When Scammers Pretend to Be Your Business: Protecting Customers From Fake Accounts and Fake Payment Requests

A bakery with eleven thousand followers posts a holiday hamper. Within a day, a second account appears with the same logo, a name that differs by one underscore, and the same photos. It messages people who commented on the post: "Hello, this is the bakery admin. Your order slot is confirmed, please transfer the deposit to this account today." Nine people pay. The bakery hears of it only when the first angry message arrives. The bakery did nothing wrong, and the customers will remember its name anyway. Impersonation scams target small businesses precisely because customers trust them and nobody is watching.

Why it works

• Small businesses talk to customers in chat, where anyone can open an account with any name and picture.
• Payment by transfer to a personal-looking account is normal for small sellers, so a scammer's account does not look odd.
• Public comments reveal who is interested. A person who writes "how do I order?" is a ready target.
• Urgency is believable. Limited slots and promotions are how real sellers talk.
• Nobody has told the customer what the real business would never do.

The defence is not technical. It is being consistent and saying so in public.

Eight habits that make a fake obvious

1. One official list of contacts

Publish your numbers and accounts in one place you control, such as your website or your pinned profile, and repeat: "These are our only contacts." Put the same list on receipts and packaging.

2. One payment destination, in the business name

Take payment to an account or payment code in the name of the business, and publish that name. "We accept payment only to an account named after the business, never to a personal account" is the single most protective sentence you can publish.

Where possible, use a payment method that shows the merchant name to the payer before they confirm.

3. A fixed way of confirming orders

Always send the same form: order number, items, total, destination account name. Customers learn the pattern. A message that lacks it stands out.

4. A list of what you never ask

Publish it:

• We never ask for a verification code or one-time password.
• We never ask for card details or a banking PIN in chat.
• We never ask you to install an application.
• We never ask for payment to a different account "because the main one has a problem".

5. No first contact about payment from an unknown number

State that payment requests come only inside the conversation the customer started, from the published number. If staff must use another number, they introduce it from the official one first.

6. Verify your presence where the platform allows

Complete the business profile: name, address, hours, website. Apply for whatever verification the platform offers to businesses of your type. A complete, consistent profile is harder to imitate convincingly, though a badge alone does not stop impersonation.

7. Protect your own accounts

A scammer who takes over your real account is far worse than one who imitates it.

• Turn on two-step verification on every chat, social, email and marketplace account.
• Never share a login code, even with someone claiming to be platform support.
• Use individual staff access where the platform supports it, and remove it the day someone leaves.
• Secure the email address that the accounts recover to.
• Keep the business number on a SIM registered to the business, and protect it from being ported or replaced.

8. Look for fakes on a schedule

Once a week, search your business name on the platforms you use. Check accounts with similar names. Ask loyal customers to tell you when something looks odd, and thank them when they do.

What to tell customers, before anything happens

A short pinned message, repeated every month or two:

"For your safety: our only contacts are [list]. We accept payment only to [account name]. We never ask for verification codes or payment to personal accounts. If someone contacts you in our name and asks for either, do not pay, and tell us."

Add a line to order confirmations and to packaging. Customers who have seen it once are far harder to fool.

The first hour when it happens

1. Collect evidence. Screenshots of the fake profile, messages and the payment account used. Ask affected customers to send theirs.
2. Report the fake account to the platform through its impersonation report, and ask followers to report it too. Volume of reports helps.
3. Warn publicly. Post on every channel, pin it: there is a fake account, here is its name, here are our real contacts, do not pay.
4. Message recent enquirers directly, especially people who commented on the post the scammer used.
5. Help victims act fast. They should contact their bank or payment provider at once to report the transfer and ask whether it can be blocked, and report to the police or the official fraud reporting channel in your country. Speed matters.
6. Report the destination account to its bank or provider, with evidence.
7. Brief your staff so every customer gets the same answer.
8. Log everything: times, names, amounts, report references.

Do not go silent out of embarrassment. A business that warns quickly is seen as a fellow victim. One that hides is suspected.

What to say to a customer who lost money

• Believe them and thank them for telling you.
• Be clear and kind about the facts: the account was not yours, and here is how to tell.
• Help with the reports. Give them your evidence and the fake account details.
• Decide your goodwill policy in advance. You may not be obliged to compensate. A gesture, such as a discount or priority on a genuine order, costs little compared with the trust at stake. Make the same offer to everyone in the same situation.
• Do not blame them. The scam was designed to work.

Staff are a target too

Scammers also impersonate customers, suppliers and the owner.

• A message from "the owner" on a new number asking for an urgent transfer: verify by calling the known number.
• A supplier announcing new bank details: confirm by phone using a number you already had.
• A "customer" sending a link or file to "see the order": do not open it on a work device.
• Anyone asking for a code that just arrived by text: never.

Write these four rules on the same page as the customer rules.

Common mistakes

• Taking payment to a personal account in someone's name, making fakes indistinguishable.
• Different staff using different personal numbers to contact customers.
• No published list of official contacts.
• No two-step verification.
• Sharing one password among all staff.
• Deleting the evidence in anger.
• Staying quiet to avoid alarming customers.
• Blaming the victim.
• Warning once, years ago, and never again.

One number, one inbox

Impersonation is easier when a business speaks through many personal phones. Customers cannot know which is real. Working from one business number, with every staff member replying from a shared inbox under their own login, gives customers a single contact to trust and gives you a record of who said what. Polynusa provides a shared inbox on the business number with notes and follow-up per customer. See the pricing page.

Summary

Impersonators succeed because small businesses are trusted, informal and unwatched. Publish one list of official contacts and one payment destination in the business name, confirm orders in a fixed format, and tell customers plainly what you never ask for. Protect your own accounts with two-step verification and individual access, search for fakes weekly, and when one appears, gather evidence, report, warn publicly within the hour and help victims contact their bank and the authorities.

FAQ

How do scammers impersonate a small business?

They copy the name, logo and photos onto a new chat or social account, then contact people who have commented on or followed the real business. They offer a promotion, claim a problem with an order or a refund, and ask for payment to a personal account, a verification code or a click on a link. The customer believes they are dealing with the business.

Are we responsible if a customer pays a scammer pretending to be us?

Legal responsibility depends on the facts and the law where you operate, so ask an adviser about a real case. In practice, the customer will associate the loss with your name whatever the law says. Clear published rules about how you take payment, and a fast public warning, reduce both the harm and the damage to trust.

What should a business never ask a customer for in chat?

A one-time password or verification code, a card number with its security code, a banking password or PIN, or payment to a personal account that differs from the published business account. Publish this list. When customers know you never ask for these, a scammer who does is easy to recognise.