Brand Impersonation Response Skill
Cheap generative tools made impersonation an industrial product: a CEO deepfake pushing a token, a cloned support line harvesting card numbers, a spoofed checkout collecting credentials. The attack isn't on your systems — it's on your customers' trust, using your face. Speed and sequencing decide the damage; this skill runs both.
What This Skill Produces
- A verification protocol — confirm it's fake, preserve evidence, assess reach before amplifying it
- A takedown sequence by platform/registrar/store, with the escalation paths that actually work
- Communications for each audience: targeted customers, all customers, public, employees, and (deepfaked) the impersonated person
- A hardening plan so the next attempt lands softer
Required Inputs
Ask for (if not already provided):
- What's circulating: the artifact (video/audio/site/app/account), where it lives, how it was discovered
- The harm mechanism: financial scam? credential harvesting? reputation/market manipulation? (Drives urgency and legal posture)
- Reach so far — views, victim reports, whether it's spreading or stagnant
- Who's impersonated — the brand, a product surface, or a named human (a deepfaked person is also a victim; the response includes them)
Response Method
Phase 1 — Verify and preserve (first hours).
Confirm fabrication with the impersonated party directly (deepfakes are good; "that's obviously fake" is not a verification method). Preserve everything before takedowns delete the evidence: URLs, hashes, screen recordings, WHOIS, wallet addresses, timestamps — the takedown kills the scam, the evidence supports fraud referrals and platform escalation. Quietly assess reach; do not publicly respond yet — a statement about a 400-view scam gives it 40,000.
Phase 2 — Contain (same day).
Takedowns in parallel, sequenced by harm-per-hour:
- Payment/credential harvesting first: hosting provider + registrar (impersonation/phishing abuse reports), Google Safe Browsing / Microsoft SmartScreen flagging (kills most browser traffic faster than the registrar acts), payment processor fraud teams if cards are flowing
- Platforms: impersonation reports via brand/IP channels, not generic user reports — trademark-based reports move in hours where "report account" moves in weeks; file with rights documentation attached
- App stores: developer-impersonation + trademark claims through the formal IP channels
- Route it as fraud, not just abuse, where money moved: law enforcement referral (IC3 or local equivalent) — platforms escalate faster with a case number
Log every report: platform, ticket, time — the log is the escalation tool when nothing moves.
Phase 3 — Communicate (as reach demands).
The proportionality rule: warn the targeted, inform the asking, broadcast only when reach forces it.
- Targeted/victimised customers immediately: what happened, what we will never ask (the anchor line: "we will never DM you for payment/credentials/wallet transfers"), what to do if they engaged, one report channel
- The impersonated executive (deepfake cases): they're a victim, not just an asset — align their personal statement with the company's; one voice
- Public statement only past the reach threshold: short, factual, no link or screenshot of the fake, the never-ask anchor, the report channel. Never repeat the scam's claims in the correction (repetition entrenches)
- Support + social teams get the script before the public does — they're already getting the questions
Phase 4 — Harden (the week after).
Verification anchors customers can check (verified handles list on your domain, DMARC/BIMI, signed comms for high-stakes messages) · monitoring for the next round (domain-permutation watch, brand-mention alerts, app-store sweeps — impersonators retry) · the internal deepfake protocol (a "CEO" voice call requesting a transfer gets a callback on a known number — write it down now) · pre-registered abuse contacts at the platforms that were slow this time.
Output Format
Impersonation Response: [what's circulating] — [date]
Verification: [how fabrication was confirmed · evidence preserved (list) · reach assessment]
Takedown log
| Target |
Channel used |
Filed |
Status |
Escalation path |
Communications (drafted, per audience): [targeted-customer notice · support script · public statement (with its reach trigger) · executive's personal statement if applicable]
The never-ask anchor: [the exact line, everywhere]
Hardening plan: [verification anchors · monitoring · internal deepfake protocol · owner + dates]
Quality Checks
Anti-Patterns
1---2name: brand-impersonation-response3description: Respond to a brand or executive impersonation incident — deepfaked executives, cloned support lines, fake apps, spoofed domains, or AI-generated scam content wearing your name. Use when a deepfake of a leader is circulating, customers report a fake version of your product or support channel, or to prepare the impersonation playbook before it happens. Produces an incident response: verification protocol, takedown sequencing by platform, customer and public communications, and the hardening plan. For general crisis comms use press-release/pm-crisis skills; for security incidents inside your systems use security-incident-response.4---5
6# Brand Impersonation Response Skill
7
8Cheap generative tools made impersonation an industrial product: a CEO deepfake pushing a token, a cloned support line harvesting card numbers, a spoofed checkout collecting credentials. The attack isn't on your systems — it's on your *customers' trust*, using your face. Speed and sequencing decide the damage; this skill runs both.
