TL;DR: Brands catch only 9% of fakes before the vendor does, 80.6% are hit on two or more platforms at once, and almost 60% of removed domains return within 24 hours, according to Doppel and a16z tracked confirmed impersonation activity across hundreds of brands. The governance gap is not discovery alone but response speed, cross-channel visibility, and repeat-offender containment.
At a glance
What this is: This report shows that impersonation campaigns are spreading across multiple platforms, are often detected by external observers before brands notice them, and frequently reappear after takedown.
Why it matters: It matters because identity governance now has to cover detection, response, and recovery across channels, not just protect a single domain or inbox.
By the numbers:
- Doppel finds 91% of confirmed fakes before the brand ever does.
- 80.6% of impersonated brands get hit on two or more platforms at once.
- Almost 60% of removed domains are back with a new fake within 24 hours.
Context
Impersonation is a cross-channel identity problem, not just a brand protection issue. Attackers borrow logos, domains, messaging styles, and social profiles to create trust fast enough that victims and defenders often see the fake only after it has already started spreading.
The operational failure is usually fragmentation. Teams may monitor email abuse, domain abuse, and social media abuse separately, but impersonation campaigns move across those boundaries as a single trust attack. That makes coordinated verification, escalation, and takedown handling more important than isolated detection.
The same pattern also exposes a wider governance issue for identity and fraud programmes. When fake assets reappear quickly, the problem is not only initial removal but sustained control over recycled infrastructure and impersonated presence.
Key questions
Q: What breaks when impersonation monitoring is split across channels?
A: Teams lose the campaign view. A fake domain, a cloned profile, and a support message may each look minor in isolation, but together they form a coordinated trust attack. Fragmented monitoring delays escalation, slows takedown, and lets the operator shift channels faster than analysts can connect the evidence.
Q: Why do repeated takedowns not eliminate impersonation risk?
A: Takedowns remove a specific asset, not the operator’s capability. If the same actor can register a new domain or recreate the same persona quickly, the organisation has only treated a symptom. The real test is whether recurrence drops after takedown, not whether the first removal request succeeded.
Q: How do security teams know if impersonation detection is actually working?
A: It is working if high-risk requests are consistently challenged, blocked, or escalated when the claimant cannot satisfy stronger proofing controls. Teams should look for reduced success rates on password resets, MFA bypass attempts, and account recovery requests that originate from unmanaged or suspicious channels. If support agents still rely on familiar questions alone, the control is not effective.
Q: When should organisations escalate impersonation cases to fraud, IAM, or trust and safety teams?
A: Escalate when the abuse crosses identity boundaries, such as account takeover, recovery abuse, verified brand misuse, or repeated claims of authority that could trigger financial or operational harm. The right response is shared ownership, because impersonation is rarely just a content issue once an identity is being exploited to mislead users.
Technical breakdown
How impersonation spreads across multiple channels
Impersonation campaigns are rarely confined to one vector. A brand can be copied in a lookalike domain, cloned on a social platform, and reinforced through direct messages or support-style outreach in parallel. That creates a trust chain where each channel validates the others, making the fake look more credible than any single artefact would on its own. The defender problem is correlation: if monitoring and escalation are siloed, the organisation sees fragments rather than a coordinated attack pattern. Practical implication: build cross-channel correlation rules for brand abuse signals and route them into one response workflow. See the Phishing Guide.
Practical implication: Correlate domain, social, and messaging abuse into one intake and response path.
Why takedown success does not end the risk
A successful takedown only removes the current instance of the fake. It does not stop the operator from re-registering a domain, changing hosting, or reusing the same narrative on another platform. That is why takedown metrics can look strong while attacker persistence remains high. The relevant control is not removal alone but follow-through on recurrence, infrastructure reuse, and operator tracking. Practical implication: measure post-takedown regrowth and treat repeated reappearance as an active adversary signal, not as a new isolated event.
Practical implication: Track regrowth after takedown and treat repeat appearance as adversary persistence.
What makes impersonation hard to observe early
Impersonation succeeds because it exploits trust before it triggers obvious technical alarms. Many campaigns use legitimate-looking content, familiar names, and fast-moving multi-platform delivery, so the earliest evidence is often behavioural rather than purely technical. That means passive detection by victims will lag behind operator activity unless the organisation actively hunts for impersonation patterns. The control gap is visibility across the outside of the organisation, where normal IAM telemetry does not reach. Practical implication: combine external monitoring, user reporting, and platform-level abuse intelligence to shorten detection time.
Practical implication: Add external monitoring and user reporting to reduce blind spots in impersonation detection.
Threat narrative
Attacker objective: The attacker aims to harvest trust at scale, drive victim engagement, and keep the impersonation campaign alive through rapid reappearance after takedown.
- Entry begins with a fake brand presence built through lookalike domains, cloned profiles, or multi-platform impersonation that creates initial trust.
- Escalation occurs when the same impersonation appears across two or more platforms, reinforcing credibility and widening the attack surface.
- Impact follows when victims engage with the fake property, and the operator can continue the campaign by regrowing removed assets quickly.
