I changed my password. Is my email safe now?

Not on its own. A password change does not always end sessions that are already signed in, and it does nothing to a forwarding rule, a filter, an app password or a connected app that was added while they had access. Any of those keeps a copy of your mail flowing to them after the password is gone. Change the password, then sign out all sessions, then go through the settings one by one.

Why does the guide say to fix email before my bank?

Because the reset link for the bank arrives in the email. If someone still controls the mailbox, they can request a password reset on any account tied to that address, receive the link and lock you out again minutes after you have finished. Email is the account that grants the others, so it goes first even when it feels less urgent than money.

I cannot get back in at all. What now?

Use the provider's account recovery form rather than the normal login, and fill it in from a device and network you have used with that account before, which is a signal the provider weighs. Answer from memory rather than guessing neatly: approximate dates and old passwords help more than blanks. If the recovery address or phone was changed, say so explicitly, and expect the process to take days rather than minutes.

Should I tell my contacts?

Yes, and through a channel other than the compromised mailbox. Whoever had access may have written to your contacts as you, most often asking for money or sending a link, and the people most likely to fall for it are the ones who trust you. A short message saying that anything unusual from your address in the last few days was not you is enough.

GUIDES · BRAND IMPERSONATION

Someone copied your website. This is the order to shut it down.

Do this first

Collect the evidence before you report anything. Copy the full URL, take screenshots with the date visible, and pull the domain's WHOIS. Cloned sites vanish within days, and a report without evidence goes nowhere.

Someone has copied your site, your logo and your copy to deceive people who think they are dealing with you. You cannot take it down yourself, but you can get it taken down by the people who hold the keys: the domain registrar, the hosting provider and the browsers.

August 17, 202612 min read

First, confirm it really is impersonation

Not everything that looks like your site is a clone. Rule out the three common confusions before you act:

A cached copy. Google, archive.org or a reader view can show your content on another domain with nobody impersonating you.
An aggregator or reseller. If you sell through third parties, your listings and photos legitimately appear on sites you do not control.
Your own site on another domain. Old domains, staging environments, or www and non-www versions left indexed.

It is impersonation when the site passes itself off as you: it uses your name or brand, copies your design, and asks for data, payments or contact as though it were yours.

Collect the evidence before reporting

This is the part that decides whether a report succeeds, and the part almost everyone skips in a hurry. You need:

The full URL, not just the domain. The specific page that copies yours.
Screenshots showing the whole address bar and, if you can, the system date.
The domain's WHOIS: when it was registered and with which registrar. It is nearly always days old, which is itself evidence.
The IP and hosting, so you know which provider to write to.
Proof your content came first: your own archived site, design invoices, your trademark registration if you have one.

If reading a WHOIS record is new to you, see what WHOIS is and how to investigate a suspicious domain.

Report it to the domain registrar

The registrar is the company the domain was bought from, and it is named in the WHOIS. It can suspend the domain, which makes this the fastest route there is: if the report is accepted, the site stops resolving within hours.

Find the abuse contact in the WHOIS, usually abuse@ at the registrar. Keep it short, attach the evidence, and say plainly that the domain is being used to impersonate your business and deceive customers.

If the registrar does not respond within a few days, you can escalate to ICANN, which requires registrars to handle abuse reports.

Report it to the hosting provider

In parallel, write to whoever hosts the site. A serious provider pulls fraudulent content quickly, because hosting it costs them network reputation. The contact here is usually abuse@ too.

If the site sits behind a CDN, that service does not host the content but does have a reporting channel and, for phishing, normally forwards the report to the real host.

Get it flagged in browsers

This does not close the site, but it stops the damage far sooner than any paperwork: once Google or Microsoft flag it, visitors get a red warning screen instead of your clone.

Google Safe Browsing, which protects Chrome, Firefox and Safari at once.
Microsoft SmartScreen, for Edge, reported from the browser under Help and feedback.

The trademark route

If your brand is registered, you have a considerably sharper tool. Using your commercial name without permission is an infringement, and registrars, hosts and platforms respond far faster to a trademark complaint than to a general one. If it is not registered, this is the moment to consider it.

The steps common to any fraudulent site report are in how to report a scam website.

Warn your customers before they fall for it

While the takedown is processed, the clone keeps working. A clear, undramatic notice on your site, your social accounts and, where appropriate, by email to customers prevents most of the damage.

Say three things: what your real domain is, what you will never ask for (passwords, verification codes, instant bank transfers), and where they can check whether something is genuinely yours. There is no need to link to the fake site.

What not to do

Do not try to take the site down yourself. Attacking someone else's server is a crime even when that someone is a criminal, and it puts you on the wrong side of the complaint.
Do not contact the impersonator. It only confirms you have noticed and gives them time to move the clone to another domain.
Do not buy the fake domain. That is money gone and an invitation to register three more.
Do not enter real data into the cloned site's form to "see what happens".

How long it takes

With the evidence prepared, browser flagging usually lands within hours and domain suspension within days. If the domain sits with a registrar that ignores reports it can stretch to weeks, and that is where the ICANN complaint and the trademark route make the difference.

Expect the clone to reappear on another domain. That is normal and does not mean you did anything wrong: the second report moves much faster because your material is already assembled.

Making it harder next time

Register your trademark. It is the single thing that most accelerates any takedown.
Watch for lookalike domains with swapped letters or different endings. Free alerts for similar registrations exist.
Set up SPF, DKIM and DMARC on your mail. It does not stop the site being copied, but it stops mail that appears to come from you, which is what makes the deception credible.
Keep proof of authorship handy: your site archived periodically, and a record of your content.

Frequently asked questions

Can I force a copied website to be taken down?

Not directly, but the people holding the keys can. The registrar can suspend the domain and the hosting provider can pull the content, and both usually do once they receive a report evidencing that the site impersonates a real business. A registered trademark speeds this up considerably.

How long does it take to shut down a site impersonating me?

Browser warnings typically appear within hours, and that is what actually stops the damage. Domain suspension runs from a couple of days to several weeks depending on how diligent the registrar is. If it does not respond, an ICANN complaint is the next step.

Is it worth reporting if the domain is registered abroad?

Yes, and it is usually the route that works. Registrars and hosting providers operate their own abuse policies independently of the victim's country, and Google and Microsoft flagging is global. A police report matters for the record and any later claim, but what closes the site is the technical route.

What if they are also sending email as my company?

That is the usual pairing: the cloned site is what makes the email believable. Set up SPF, DKIM and DMARC on your domain so receiving servers reject messages claiming to be from you. It does not remove the clone, but it takes away the channel that reaches people.

Do I have to tell my customers?

You should, and quickly. While the clone is up, every day is more people who might fall for it. A short notice stating your real domain and what you will never ask for prevents most of the harm. If customer data has leaked, notification obligations may also apply and are worth checking.