Multi-platform impersonation: what practitioners need to act on

TL;DR: Brands catch only 9% of fakes before the vendor does, 80.6% are hit on two or more platforms at once, and almost 60% of removed domains return within 24 hours, according to Doppel and a16z tracked confirmed impersonation activity across hundreds of brands. The governance gap is not discovery alone but response speed, cross-channel visibility, and repeat-offender containment.

Editorial analysis by NHI Mgmt Group, based on content published by Doppel: “Faking a brand is easy. Making it stop is hard”.

By the numbers:

• Doppel finds 91% of confirmed fakes before the brand ever does.
• Almost 60% of removed domains are back with a new fake within 24 hours.

Key questions

Q: What breaks when impersonation monitoring is split across channels?

A: Teams lose the campaign view.

Q: Why do repeated takedowns not eliminate impersonation risk?

A: Takedowns remove a specific asset, not the operator’s capability.

Q: How do security teams know if impersonation detection is actually working?

A: It is working if high-risk requests are consistently challenged, blocked, or escalated when the claimant cannot satisfy stronger proofing controls.

Practitioner guidance

• Build a single impersonation intake path Unify reports from domains, social platforms, messaging apps, and support channels so the same fake is not handled as separate tickets.
• Measure regrowth after takedowns Track whether removed domains, profiles, or pages reappear within 24 hours and classify repeat appearance as operator persistence.
• Correlate cross-platform abuse signals Join lookalike domains, cloned profiles, and scripted outreach into one case record so analysts can see the campaign rather than isolated events.

Bottom line: Impersonation now operates as a multi-channel trust attack, so fragmented monitoring leaves defenders with only partial visibility.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →