Someone Is Pretending to Be You Online: How to Protect Your Digital Identity

Years ago, I titled an article about online impersonation "Who Are You? Are You, You?" It was a slightly playful title for a problem that was not particularly funny then and has become considerably more serious now.

At the time, much of the advice centered on fake Facebook, Instagram, and Twitter profiles. Those threats still exist, but the problem is bigger today.

Someone pretending to be you can copy your name, photo, logo, social profile, website, email address, voice, or other pieces of your digital identity. They may contact your customers, employees, vendors, friends, or family while borrowing the trust you spent years building.

For a business owner, your digital identity is an asset. Protecting it is no longer just a social media problem. It is part of protecting your reputation, your customers, and your business.

An impersonator does not necessarily need to hack your account. Sometimes the scam works because the criminal creates something that looks close enough to the real thing.

A fake profile can use your photograph. A lookalike email address can imitate your company. A copied website can borrow your logo and language. A message can appear to come from an executive. AI can make fake images, audio, and other deceptive content easier to create.

The goal is not to become paranoid about everything online. The goal is to make the authentic version of you easier to verify and make impersonation harder to exploit.

A Simple Framework: Prevent, Monitor, Respond

I think about digital identity protection in three stages. PREVENT makes your legitimate identity harder to compromise and easier to recognize. MONITOR helps you notice suspicious copies or activity. RESPOND gives you a plan when something goes wrong.

Protecting your digital identity is not only about finding fake accounts. It is also about creating a strong, consistent, legitimate online presence.

If your website, social profiles, business listings, email domain, contact information, and branding reinforce one another, a customer has a much better chance of answering an important question: "Is this really them?"

A strong online presence is not just marketing. In this context, it becomes part of your trust infrastructure.

Do Not Assume a Familiar Name, Photo, Voice, or Caller ID Proves Identity

One of the hardest parts of modern impersonation is that many of the signals people once relied on can be copied or manipulated.

The FTC advises consumers to independently verify unexpected communications instead of trusting the contact information supplied in the suspicious message. Caller ID can be spoofed. A familiar logo can be copied. A profile photo proves very little.

AI raises the stakes further because realistic synthetic images, audio, and video can support a scammer's story. The right response is not to assume every piece of media is fake. It is to develop verification habits for unusual or high-risk requests.

If someone claiming to be a business owner, executive, employee, family member, bank, or vendor suddenly asks for money, credentials, sensitive data, or an unusual change in procedure, verify the request through a known, independent channel.

Your Employees Need a Verification Rule

A small business can invest in technology and still be vulnerable if one rushed employee believes the wrong message.

Create a simple rule: unusual requests involving money, passwords, account access, banking changes, gift cards, sensitive customer data, or changes to established payment procedures require independent verification.

Do not verify by replying to the suspicious message. Use a phone number, email address, internal chat, or other channel you already know is legitimate.

This is especially important for employees who handle accounting, payroll, customer service, social media, website administration, and executive support.

Save the exact profile, page, and website URLs. They disappear after reports are filed.

Full profile, messages, and any pages the impersonator is running. Include timestamps.

Usernames, handles, email addresses, phone numbers, domains, and payment instructions.

Names of anyone contacted, what the impersonator asked for, and any platform case numbers.

Before evidence disappears, preserve what you can. A written record protects your reporting options and helps investigators later:

Do not engage the impersonator more than necessary to preserve evidence or protect someone. If there are threats, stalking, extortion, significant financial loss, or safety concerns, involve the appropriate authorities and professional advisers.

What Has Changed Since I First Wrote This Article

My original article focused heavily on how to click through individual social networks and report a fake account. That information ages quickly.

The more durable lesson is to build a digital identity that can be verified, secure the systems behind it, monitor the places where people encounter your brand, preserve evidence when something happens, and use the current official reporting channel for the service involved.

That approach survives the next Facebook menu change, the next social platform, and the next generation of AI tools.

Your name, company, website, domain, email, social profiles, reviews, business listings, photographs, and reputation collectively tell people who you are online.

That identity helps create trust. Unfortunately, trust is exactly what an impersonator wants to borrow.

Protect the accounts. Make your legitimate presence easy to verify. Monitor what people are seeing. Teach your team how to verify unusual requests. And if someone impersonates you, preserve the evidence and respond through the right channels.

The question behind my old title still matters: Who are you, and can your customers tell that it is really you?

In 2026, every business should be able to answer that question.