What to Do When an Instagram Account Impersonates Your UK Business

Recognise the incident without guessing its reach

A copied bread logo, a bakery name with one extra character and a direct message asking for a pre-order payment can be enough to confuse a customer. In this guide, an imagined Bristol bakery learns that a second Instagram profile is messaging people about a weekend bread-box offer the shop never ran. The owner has only one customer screenshot. That is enough to start checking, but not enough to claim that every follower has been contacted or that a payment has been made. Begin with the exact suspected profile and the actual message, not a public accusation built from an unverified screenshot.

The NCSC describes online brand impersonation as a false representation of a business or service. It can appear on social accounts and can point to a separate phishing website. An ordinary fan account, a mistaken tag and a fraudulent copycat have different implications. Ask what the account actually claims: does it say it is the shop, copy its images, quote its address, direct customers to a new payment destination or invent an offer? A suspicious handle by itself needs checking in context. Note when and how the shop first heard about it, and appoint one person to coordinate the response.

Use the table above to separate the threads. The first priority is people who may be asked to pay or share details. The shop also needs to determine whether its own account is still under its control. Do not wait for a full count of affected customers before taking a proportionate action. Equally, do not claim the copycat has been removed or that no one is at risk until those facts are known.

Separate a copycat account from a hacked account

Impersonation means another account is pretending to be the shop. Account compromise means someone has gained access to the shop's actual account. Both can happen, but they call for different first steps. Have an authorised owner open the shop's Instagram account through their usual app or bookmarked site, not through a link in the suspicious DM. Can they still see the right profile, connected contact details, recent posts and account settings? Are there unexpected messages, email changes or unfamiliar access prompts? Record what is observed without putting passwords or codes in the incident file.

If the genuine account has been taken over, use Instagram's official hacked-account route and secure its linked email and other affected credentials. The existing HitsBoost account security checkup covers routine preparation and recovery readiness in more detail. This guide focuses on the other case: a second account controlled by someone else, while the original remains available to the owner. Changing the genuine profile password may be sensible if there are indicators of compromise; it will not by itself remove a separate lookalike profile.

Do not ask a customer to test a suspect link or send their full message history to prove the incident. The baker can verify the real account with the shop's own stored profile URL and a known website link. One staff member makes that comparison; another can review it if the names are very similar. Keep the real account available for a clear warning once the core facts are established.

• Check the real account from an owner-controlled device.
• Compare the profile URL and settings you know, not a screenshot alone.
• Treat any lost access as an account-recovery incident too.

Compare exact identity details, not follower counts

Write down the full profile URL and exact handle shown in the report. Compare them character by character with the shop's own profile link, website, published contact details and any genuine current promotion. A copied display name and logo can look identical in a small screenshot. A short-lived scam account may also use the shop's address or an old photograph. Check the destination of a pre-order payment request separately: a business that normally takes orders through its own website should treat a new payment link in a DM as a different route, not a routine variation.

A follower count, like count or polished image does not establish identity. The NCSC specifically notes that follower numbers can be bought. A badge can be one clue, but it is not a reason to ignore a suspicious payment destination or to treat every unbadged local shop as fake. The shop should identify its own genuine channels in a way a customer can independently check, such as a website contact page or physical storefront details already in use. Do not create a fresh account just to warn people unless the original is unavailable and the new channel can be independently authenticated.

The bakery's first comparison is practical: the real account is linked from the existing shop website and directs customers to its normal ordering route; the lookalike uses a different spelling and sends a payment page the shop has never used. That does not prove who operates the lookalike, but it supports a precise report and a customer warning. Avoid publishing the scam URL in a clickable form, since that can send more people to it.

Preserve a small, useful evidence record

Before a profile changes or disappears, save the exact URL, handle, display name, relevant public posts, profile image and capture date. If a customer volunteered a suspicious DM, ask for only the portion that shows the sender, claim and destination. Record whether the link points to an off-platform site, but do not open an unfamiliar payment page from a staff device simply to inspect it. If the customer has already clicked, the response belongs in a different risk lane. The NCSC's takedown guidance expects a report to identify the abusive content and supporting evidence; clear, minimal facts are more useful than a large folder of unrelated screenshots.

Keep a simple log: report received; what the shop verified; the suspect account URL; which platform report was submitted; public warning sent; follow-up owner and time. Redact order numbers, addresses and personal messages before sharing evidence outside the incident team. Store the original privately with limited access under the shop's normal retention practice. If several customers report the same profile, link their report references rather than repeatedly copying personal details into a common spreadsheet.

