Social Media Security and Brand Protection

Your page is a business asset

For many small businesses, an Instagram page, a Facebook page, a YouTube channel or a WhatsApp Business profile is the shop window. Customers message you there, see your offers and decide whether to trust you. If someone takes over that account, or creates a convincing copy, they can post scams in your name, message your customers and damage years of goodwill in a day. Treat official accounts like any other business asset: they need an owner, protection and a recovery plan.

Keep official accounts under business control

• Own the account as a business: create it under a business email address the company controls, not a former employee’s personal email or phone number.
• Use a unique, strong password for each official account, kept in an approved password manager rather than a notebook or chat message.
• Turn on multi-factor authentication (MFA) for every person who can manage the account. Prefer an authenticator app over SMS where the platform offers it.
• Have at least two trusted admins, so the business is not locked out if one person is unavailable or leaves. Give others lower roles, such as editor or moderator, if they only post content.
• Keep recovery email and phone details current and owned by the business.
• Review admins and connected apps regularly. Remove people who have changed role or left, and disconnect scheduling or analytics apps you no longer use.

Impersonation and fake support profiles

Impersonation is when someone copies your name, logo and photos to create a look-alike page or profile. They may run fake giveaways, collect ‘advance payments’ for orders, or ask customers for bank details or UPI payments. A related trick is the fake support profile. When a customer publicly complains under your post, a look-alike account replies quickly, saying ‘Sorry for the trouble, please DM us your number to get a refund’. The customer believes it is you. Small details often give it away: a slightly different spelling, a new account with few posts, a different contact number or a request to pay outside your normal channels.

When you spot an impersonation account

1. 1Do not engage with the fake account or argue in public comments. It can draw more attention to it.
2. 2Record the evidence safely: the profile link, the account name and dated screenshots of the posts or messages. Do not store any customer’s personal details beyond what is needed.
3. 3Report it through the platform’s built-in impersonation or brand reporting tool. Ask a few trusted staff to report it too, using the same tool.
4. 4Warn customers through your verified channels: a pinned post on your real page, your website and your known WhatsApp Business number. Say clearly how you do and do not ask for payments.
5. 5If customers have lost money, guide them to the national cybercrime helpline 1930 or cybercrime.gov.in, and suggest they contact their bank quickly.
6. 6Note the date, what was reported and the outcome, and check whether the account is taken down.

Think before you post

• Do not post photos that show customer orders with names, addresses or phone numbers visible.
• Avoid sharing internal details such as which systems you use, office layouts with screens visible or staff ID cards.
• Be careful with posts that reveal when the owner is travelling. Fraudsters use this to time fake payment requests to staff.
• Agree who can approve posts that mention money, refunds or offers, so fakes stand out.