Brand fraud occurs when criminals use a company's name, logo, and visual identity to deceive its customers through websites that imitate the official store, fake support profiles, sponsored ads, and cloned applications. Defense combines rapid detection and rapid removal, known as takedown.
Deceived customers usually hold the brand responsible, rather than the criminal.
How the fraud works
The pattern tends to repeat. The criminal registers a domain similar to the official one, with a swapped letter, an extra hyphen, or a different extension. They copy the site's appearance and publish a sponsored ad on social media or a search engine with an attractive offer. The customer buys and pays, and the product never arrives.
Common variations include fake support profiles that respond to public complaints and request data to resolve the issue, fraudulent payment slips emailed under the company's brand, and cloned apps in alternative stores.
Why response time matters
A fake website causes harm as long as it remains online. Every hour between domain registration and takedown means deceived customers, complaints, and reputational damage.
That is why defense cannot rely on a customer's warning. By the time the first complaint arrives, there are already victims. Detection must happen earlier, ideally when the domain is registered.
Digital fraud already tops executives' concerns. The Global Cybersecurity Outlook 2026, from the World Economic Forum, shows that cyber fraud has surpassed ransomware among CEOs' concerns, and the FBI attributed about 85% of reported losses in 2025, totaling US$20.9 billion, to digitally enabled fraud.
How detection works
In the Vultus methodology, DNS feeds are continuously tracked to identify new domains impersonating the brand, while ads, profiles, and pages using its name or logo are monitored. An AI model assesses whether a site is potentially fraudulent based on its characteristics and the presence of the company's visual identity, generating an alert when the score exceeds the threshold.
Before takedown, an analyst confirms the fraud to avoid removing a legitimate reseller or fan site.
How takedown works
Taking down a fraudulent website means securing its removal through whoever keeps it online: the domain registrar, hosting provider, content delivery service, advertising platform, and search engine. Each has its own process and timeframe.
Vultus prioritizes close coordination with these parties because a well-documented request sent to the right contact is addressed faster than a generic form. Automated requests remain available for simpler cases. The cycle closes with a monthly report on what was found, what was taken down, and how long it took.
Fictional example: the fake promotion before Black Friday
Two weeks before Black Friday, an electronics retailer discovers six newly registered domains with variations of its name. Three are empty, two copy the official website, and one already has a sponsored ad offering a phone at half price.
All six are detected at registration. The two clones and the ad enter immediate takedown, the three empty domains remain under monitoring, and customer support receives guidance on responding to customers who ask about the promotion.
What the company can do beyond takedown
Complementary measures reduce opportunities for fraud:
- Preventive registration: of the most obvious variations of the company's domain.
- Published official channels: so customers know where to check.
- Email authentication: SPF, DKIM, and DMARC on the domain, to make emails impersonating the company harder to send.
- Customer service script: for when customers report scams.
- Continuous monitoring: because new incidents keep emerging.
The issue involves marketing, which knows the brand and channels, and security, which has detection tools and the response process.
Detection and takedown with curation
Vultus detects brand fraud from domain registration onward and handles takedowns with providers. Explore Vultus fraud management and prevention and read about dark web monitoring.
