A three-pass checklist for handling impersonation before it spreads

A checklist earns its keep when you are embarrassed and moving fast. That rules out anything long.

These are three short passes, not one list. The first runs twenty minutes on a quiet evening and removes most of what a copy needs to work. The second covers the hour you find out. The third is the one people skip, and it is where repeat incidents get caught.

What to take away

A copied profile with no audience is close to worthless, so privacy settings do most of the prevention.
In the first hour, warning the people being contacted beats reporting, and reporting beats blocking.
Ask early whether anything left your hands, because a read-out code means you are dealing with a compromise, not a copy.
Blocking hides the account from you and leaves it running for everyone else.
Check recovery email and phone a week later, since quiet access outlasts a password reset.

Pass one: the quiet evening

Run these once, on the accounts that carry your name.

Checklist of seven account hardening steps for the quiet evening pass (A three-pass checklist for handling impersonation before it spreads) — Run these seven steps once on every account that carries your name. Image: Privacy Scam Verification

Set your friend or follower list to private where the service allows it.
Open your own profile in a logged-out browser and read what a stranger sees. That view, not your feed, is the raw material a copy is built from.
Turn on two-step sign-in for the account and for the email address behind it, then store the backup codes somewhere physical.
Check the recovery phone and recovery email on every account with your name on it, and remove anything you no longer control.
Agree one prearranged question with the two or three people most likely to be approached in your name. Pick something only they would know, never something posted publicly.
Decide now that you will never act on a request carrying a deadline. Deciding it in the moment does not hold.

The hardening half of this list overlaps with account security, which explains why recovery settings matter more than password strength.

Pass two: the first hour

The order below is not the order things occur to you. It is the order that limits damage.

Six ordered steps for the first hour after impersonation (A three-pass checklist for handling impersonation before it spreads) — Follow this order, not the order things occur to you. Image: Privacy Scam Verification

Tell the people being contacted. A short message in your own voice, on a channel that is still yours. This step prevents losses, and delay costs more here than anywhere else on the page.
Save the evidence before it disappears. Account name, handle, profile link, screenshots of what people received, and dates. Removal takes all of it with them.
Report inside the platform's impersonation route, as the person being impersonated. Ask the people who were contacted to file separately as recipients, since several reports move faster than one person reporting repeatedly.
Ask the one diagnostic question: did anything leave my hands recently? A code read aloud, a password typed after a link, an approval tapped without reading. If yes, treat it as an account compromise and fix the account before anything cosmetic.
Post one clear statement. You have one account, you will never ask for money, anything else is not you. Once, pinned, then stop.
Block last. Blocking removes the account from your view and leaves it running on everybody else.

Pass three: the week after

This pass exists because the first hour is loud and the real problem is often quiet.

Checklist of week-after checks for quiet account access (A three-pass checklist for handling impersonation before it spreads) — The first hour is loud; these quiet checks catch what survives it. Image: Privacy Scam Verification

Check the recovery email and phone again on the accounts involved. Swapping those is the first move anyone with access makes, and it is what survives your password reset. Open the active sessions or login history and end anything you do not recognize.

Expect a second approach that references the first. That is normal, not alarming. Read any offer to help you recover, remove, or trace the account as part of the incident rather than a response to it.

If money moved, the sequence for the payment provider and the reports sits in reporting and recovery, and it puts the bank call ahead of tidying up.

The five-line version

Tell people first.
Screenshot before you report.
Report before you block.
Ask what left your hands.
Check recovery settings again in a week.

Checks that are not worth your time

Some steps feel productive and are not. Cutting them makes room for the ones that work.

Comparison of unproductive steps against effective alternatives (A three-pass checklist for handling impersonation before it spreads) — Cutting these four unproductive steps makes room for the ones that work. Image: Privacy Scam Verification

Arguing with the account produces material for the other side and changes nothing. Repeated identical reports from one person usually count as one report. Paying a service to remove a profile buys a process you can run yourself.

Deleting your own account in frustration removes the only channel where your warning carries weight. It also destroys the evidence.

The wider question of what is sold to people mid-incident is covered on the impersonation overview.

If the impersonation is aimed at you rather than by you

The mirror version of this checklist is shorter, because it has one rule.

Whatever the message claims to be, reach that organization through a route you had before the message arrived: a number on your card, a bookmark, the app itself. A message cannot be checked against itself, and the number inside it is part of it.

Where a link is involved, the CISA guidance on recognizing and reporting phishing describes what to preserve. The sign-in habits that keep one mistake from becoming several are set out in CISA's advice on turning on multi-factor authentication.

The recognition patterns for the message itself, rather than the account, are in phishing scams checklist.

Common questions

How long should the first pass take?

About twenty minutes per account, and less for the second because you know where the settings live. Do the account with the largest audience first, even if you never get to the others.

Do I really need to tell people before reporting?

Yes. Reporting is a queue with no guaranteed clock. Your message is not a queue, and the losses happen in the hours before any platform acts.

What if I do not know who was contacted?

Post once publicly and message the people most likely to be approached. You will not reach everyone, and reaching most of them is the whole benefit.

What if the same person comes back with a new account?

Report each one, keep the reference numbers, and say plainly that it is repeated. Repetition is the detail that moves a platform report from automated handling to a human, and it belongs in a police report if it ever gets that far.