Stopping an impersonation attempt means acting in this order

Impersonation is two different problems that share a name. Either someone is using your name and face on people who trust you, or someone is using an organization's name on you. The first is a reputation and contacts problem. The second is a payment problem. Almost everything you do next depends on which one you are in.

This page is the sequence for both, in the order the steps actually matter rather than the order they occur to you.

What to take away

• Warning the people being contacted does more good than anything the platform will do in the first day.
• A fake account is usually a symptom. The question underneath is whether anything of yours was taken to build it.
• Reporting before blocking preserves what an investigator can still see.

Which of the two you are in

What you are seeing	What it is	The first move
An account with your name and photos messaging your contacts	Your identity, used on people who trust you	Tell your contacts before anything else
A message from a company, agency, or bank asking you to act	An organization's name, used on you	Stop and reach that body through a number you find yourself
An account with your name that only posts, never messages	Passive copying	Report it, then leave it alone
A message from a friend's account that does not sound like them	Their account, not their choice	Reach them another way and tell them
A caller who knows details about you and wants a decision now	Pressure built from information, not authority	End the call. Call back on a published number

The middle column is the useful one. It tells you whose problem this is, and therefore who has to be told.

If someone is impersonating you

Tell the people being targeted first. A short message, in your own voice, on a channel that is still yours, does more in ten minutes than a report does in a week. You do not need to explain how it happened.

Collect what you can see, before you report. The account name and handle, the profile link, screenshots of the messages people received, the dates. Once an account is removed you lose access to all of it, and that record is what a platform or a police report runs on.

Report inside the platform, using its impersonation route. Every large service has one, and it usually asks whether you are reporting on your own behalf. Reports from the person being impersonated are handled differently from reports by bystanders, so ask the people who were contacted to report as recipients rather than on your behalf.

Then block, not before. Blocking hides the account from you while leaving it working on everybody else.

Work out whether anything was taken. A copied profile needs nothing but public photos. A copied account needs a password or a code. If anyone got a code from you, or a password, treat it as an account compromise and follow the order in account security, which puts recovery settings ahead of everything cosmetic.

Say it publicly once, plainly. A single pinned post naming that you have one account and will never ask for money is worth more than repeated denials, and it gives your contacts something to check against.

If an organization is being impersonated to you

The whole of this half is one habit: never use the contact route that arrived in the message.

A message that claims to be your bank, a delivery service, a tax office, or an employer is asking you to act inside a channel it controls. The number in the message, the link in the message, and the address in the reply field are all part of it.

The correct move is dull and it works every time: close the message, and reach the organization through a number on your own card, a bookmark you saved, or the app you already have.

Real organizations lose nothing if you call them back, so a refusal to let you is the answer. No legitimate body asks for payment in gift card codes or cryptocurrency, which is why those requests appear in almost every version.

The pattern-level version of this is in phishing scams, which covers the same pressure arriving by email and text.

What to do about the code request

It appears in nearly every impersonation story and it deserves its own line.

A code sent to your phone or email proves you are you to the service that sent it. It is never proof to another person. Anyone asking you to read one out is at a sign-in or sign-up screen right then.

No real support agent, real buyer, or real friend needs it. No situation exists where they do.

If you have already sent one, the account it belongs to is the emergency, not the conversation. Change the password there and on the email behind it, sign out other sessions, and check the recovery phone and address, which is the part attackers change first.

Timelines that are worth knowing in advance

Platform removals are slow, uneven, and often need more than one report. That is frustrating rather than personal.

Expect days rather than hours, expect a first automated response that reads like a rejection, and expect to have to submit again. Reports from several different recipients tend to move faster than one report submitted repeatedly by the same person. Nothing about that ordering is fair, but knowing it stops you burning a week on the wrong channel.

While you wait, the useful work is on your side: your contacts know, your accounts are secure, and your evidence is saved.

Reducing how easy you are to copy

You cannot stop a stranger downloading a public photo, so this is about limiting what can be built with it rather than preventing it.

• Keep the friends or followers list private, since a copied profile is only useful with a list of people to send it to.
• Watch what is visible to people who do not follow you, and check it from a logged out browser rather than from your own view.
• Use a distinctive detail on the real account, such as a consistent handle across services, so people have something to compare.
• Keep two-step sign-in on the account and on the email behind it, so a copy stays a copy rather than becoming a takeover.
• Report early rather than waiting to see what the account does.

The wider audit of what a stranger can see about you is in privacy settings.

When it is somebody else being impersonated

If you receive the message rather than send it, you are the evidence.

Report it as a recipient, tell the person through a channel you already had, and do not engage with the account itself.

If money has already moved, follow reporting and recovery. US consumer fraud reports go through the Federal Trade Commission's advice on scams.

Where the approach arrived as a message with a link, the CISA guidance on recognizing and reporting phishing covers what to preserve.

Common questions

Can I make a platform delete a fake account of me?

You can report it and you often succeed, but you cannot compel it, and there is no timescale you can rely on. Plan the rest of your response as though the account will stay up for a while.

Should I message the impersonator?

No. It confirms the account reaches you, it produces material they can screenshot, and it changes nothing about the outcome.

Someone used my name to ask my friends for money. Am I responsible?

No, and you should say so once, calmly and publicly. The people who were contacted need to know it was not you far more than they need an explanation of how it happened.

Is it worth reporting to police when nobody lost money?

Sometimes. It is worth doing where there was a threat, where the same person keeps returning, or where you may later need a reference number. Otherwise the platform report is the one that acts.

How do I check whether a message from a company is real?

Not from inside the message. Use a number or an app you already had before it arrived. Anything else is checking the message against itself.