9
10## What This Skill Produces
11
12- A **verification protocol** — confirm it's fake, preserve evidence, assess reach *before* amplifying it
13- A **takedown sequence** by platform/registrar/store, with the escalation paths that actually work
14- **Communications** for each audience: targeted customers, all customers, public, employees, and (deepfaked) the impersonated person
15- A **hardening plan** so the next attempt lands softer
16
17## Required Inputs
18
19Ask for (if not already provided):
20- **What's circulating**: the artifact (video/audio/site/app/account), where it lives, how it was discovered
21- **The harm mechanism**: financial scam? credential harvesting? reputation/market manipulation? (Drives urgency and legal posture)
22- **Reach so far** — views, victim reports, whether it's spreading or stagnant
23- **Who's impersonated** — the brand, a product surface, or a named human (a deepfaked *person* is also a victim; the response includes them)
24
25## Response Method
26
27**Phase 1 — Verify and preserve (first hours).**
28Confirm fabrication with the impersonated party directly (deepfakes are good; "that's obviously fake" is not a verification method). Preserve everything *before* takedowns delete the evidence: URLs, hashes, screen recordings, WHOIS, wallet addresses, timestamps — the takedown kills the scam, the evidence supports fraud referrals and platform escalation. Quietly assess reach; **do not publicly respond yet** — a statement about a 400-view scam gives it 40,000.
29
30**Phase 2 — Contain (same day).**
31Takedowns in parallel, sequenced by harm-per-hour:
32- **Payment/credential harvesting first**: hosting provider + registrar (impersonation/phishing abuse reports), Google Safe Browsing / Microsoft SmartScreen flagging (kills most browser traffic faster than the registrar acts), payment processor fraud teams if cards are flowing
33- **Platforms**: impersonation reports via *brand/IP channels*, not generic user reports — trademark-based reports move in hours where "report account" moves in weeks; file with rights documentation attached
34- **App stores**: developer-impersonation + trademark claims through the formal IP channels
35- Route it as **fraud, not just abuse**, where money moved: law enforcement referral (IC3 or local equivalent) — platforms escalate faster with a case number
36Log every report: platform, ticket, time — the log *is* the escalation tool when nothing moves.
37
38**Phase 3 — Communicate (as reach demands).**
39The proportionality rule: **warn the targeted, inform the asking, broadcast only when reach forces it.**
40- **Targeted/victimised customers** immediately: what happened, what we will *never* ask (the anchor line: "we will never DM you for payment/credentials/wallet transfers"), what to do if they engaged, one report channel
41- **The impersonated executive** (deepfake cases): they're a victim, not just an asset — align their personal statement with the company's; one voice
42- **Public statement** only past the reach threshold: short, factual, no link or screenshot of the fake, the never-ask anchor, the report channel. Never repeat the scam's claims in the correction (repetition entrenches)
43- **Support + social teams** get the script *before* the public does — they're already getting the questions
44
45**Phase 4 — Harden (the week after).**
46Verification anchors customers can check (verified handles list on your domain, DMARC/BIMI, signed comms for high-stakes messages) · monitoring for the next round (domain-permutation watch, brand-mention alerts, app-store sweeps — impersonators retry) · the *internal* deepfake protocol (a "CEO" voice call requesting a transfer gets a callback on a known number — write it down now) · pre-registered abuse contacts at the platforms that were slow this time.
47
48## Output Format
49
50### Impersonation Response: [what's circulating] — [date]
51
52**Verification:** [how fabrication was confirmed · evidence preserved (list) · reach assessment]
53
54**Takedown log**
55| Target | Channel used | Filed | Status | Escalation path |
56|---|---|---|---|---|
57
58**Communications** *(drafted, per audience)*: [targeted-customer notice · support script · public statement (with its reach trigger) · executive's personal statement if applicable]
59
60**The never-ask anchor:** [the exact line, everywhere]
61
62**Hardening plan:** [verification anchors · monitoring · internal deepfake protocol · owner + dates]
63
64## Quality Checks
65
66- [ ] Evidence was preserved before takedowns were filed
67- [ ] Takedowns route through IP/trademark channels with documentation, not generic reports
68- [ ] Public response is gated on a stated reach threshold, not reflex
69- [ ] No communication links, screenshots, or restates the scam's content
70- [ ] Money-moved cases include the law-enforcement referral
71- [ ] The hardening plan includes the internal voice-deepfake protocol
72
73## Anti-Patterns
74
75- [ ] Do not amplify a low-reach scam with a high-reach denial — proportionality is the discipline
76- [ ] Do not file generic "report this account" tickets when trademark channels exist — wrong queue, weeks lost
77- [ ] Do not let takedowns destroy the evidence — preserve first, always
78- [ ] Do not leave the deepfaked human out of the response — an executive learning the plan from the press release is a second incident
79- [ ] Do not treat it as a one-off — impersonation that worked once is a campaign; monitoring is part of the response, not the postscript
Mohit Aggarwal