Brand Impersonation
Brand impersonation
How attackers exploit your brand and what the business impact is
What is brand impersonation?
Brand Impersonation is an attack method in which attackers impersonate a well-known brand, company or organization in order to steal information, money, or to harm reputation. Attackers exploit the trust that consumers and employees have in familiar brands to carry out sophisticated phishing scams.
Brand impersonation is an especially dangerous form of phishing because it is based on trust and familiarity - people tend to be less suspicious when they see the logo of their bank, their mobile carrier or a global brand they know.
Types of brand impersonation
Domain Spoofing
Buying domains similar to the real brand (typosquatting) such as amazo0n.com or paypa1.com
Email Impersonation
Sending emails impersonating a well-known brand, with an identical logo, signature and wording
Social Media Fake Accounts
Creating fake social network accounts that impersonate the brand
Website Cloning
An exact copy of the real brand's website in order to steal information
The business impact
of phishing attacks involve impersonating a well-known brand
The average cost of brand damage from an impersonation attack
of consumers stop trusting a brand after an impersonation attack
Real-world examples
The attack:
Attackers send fake emails in Microsoft's name announcing 'a security problem with your Office 365 account' and ask the user to log in again.
The result:
Millions of users were affected, hundreds of thousands of credentials were stolen
The attack:
Fake websites imitating Amazon and offering 'one-time' deals. Buyers enter credit card details and the money disappears.
The result:
Damage of tens of millions of dollars, severe harm to consumer trust
The attack:
Fake emails from 'PayPal' announcing a 'blocked account' or a 'suspicious transfer' and redirecting to a fake login page.
The result:
Hundreds of thousands of accounts were breached, millions in direct damage
How do you protect the brand?
DMARC, SPF, DKIM
Implementing email authentication protocols to prevent email spoofing
Brand Monitoring
Continuous monitoring of domains, social networks and websites that impersonate the brand
Trademark Protection
Registration and care in trademark policy, and shutting down similar domains
Customer Education
Educating customers to recognize impersonation - official communication channels, security markers
Employee Awareness
Training employees to recognize and report impersonation of the company's brand or of suppliers
Legal Action
Taking legal action against attackers and shutting down fake websites and accounts
Protect your brand and your customers
PhishingU's phishing simulations include brand impersonation scenarios to prepare employees
Contact us now* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.