Guide
Stop Brand Impersonation Scams in Social Media Comments
Stop brand impersonation scams in social media comments with a repeatable system: document your real accounts, learn the scam tells, filter and block fast, and automate detection so fakes do not outpace your team.
8 min read
read
·
Step 1: Document Your Official Identity So Impostors Are Easy to Spot
Moderators cannot catch fakes if nobody has written down what is real. Create one reference sheet every teammate can open in seconds. It should contain:
Official handles on each platform, with verified status noted
Your official support email address
Official domains, including any checkout or order-tracking subdomains
The only channels where you ever ask customers to DM or contact you
Next, write down what your brand never does. For example: never asks for card numbers, passwords or verification codes in comments or DMs, never runs a giveaway that requires a fee or shipping payment, and never moves a support conversation to WhatsApp or Telegram unless that is genuinely one of your listed channels. These rules turn a vague "this feels off" into a clear yes or no.
Share the sheet with moderators, support staff, and any agency running your ads. Agencies matter here because they often manage ad comments and may not know which handles are yours.
Mistake to avoid: relying on moderators' memory of which handles are real. Lookalike accounts are designed to pass a quick glance, and memory fails most when someone is new or covering a weekend shift. Update the sheet whenever you launch or retire a handle.
Step 2: Learn the Scam Patterns That Show Up Under Your Posts and Ads
A brand impersonation scam in comments is an account that copies your name, logo and tone to reply to customers with fake support, fake giveaways or phishing links. The goal is to steal payments, personal data or login credentials.
The common tells are consistent enough to train your team on:
A handle that swaps characters, such as a capital I for a lowercase l or a zero for an O, or adds underscores, numbers or words like "support" or "official"
A new account with few posts, little history and a copied profile photo
A reply that lands quickly after a customer complaint, often with a generic apology
An instruction to "DM us on WhatsApp" or Telegram, or a shortened link
A message announcing the customer has "won" something and must pay or confirm details
The highest-risk spots are ad comments, posts where customers complain about orders or refunds, and viral posts with heavy traffic. Scammers watch for frustrated customers because they are the most likely to respond to a "support agent."
Misconception: only big brands are targeted. Any brand that runs paid ads and receives complaints is a target, because the scammer only needs a stream of visible, worried customers.
Step 3: Turn on Native Platform Filters and Blocking
Built-in tools are free to set up.
Instagram: add impersonation phrases and your brand's own name variations to Hidden Words, Instagram's custom list on top of its default comment hiding. Block any account you have confirmed as an impostor.
Facebook Page: turn on the Page profanity filter and add scam phrases and impersonator handle patterns to the blocked-word list, which can hold up to 1,000 keywords and also catches common misspellings, plurals and symbol swaps. To block an impostor from a comment on desktop, hover over the commenter's photo, click Options, then Block. On mobile, tap and hold the comment, then tap Block user.
TikTok: use the Comments Manager in TikTok Ads Manager to view, hide, filter and block comments on your ads, and add impersonation phrases to a Blocked Word list there.
Build the keyword list
Start with phrases scammers lean on: "DM me," "WhatsApp," "Telegram," "claim your prize," "refund," "support agent," "winner," and common link shorteners such as bit.ly. Add your own brand name with likely variations: swapped letters, added underscores, and "support" or "official" tacked on. Review the list against real scam comments you have already seen.
Limitation: keyword lists miss spaced-out letters, emoji substitutions and lookalike handles the list has not seen yet. A scammer who writes "W h a t s A p p" can still slip through, and a real customer who writes "I want a refund" can get caught by a rule aimed at scammers. That gap is why Step 5 adds a review queue on top of native filters, not instead of them.
Step 4: Report and Remove Impersonators the Right Way
Deleting a comment is not enough on its own. The account is still free to reply to the next customer. Work through each incident in order:
Hide or delete the comment so customers stop seeing it. Take a screenshot first.
Collect evidence: the profile URL, handle, timestamp, the post or ad it appeared on, and any links or phone numbers used.
Report the account using the platform's impersonation or scam reporting option. Check each platform's current forms before you need them, since some offer a separate business-impersonation report.
Block the account so it cannot keep replying under your content.
Check for spread. Search the handle across your other posts and ads, since the same account can comment on more than one post or ad.
Report fraudulent links to the hosting provider or domain registrar where possible, and to your country's relevant consumer protection or cybercrime reporting body.
Keep a simple log with these columns: handle, platform, date, action taken and outcome. A shared spreadsheet is enough. The log shows which scammers return under new names, which posts attract them, and how long removal takes.