The fictional bakery saves a screenshot of the lookalike profile and one redacted bread-box DM. The customer screenshot shows an account name and a payment link, so the shop has enough to report both the profile and the message. The team does not publish the customer's name, repeat the link on its own Story or speculate about who created the account. This evidence record is for the platform, any relevant provider and the shop's own follow-up, not an invitation for followers to investigate a stranger.

• Save the complete suspect profile URL and capture time.
• Keep a redacted sample of the message and any destination URL.
• Record which customer report led to which platform report.

Report the suspect profile and message through Instagram

Use Instagram's in-app reporting controls on the suspect profile and on any relevant message or post. Meta says questionable content can be reported from a profile, post or message and that impersonation breaches its rules. The wording of menus may change by app version; select the reason that accurately describes the behaviour, include the exact account being reported and follow the form shown to the account owner. If the platform asks for evidence of business identity, provide it only through an official Instagram or Meta route. Do not upload identity documents to a third-party page that arrived in a DM.

Ask people who actually received the suspicious DM to report that message if they are willing. Do not organise a mass-report campaign against a guessed handle or encourage abusive replies. Reporting does not guarantee an immediate removal, and a single takedown may not stop another lookalike from appearing. Save the report reference or screen confirming that a report was sent, then check its status through Instagram's support tools when available. If a profile remains active, update the evidence and keep the customer warning current rather than submitting duplicate reports without new facts.

Meta's reporting guidance is one source for the platform action. The NCSC adds a wider brand-impersonation perspective when a fake site or domain is involved. Those are separate channels: Instagram can assess content on its platform; a hosting company or registrar can assess abusive use of a site or domain. An accurate report to one channel should not be described as action taken by the other.

Give staff one response for incoming customer questions

A shop assistant needs a short answer when a customer asks whether the pre-order DM is real. Prepare a response that states the facts already checked: 'That profile is not one of our published shop accounts. Please do not use its payment link. Our current contact and ordering details are on our website and in our shop. If you received a message, you can report it in Instagram and tell us privately what happened.' Adapt the words to the actual incident and avoid promising that the platform will remove the account by a particular time.

Have staff route affected customers to a person who can handle payment or data concerns. Do not ask for passwords, one-time codes, bank details or a full identity document in a public comment or DM. A customer who paid through the false link should contact their bank or card provider promptly using a number or app they already trust. If the shop routinely answers Instagram and Facebook enquiries, the separate UK customer-enquiries guide covers normal ownership and handoff. An impersonation incident needs a separate log and escalation so it does not disappear into ordinary sales messages.

Give the team a single current link to the shop's public warning and a date for the next review. That prevents three employees giving slightly different stories. The bakery might pause a real pre-order promotion while customers are being misled, but that is a case-specific choice: removing all promotional content can also make it harder for people to identify the real shop. Decide based on what the copycat is copying and what the shop can explain accurately.

Warn customers through channels they already trust

Publish a concise warning on the genuine Instagram account and an established website page or other channel the business controls. Include the exact real profile handle as plain text, how the shop normally accepts payments or orders, and what it will never request through DMs during this incident. Do not make absolute promises about every future message or payment method. If the fake profile is using a particular offer or deadline, describe the fraudulent claim without reproducing a clickable malicious link. Give one private route for affected people to report what they saw.

A good warning is specific but calm: 'A separate account is using our name to send bread-box payment messages. We are not running that offer. Check our Instagram link from our website before responding, and do not pay through the link in that message. If you paid, contact your bank promptly and tell us through our published contact route.' Only post this once the business has checked the core facts. An image of the suspect account might help identification, but crop or blur customer names and avoid amplifying the scam destination.

The public message and the staff script should agree. Pinning or highlighting it may make the warning easier to find if the shop uses those features, but the shop should also check that the warning remains accurate as facts change. Update it when the suspected account is removed, replaced or found to involve a different domain. Record the exact wording and time of each update. Customers need a stable verification route more than a dramatic statement that the business has 'solved' an incident it cannot control completely.

• Post the warning on an account and website you already control.
• Name the real contact and payment route without linking the scam page.
• Give affected people a private, safe way to tell you what happened.

Escalate money loss and malicious links appropriately

An Instagram report addresses the account on that platform. A customer who sent money to an impersonator needs immediate practical help beyond that report. Encourage them to contact their bank or payment provider through their usual app or published number, explain what happened and ask what protective steps apply to their payment method. The shop should not promise a refund from a transaction it never received, nor tell a customer to wait for a platform takedown before contacting their bank. Keep the discussion private and refer the person to appropriate independent support.

Report Fraud's current service distinguishes suspicious messages with no loss from actual fraud or cyber crime in England, Wales and Northern Ireland. Its guidance directs Scottish cases to Police Scotland. Use the current official route for the person's location and circumstances rather than an old phone number copied from a blog. If a fake payment website is involved, the NCSC's brand-takedown guidance explains how to identify the host or registrar and report abuse. The shop may also report a suspected scam website through the NCSC's route. A platform report, crime report and host abuse report may all be useful, but each has a different purpose.

The Bristol bakery finds that one customer entered a card number on a lookalike bread-box checkout page. The bakery records only the minimum details needed for follow-up, tells the customer to contact their bank immediately, and points them to the relevant official fraud service. The shop avoids collecting the card number itself. It then adds the false domain to its provider report without posting it publicly as a live link. This is a fictional example of triage, not a claim that all banks or reports produce the same outcome.

• Ask affected people to contact their bank promptly if they paid.
• Use Report Fraud for England, Wales or Northern Ireland; Police Scotland for Scotland.
• Report a phishing site or impersonating domain through the appropriate provider or NCSC route.

Check whether customer information was exposed by your business

A copycat can reuse a publicly visible logo and send speculative DMs without accessing the real shop's systems. That does not automatically mean the shop has suffered a personal-data breach. Ask what the scammer appears to know. Were names copied from public followers, or did the message contain private order details that should only exist in the shop's records? Did staff lose access to an account, forward customer messages, or install a suspicious tool? Involve the person responsible for the shop's systems and data if there is credible evidence of unauthorised access or disclosure.

The ICO's current guidance says organisations assess whether an incident is a personal-data breach and the risk to people; certain breaches must be reported, and high-risk cases may require telling affected people. The timing and duties depend on what happened, so use the ICO's own guidance and professional advice for the actual facts rather than treating every copycat profile as a reportable breach. Record the decision and reasons. If the shop has no evidence of its own data being exposed, it can say so carefully without claiming an investigation has proved that no one anywhere has been harmed.

Keep this assessment separate from the platform report. Instagram can remove a fake profile without determining whether the business exposed customer data. Equally, a business data incident can need action even if there is no fake profile left online. The bakery checks account access, customer records and the source of private details in the DM before choosing the next step. The point is to protect people using evidence, not to generate a reassuring statement before the facts are known.

Make the next copycat easier to detect and explain

Once the immediate incident is stable, tidy the shop's public identity. Keep the genuine Instagram link on the current website, storefront materials and other channels customers already use. Make the contact and ordering routes consistent and review old promotions that still point to abandoned accounts. Maintain an owner-controlled record of active social profile URLs and authorised payment destinations. A simple change log lets staff recognise a new real handle or website update without relying on memory. These steps help customers check identity; they do not prevent every imitation.

Review how the shop receives reports. A customer should be able to send a suspicious profile link through a known contact channel without being asked to re-open the fake link. Assign an owner for checking such reports and decide where redacted evidence is stored. If comments under the shop's own posts attract fake pre-order replies, use Instagram's reporting and moderation controls according to the separate comment-moderation guide. Do not hide a genuine customer warning simply because it contains the word 'scam'. Staff should know when a comment requires a public clarification and when the detail belongs in private support.

Ask what was difficult during the bakery's response: perhaps the genuine link was buried in a footer, two colleagues used different payment descriptions, or nobody knew who could publish an emergency Story. Fix those practical gaps. Do not measure success by a guessed number of scams prevented. A useful review records when the first report arrived, when a verified warning went live, whether affected customers got a clear route and whether the reported account or site is still active.

Keep social growth decisions separate from safety claims

After an impersonation report, a shop may worry that a lookalike with more followers will appear more credible. That concern does not make follower count an identity check. The NCSC cautions that follower numbers can be bought, and customers should confirm the genuine business through independent published channels. A UK Instagram follower package changes a stated profile count under the seller's terms; it does not verify a business, remove a fake account, protect customers, produce authentic enquiries or guarantee reach or sales. Never describe buying a count as a fraud-prevention measure.

If the bakery has a separate, legitimate profile-count objective later, it can compare current UK Instagram follower options, service conditions and checkout total as a separate decision. It should not distract the incident team from reporting the copycat, warning customers and checking payment or data exposure. The follower-versus-engagement guide explains why profile count and audience response are different measures, neither of which proves that a particular DM came from the real shop.

Close the incident with a dated summary: what was verified, reports made, customer guidance provided, remaining risk and who will check again. If the platform removes the profile, update the warning precisely; if another copycat appears, start a new record linked to the first. The best outcome is a shop whose customers know how to find the real account and whose team can respond proportionately, without claiming immunity from future impersonation.