Privacy & Social · October 15, 2026
What to Do When Scammers Impersonate Your Business on WhatsApp
A practical response plan for documenting fake WhatsApp accounts, warning customers, securing your real account, and reporting fraud without spreading it.
If scammers impersonate your business on WhatsApp, preserve the fake profile and messages, confirm whether your real account was compromised, report and block the impersonating account through WhatsApp, and warn customers through channels they already trust. Tell customers not to click the scammer's links, share codes or personal information, or send money. Report financial fraud to the appropriate authorities and payment providers. Do not threaten the impersonator or promise instant removal. WhatsApp and other third parties control enforcement, so account removal and recovery are not guaranteed.
A scammer may copy a business name, logo, product photos, staff identity, or message style while using a different number or username. They may claim an invoice is overdue, offer a prize, change payment details, recruit for a fake job, or ask for a registration code. Customers judge the real business by how clearly it responds.
A lookalike account is different from a compromised account. In the first case, the scammer uses a separate account that resembles the business. In the second, someone gains access to the business's real WhatsApp account or linked device. The evidence, recovery steps, and customer warning should say which situation is confirmed. Do not announce a breach unless the facts support it.
WhatsApp says users can report suspicious accounts and messages, and it may review recent messages and basic call information connected with a report. The FTC advises businesses to warn customers promptly when scammers impersonate them. Reporting and legal options vary by country. This article is general education, not legal advice; consult qualified security, privacy, and legal professionals for serious loss, stolen data, threats, or regulatory duties.
A practical step-by-step approach
01Preserve the scam without spreading it
Save the impersonating phone number or username, profile name and photo, chat screenshots, message timestamps, voice notes, payment requests, links, group names, and reports from customers. Record how each person encountered the account. Keep original files private and redact customer, financial, and security details from anything shared publicly.
02Confirm whether your real account is secure
Check the official business number, linked devices, recent profile changes, sent messages, groups, verification notices, and staff access. Ask the mobile carrier about unexpected SIM activity if the number stopped working. If the real account was taken over, use WhatsApp's compromised-account recovery process and notify contacts that unauthorized messages may have come from the genuine number.
03Report the impersonating account in WhatsApp
Ask recipients who received the scam to open the chat or business profile and use the available Report or Report and Block option. They should select the truthful reason and preserve evidence first. WhatsApp says the reported user is not notified and that recent messages and related metadata may be provided for review. Do not organize false or unrelated reports.
04Send one clear customer warning
Use the official website, established email list, verified social profiles, storefront notice, or known customer-service channel. State the exact official WhatsApp number or username, describe what the fake account is asking people to do, and explain that the business will never request passwords, registration codes, or unusual payment methods in chat. The FTC recommends avoiding hyperlinks in an email warning so it does not resemble phishing.
05Help affected customers take practical action
Tell recipients to stop communicating, avoid links and downloads, block and report the account, and contact their bank, card issuer, payment app, or mobile carrier quickly if money or account access is involved. U.S. customers can report fraud at ReportFraud.ftc.gov and use IdentityTheft.gov when personal information was stolen. Emergency threats belong with local emergency services.
06Report the broader fraud pattern
Create one evidence packet with the fake account, customer reports, payment destinations, domains, email addresses, ads, and related profiles. Report each item to its host. In the United States, the FTC points businesses to the FTC, local law enforcement, and the FBI's Internet Crime Complaint Center. Other countries have their own cybercrime and consumer agencies.
07Harden the official account and phone number
Re-register a compromised account using the code sent to the business phone number, never share that code, and review linked devices after access returns. Enable WhatsApp's current two-step verification or password option, verify the recovery email, secure the carrier account, restrict staff access, and document who owns the number. Update the app and train staff to recognize fake support requests.
08Make the real business easier to verify
Keep the official WhatsApp number, website, email, address, and support policy consistent across trusted profiles. A verified business account may add trust and impersonation protection where available, but it is optional and not a guarantee. Monitor customer reports and retire the warning after the scam is no longer active.
Information to gather
A clear record makes it easier to choose the right channel, communicate accurately, and avoid unnecessary repetition. Start with:
- Fake phone number or username, profile, messages, calls, links, groups, and timestamps
- Customer reports, payment requests, transaction details, and original files stored securely
- Official account access, linked devices, carrier status, recent changes, and authorized staff
- WhatsApp reports, host and payment-provider reports, case numbers, and decisions
- Customer warning with official contact details, scam description, and response owner
- Two-step verification, recovery email, carrier security, staff training, and follow-up date
What not to do
Pressure can lead to decisions that create a second reputation problem. Avoid:
- Replying to the impersonator with threats, insults, tracking links, or attempts to identify them
- Publishing the scammer's payment details or customer records without a lawful reason
- Forwarding suspicious links, files, or messages to customers as examples
- Paying recovery agents who claim private access to WhatsApp or guaranteed removal
- Asking staff or customers to submit inaccurate reports or confront the account
- Promising that WhatsApp, police, banks, or a reputation agency will recover funds or remove the account
Frequently asked questions
How do I report a fake business account on WhatsApp?
Open the suspicious chat, tap or click the account or business name, and use the available Report, Report Business, or Report and Block option. Preserve screenshots first and choose the reason that truthfully describes the problem. WhatsApp says a report may include recent messages and related call or message information, and the reported account is not notified.
What if the scammer is using our real WhatsApp number?
Treat that as a possible account or phone-number compromise. Use WhatsApp's official recovery process, secure the carrier and connected email, review linked devices, and warn contacts that messages from the genuine number may have been unauthorized. WhatsApp says re-registering with the code sent to the number logs out other devices; never share that code.
Should the business warn every customer?
Warn the people reasonably likely to receive or act on the scam, using channels they already recognize. Explain the fake account, official contact details, and what the business will never request. Avoid speculation and unnecessary personal information. The appropriate scope depends on reach, customer data involved, financial risk, and any legal notification duties.
Does a WhatsApp verified badge stop impersonation?
No. WhatsApp says verified business accounts use a multi-step authentication process, and some Meta Verified plans include impersonation protection. Availability and benefits vary. A badge can help customers identify the official account, but scammers may still use copied images, similar names, different numbers, or other channels.
Can a reputation agency guarantee removal of a WhatsApp impersonator?
No. A responsible agency can organize evidence, prepare accurate reports, draft customer warnings, monitor related channels, and improve verification information. WhatsApp, telecom providers, payment services, authorities, and other third parties make their own decisions. Removal, account recovery, payment recovery, and timing cannot be guaranteed.
Primary resources
Policies and features can change. Review the current source before submitting a request:
- WhatsApp Help Center: About Suspicious Messages and Scams
- WhatsApp Help Center: How to Report a Merchant for Fraud
- WhatsApp Help Center: How to Recover a Compromised Account
- WhatsApp Help Center: How to Report a Username
- WhatsApp Help Center: About Registration and Two-Step Verification
- FTC: Small Business Guidance on Business Impersonators
- FTC: Business Impersonator Scams