Step 5: Automate Detection So Review Doesn't Depend on Who Is Working the Night Shift
Manual review breaks down for predictable reasons. Scammers reply quickly, often overnight or on weekends. Ad comment sections grow faster than a team can read them. And every minute a fake-support reply stays visible is a minute a customer might click it.
Exerta's comment moderation product works on this layer for Facebook, Instagram and TikTok ads: it hides impersonation phrases and fake-support replies automatically on Facebook, Instagram and TikTok ads, hides scam links on Facebook where comments can carry them, and gives you a log to review. Set clear rules rather than leaving everything to the default:
Auto-hide Facebook comments containing external links from accounts that do not follow you
Flag handles that closely resemble your official ones, using the list from Step 1
Hide phrases tied to fake support and giveaways, such as requests to move to WhatsApp or Telegram
Set up a review queue for edge cases too. No automated system detects everything, and scammers adapt their wording, so a person should check borderline items and feed what they learn back into the rules.
You can also compare dedicated moderation tools. BrandBastion, Respondology, CommentGuard and NapoleonCat each offer comment moderation. Confirm current features, platform coverage and pricing on each vendor's own site before deciding, and judge them on the same criteria: impersonation handling, ad comment coverage, and how easily rules can be edited.
Step 6: Redirect Customers to Real Support Before Scammers Reach Them
Scammers fill gaps. If a complaint sits unanswered for hours, a fake agent may answer it for you. Close the gap with a fast public reply that acknowledges the issue and points to your official support channel, something like "Sorry about this. Please contact us at [official email] or message our official account and we'll sort it out."
Pin the warning
Add a pinned comment or post note that states your rules plainly. A template you can adapt:
"Heads up: we will never ask for payment details, passwords or codes in comments or DMs, and we never charge to enter a giveaway. Our only official support channels are @[yourhandle] and [support email]. If someone else contacts you claiming to be us, do not reply. Report the account and tell us."
Repeat the same warning in your bio, in a story highlight, and as a pinned reply on your active ads. Customers who see the same message everywhere learn which channels to trust.
Step 7: Monitor, Measure and Tighten the Setup Monthly
Scammers change tactics, so a one-time setup decays. Build a light routine.
Weekly: search for your brand name and common misspellings in tags and platform search, and skim the comment sections of your active ads for new lookalike accounts, even ones that have not commented yet.
Monthly:
Review the incident log for repeat offenders and patterns
Add new scam phrases to your keyword list
Prune rules that hide legitimate customer comments
Confirm your official sheet from Step 1 is still accurate
Track four metrics: scam comments caught, time from posting to removal, impersonator accounts reported, and customer complaints about scams. Do not borrow benchmarks from elsewhere. Use your first month as the baseline, then aim to shorten time-to-removal and reduce complaints from there.
Finally, write a short escalation plan: name who to alert if a customer reports losing money, what that person does first (collect evidence, advise the customer to contact their bank or payment provider, and report the fraud), and the point at which you post a public warning, such as when multiple customers are affected or a scam account is active on several posts.
FAQ
How do I tell a brand impersonation scam from a real customer complaint?
Check the account first: a new profile, a copied photo, and a handle with swapped letters or "support" tacked on are tells. Then check the message: a request to move to WhatsApp or Telegram, a demand for payment or codes, or a "you won" announcement. A real customer rarely asks you to pay them.
Should I delete an impersonator's comment or just hide it?
Hide or delete it so customers stop seeing it, but do both with a screenshot first, since deleting alone does not stop the account from replying to your next customer. Report and block the account too, or it keeps targeting the same comment section.
Can native platform filters catch brand impersonation on their own?
They catch some of it. Facebook's blocked-word list and Instagram's Hidden Words work from the words and phrases you add, and Facebook's profanity filter works from Meta's own list of commonly reported words. None of them can judge a new impersonation handle or phrasing they have not seen before. They are a first layer, not a complete one.
Who should I tell if a customer actually loses money to a scam?
Tell the customer to contact their bank or payment provider right away, since that is often the fastest way to reverse a payment. Then report the scam account on the platform and to your country's consumer protection or cybercrime reporting body, and log the incident so you can track repeat offenders.
Does this only matter for brands running paid ads?
No, but ads raise the stakes. An ad comment section gets a steady stream of new visitors who do not know your usual posting style, and a frustrated customer under an ad is exactly who a scammer is watching for.
Other useful guides
Get started today
Pick one recent ad and read through its comments with your Step 1 sheet and Step 2 tells beside you. Anything that slipped through shows where your filters, rules or review queue need work. When you want that review running continuously, see how Exerta moderates ad comments or book a demo.