Breaches seen in the wild
- Entra ID actor token flaw (CVE-2025-55241): Hidden Actor tokens plus an Azure AD Graph validation flaw could have let attackers become Global Admin in any Entra ID tenant (CVE-2025-55241).
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Impersonation is now a governance problem across the full trust surface, not a single-channel abuse problem. The data shows attacks spanning multiple platforms and reappearing quickly after takedown, which means the control failure is fragmented oversight rather than weak branding alone. Identity teams, fraud teams, and security operations often own adjacent pieces of the problem but not the full lifecycle. Practitioners should treat impersonation as a cross-functional identity risk with one shared case management path.
Fast takedown metrics can hide a slower adversary loop. A 97% takedown success rate sounds strong until almost 60% of removed domains come back within 24 hours. That gap shows the real control weakness is persistence management, not incident closure. The named concept here is regrowth resistance: the ability to prevent the same operator from reconstituting the fake faster than the defender can suppress it. Practitioners should measure recurrence, not just removal.
Detection often fails because defenders are looking where their own infrastructure is, not where attackers operate. The report suggests brands catch less than they think because the first signal often appears outside the organisation in social platforms, messaging apps, or cloned domains. That is a visibility problem, but it is also an identity governance problem because trust is being stolen through external identity surfaces. Phishing Guide remains relevant because the delivery mechanics overlap with broader social engineering patterns. Practitioners should extend monitoring beyond inbox-centric controls.
Multi-platform impersonation changes how fraud and identity programmes should prioritise response. If 80.6% of impersonated brands are hit on two or more platforms at once, then single-venue response is structurally too slow. The response model must assume synchronized attacks, shared narratives, and recurring infrastructure. That favours centralized triage, common taxonomies, and an escalation path that spans brand, legal, and security owners. Practitioners should redesign impersonation response as an enterprise trust operation, not a per-channel cleanup task.
What this signals
Regrowth resistance: the next stage of impersonation defence is not just removing fake assets but proving they cannot be recreated faster than the organisation can suppress them. That shifts the control question from takedown volume to recurrence rate and operator persistence.
External brand abuse is increasingly an identity problem at the edge of the enterprise. The practical issue is no longer whether a fake exists, but whether the organisation can bind detection, attribution, and escalation into one response loop before victims act on the false trust signal.
For practitioners
- Build a single impersonation intake path Unify reports from domains, social platforms, messaging apps, and support channels so the same fake is not handled as separate tickets.
- Measure regrowth after takedowns Track whether removed domains, profiles, or pages reappear within 24 hours and classify repeat appearance as operator persistence.
- Correlate cross-platform abuse signals Join lookalike domains, cloned profiles, and scripted outreach into one case record so analysts can see the campaign rather than isolated events.
- Tune escalation around trust surfaces Route impersonation cases to brand, legal, fraud, and security owners together when the campaign spans multiple platforms or customer touchpoints.
Key takeaways
- Impersonation now operates as a multi-channel trust attack, so fragmented monitoring leaves defenders with only partial visibility.
- The report’s data shows that external observers often detect fake brands before the owner does, and that removed domains can return very quickly.
- Practitioners need one response path for detection, takedown, and recurrence tracking, or the same operator will keep reappearing.
Related NHI Mgmt Group resources: Phishing Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001;TA0003;TA0040 — Initial Access; Persistence; Impact | The report describes multi-stage impersonation campaigns that establish trust, persist through regrowth, and cause victim harm. |
| Recommendation — Map impersonation campaigns to these tactics and hunt for repeated infrastructure reuse after takedown. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies, Events, and Threats | Cross-platform impersonation needs continuous monitoring across external trust surfaces and abuse signals. |
| RS.CO-02 — Coordination with Stakeholders | The response requires coordinated action across security, legal, fraud, and brand owners. | |
| Recommendation — Expand monitoring to external brand abuse signals and route them into one case management process. Define one escalation path that coordinates impersonation response across all affected stakeholders. | ||
| CIS Controls v8 | CIS-17 — Incident Response Management | Impersonation campaigns need repeatable response handling, not isolated takedown requests. |
| Recommendation — Treat impersonation as an incident class and maintain a repeatable response workflow with recurrence tracking. | ||
Key terms
- Impersonation Campaign: An impersonation campaign is a phishing operation that mimics a trusted organisation, service, or public authority to increase credibility. The attacker changes branding, messaging, and layout to match the target, while keeping the same malicious collection or redirection logic behind the page.
- Lookalike Domain: A lookalike domain is a web address designed to resemble a trusted brand closely enough to trick users into believing it is legitimate. In identity attacks, the domain becomes part of the deception layer, letting attackers capture credentials, identity details, or payments through a counterfeit flow.
- Takedown Regrowth: The reappearance of a removed fraudulent or impersonating asset after it has been taken offline. It is a persistence signal, not a new incident, because it indicates the operator can recreate the same abuse faster than the defender can suppress it.
- Cross-Channel Correlation: Cross-channel correlation is the process of linking identity signals from different surfaces into one decision model. It lets security teams see whether a web action, a phone call, a desktop event, and a token event belong to the same identity moment, which is essential for reliable risk decisions.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for practitioners who need to connect identity controls to fraud, access, and governance decisions across a programme.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org