Fake leads and impersonation: what to do when it happens and how to prevent it
“Yes, a new lead has come through! …Oh no, it’s fake..”
Fraudulent emails impersonating a real brand or person are common, and can be damaging for businesses and people alike.
If it has happened to you or you’d rather prevent it from happening, keep reading.
If you receive fake leads
When it happens
Pay attention to all the details provided throughout the form and cross-check them through independent routes before replying or clicking on any links.
Delete fraudulent entries from your systems (e.g. CRM, mailing lists), especially if they include real people’s personal data. It just makes your life easier and your business safer in terms of privacy compliance.
If a lookalike domain of a real brand was used, report that to the brand owner or to the domain’s registrar, so that they can also take action to suspend the fraudulent domain.
To prevent it
If not already in place, add a double opt-in mechanism for any form adding people to a mailing list. This stops fake addresses from ending up on your list and strengthens your consent mechanisms.
Avoid auto-replies that repeat what the user typed, as your auto-reply mechanism can be leveraged to spread the fraudulent message further, this time using your business details. A simpler message like “Thanks, we’ll be in touch” can help avoid issues, while still signalling you got the message.
Check whether your form tool supports a honeypot field, and turn it on if it does. A honeypot field is invisible to humans (who therefore cannot fill it in), but present in the page code, which bots read. Bots tend to fill it in, so the submission gets rejected.
If fake leads become frequent, consider adding a CAPTCHA feature or a form with more advanced options to increase protection. If you do, just be aware that a new feature might require privacy-related considerations or actions.
If your brand is impersonated
When it happens
Look up the registrar of the fraudulent lookalike domain and report it to them. The registrar may suspend a domain used for fraud.
Warn your contacts and customers (e.g. with a banner on your website, a post on social networks).
If customers are actually being deceived, report the fraudulent activity to the police or fraud help desks/agencies.
To prevent it
Strengthen the protection of your own email domain by setting up SPF, DKIM and DMARC in your DNS settings. Note that this doesn’t cover lookalike domains.
Set Google Alerts for your business name or domain to catch their use on public web pages. You can also customise the monitoring in terms of language, regions, frequency, and more.
Consider registering variants of your domain, starting from the most obvious ones.
If counterfeiting or impersonation of your business becomes very frequent, consider adopting specialised services for more structural lookalike domain monitoring or takedown. Note that takedown might require a registered trademark.
If your personal information is misused
When it happens
If your name or other data were used without your consent, report it to the authorities (e.g. the police, the local fraud help desk) or to the email provider or the domain’s registrar.
To avoid being the last one to know
Set Google Alerts and related preferences for the information you want to monitor.
Use tools such as Leakchecker.uni-bonn (EU-based) or Haveibeenpwned (non-EU based) to find out whether your email address was involved in a data breach, or to set notifications up. If involved, strengthen your account protection, starting from changing your password, turning on multi-factor authentication (MFA), and adding more measures depending on the specific platform.
Many of these steps touch on data protection, privacy and security.
If you’re unsure how they apply to your business or what else you can do, feel free to reach out or schedule a free discovery call.