fewer gaps they have to work with.

Canonical Identity: Your First Defense

A canonical identity is the single official, consistent definition of your business. It includes your exact legal name, your trading name, your address, your phone number, your website address, and the profiles that truly belong to you. Every other description of your business, everywhere it appears, is made to match it. When you have one, there is finally a clear answer to the question “Which one is the real you?”

Your defense starts with locking that record. Decide the exact form of each fact, using your state business registry filing as your guide, and write it down. Choose one person to own the record so that nobody on your team types a slightly different version. PerfectReputations’ free Canonical ID tools walk you through each field, with plain-English help, so you get the details right the first time.

Next, publish your record on your own website in the forms machines read directly. Structured data tells search engines and AI/SI systems exactly who you are, and a plain summary file called llms.txt gives AI/SI systems a clean description of your business and its official profiles. Your website is the root of your identity because it is the one place you fully control. When your website states your facts clearly, every other source can be checked against it.

Then confirm your identity where AI/SI systems look. Claim and verify your listings on Google Business Profile, Apple Business Connect, Bing Places, LinkedIn, and your state registry, and make each one match your record exactly. Link each profile back to your website, and list each profile on your website. This two-way connection, called the sameAs loop, is what machines treat as confirmed identity.

Here is why this matters so much for impersonation. An impostor can copy your logo, but they cannot easily copy a web of verified, interlinked, consistent records. Their fake listing will not appear in your website’s structured data. Their lookalike domain will not be linked from your verified LinkedIn page. Their phone number will not match the number on your state filing. The stronger your canonical identity becomes, the more obviously every fake stands apart from it, for both your customers and the machines that answer their questions.

Close the Doors Impersonators Use

A strong canonical identity tells the world who you are. The next step is closing the specific doors impersonators walk through. Three of those doors are your email, your website, and your comments.

• Protect your email. Your domain needs three security records, called SPF, DKIM, and DMARC, which tell receiving mail servers which messages truly come from you and what to do with forgeries. With a strict DMARC policy in place, most direct spoofing of your domain gets rejected before it reaches your customers’ inboxes. You can go further with BIMI, which displays your verified logo beside your real emails in supporting inboxes. The PerfectReputations Email Security DNS Toolkit builds each of these records step by step, in plain language, so you do not need to be a network engineer to set them up.
• Protect your website. Criminals who break into a website often hide links or pages that use your site’s good name to promote their scams or malware. You rarely notice, because they hide these links from ordinary visitors. PerfectReputations’ Link Checker’s External Sites report lists every website your site links to and highlights the warning signs of a hack, such as new domains, hidden links, and links that appeared on pages nobody edited. It can also check every linked address against Google’s list of known phishing and malware sites. PerfectReputations’ Page Check looks at your published pages exactly as visitors and AI/SI systems receive them, and it can add security headers that make your site harder to tamper with and harder to imitate inside someone else’s frame.
• Protect your comments. Comment sections are a favorite hiding place for impostors. PerfectReputations’ Comment Guard™ blocks automated spam, lets your readers flag suspicious comments for your review, and reports confirmed spammers to shared databases so other websites benefit too. It also prepares scam links for reporting to services such as Google Safe Browsing and Microsoft SmartScreen, which warn millions of people before they visit a dangerous site.

Each of these steps removes one more place where a criminal can stand in your shadow. Together, they make your business a much harder target.

Watch Closely, and Teach Customers to Recognize You

You cannot fight what you cannot see, so make watching a habit. Every month, search for your business name, your address, and your phone numbers, including old ones, and look for listings you did not create. Check that your Google Business Profile and other key listings have not been changed by someone else. This review usually takes 30 to 60 minutes once your canonical identity is in place, and it catches most problems while they are still small. If you want to automate that, our partner Abiquity.com can do that for you.

Make a habit of asking AI/SI systems about your own business, too. But be careful; do it anonymously, using an incognito browser so it is not biased in your favor. Ask an AI/SI chat assistant for your phone number, your website, and how to contact your support team, and compare its answers with your canonical record. When an answer is wrong, it often points straight to the outdated or fake source the system learned it from. Errors you catch early stop spreading.

When a suspicious website or email address turns up, check it before you act. The PerfectReputations’ Website Check shows a site’s age, ownership history, email setup, and warning signs of impersonation, and a brand-new domain imitating your name is a strong red flag. PerfectReputations’ Blacklist Check shows whether an email address, domain, or website appears on major spam and abuse lists. These checks turn a vague worry into clear evidence you can act on.

Just as important, teach your customers how to recognize the real you. Publish an official contact page that lists your one real phone number, your real email domain, and your verified social profiles. State plainly what you will never do, such as asking for payment by gift card or requesting a password by email. When customers know exactly what real contact looks like, impostors have a much harder time fooling them.

Make that same information easy for machines to read. AI Readable Pages publishes clean, text-only versions of your pages and an llms.txt file that lists your official profiles and important content, so AI/SI systems find your real details quickly instead of piecing them together from scattered sources. When customers ask an AI/SI assistant how to reach you, you want the answer to come from you.

When It Happens Anyway

Even with strong defenses, an impersonator can still target you. What matters then is how quickly and calmly you respond. A clear plan, made before you need it, keeps a bad day from becoming a bad month.

• First, document everything. Save the fake website’s address, screenshots, the fake emails with their full headers, and any messages customers forward to you. This evidence supports every report you make and protects you if questions arise later.
• Second, report the impersonator to the services that can shut it down or warn others. Report fake websites to Google Safe Browsing and Microsoft SmartScreen, which protect the people using major browsers. Report fake profiles and listings through each platform’s impersonation or “suggest an edit” process, and report the lookalike domain to the registrar that sold it. In the United States, also report fraud to the FTC and the FBI’s Internet Crime Complaint Center, since your report helps investigators connect cases.
• Third, warn your customers directly. Post a short notice on your website and social profiles that describes the fake, repeats your one official contact information, and explains what to do if someone already responded. Speed and honesty protect your customers and your reputation at the same time.
• Finally, strengthen whatever let the impersonator in. If the fake used a listing you never claimed, claim it now. If customers received spoofed email, tighten your DMARC policy. If the attack involved your own website, scan it with PerfectReputations’ Link Checker and PerfectReputations’ Page Check and fix what they find. Every incident shows you one more gap to close.

Be the Easy One to Recognize

You cannot outrun every criminal on the internet, and you do not need to. Impersonators look for confusion, because confusion is where their copies pass for the real thing. Your job is to remove that confusion, one consistent record and one closed door at a time.

Start with your canonical identity, because everything else builds on it. Lock your official record by publishing it on your website, and confirm it on the platforms that customers and AI/SI systems trust. Then protect your email, your website, and your comments, watch for fakes every quarter, and teach your customers what real contact from you looks like. Also teach your own staff how to stay in canon and how to update it when things need to change.

When your identity is clear, consistent, and confirmed everywhere, the fakes start to look like what they are. Your customers recognize you, the machines that answer their questions recognize you, and the impostor is left standing alone with a copy nobody believes.

That is the goal: make your real business so easy to recognize that pretending to be you stops being worth the effort.