Social Media Spoofing, Fraud, and Company Security

But first, “What is Social Media Spoofing?”

Social media spoofing is when someone creates a fake account using your name and/or likeness in order to defraud people or spread malware. These fraudsters will often copy your profile photo and use similar usernames to make their fake accounts look as realistic as possible.

They may also copy and paste parts of your bio or other information into their fake profiles. These spoofed accounts are often difficult to distinguish from the real thing, which makes them all the more dangerous. Social media spoofing can be damaging to both your personal and professional reputation (as well as your organization’s brand image).

Spotting Fake Profiles

There are a few telltale signs that a social media profile has been spoofed.

1. Picture:
   • If this is a corporate account, does the logo match?
   • If this is a personal account, does the picture match?
2. Username:
   • For corporate accounts, is the name spelled correctly and exactly. Profile visitors moving quickly may not notice the difference between Disny, DlSNEY, and Disney when the rest of the account looks right?
   • For individual accounts – are the names spelled correctly and are they in the form used by the person? For example, if a person’s formal name is Christopher, but in business he always goes by “Christy” – the use of the formal name may indicate an imposter.
3. Biography:
   • For corporate – especially businesses that have an inhouse marketing and PR function, are there issues with the biography? Are there typos? Are there grammar issues?
   • For individuals – does the language “sound like” that person. Does that person typically make jokes or are they more formal? What is their normal behavior on channels and forums that you know are legitimate?
4. Connections and Followers:
   • In the early days of a threat actor profile, the account may have no followers. Or they may have bots that are following them. Take note of the number and quality of the account’s followers.
5. Language in Replies:
   • In business channels, you will typically and consistently see a certain style of response. A response that deviates from the norm may be an indicator of a fake account. You can see some amusing examples here of this happening.

How Cyber and Security Teams Can Collaborate to Identify Fraudsters and Defend Against Abuse:

The best way to avoid social media spoofing is to be proactive. When Cyber and Security teams work together to track and respond, you can help avoid embarrassing and damaging account impersonations. Here are 4 things you can do to help defend against threat actors looking to manipulate your business and key executives.

1. Monitor your business presence and require strong passwords for both business and corporate accounts. Require MFA for all accounts.
2. If you’re monitoring executive profiles, institute a process that notifies cyber and security teams that a new account has been established and ensure that it is also monitored.
3. Control access to your community accounts and ensure access is limited to only those that require it. Capture similar profile names to prevent others from doing so and impersonating your organization.
   • Identify and create the profiles that you don’t want anyone to use. Protect your brand. This also applies to domains.
   • If you’re ABC Company, it may be wise to also claim ABC Co. and The ABC Company etc. to help reduce confusion.
   • Do the same on the channels you aren’t currently using and those you don’t plan to use. In the long run, you’ll be thankful you did.
     • In doing this exercise, you may also come up with a list of “alternative names” that you can use for your monitoring activities.

Thankfully, platforms are getting better at helping users report suspicious activities. But how you respond to fraud remains important. Social media spoofing is on the rise, as evidenced by a recent wave of high-profile attacks. It is a serious problem with major implications for both individuals and businesses. By proactively monitoring your social media accounts, you can avoid becoming a victim and you are more likely to avoid reputational attacks. Make it a priority.

About Nisos®

Nisos is The Managed Intelligence Company®. Our services enable security, intelligence, and trust and safety teams to leverage a world-class intelligence capability tailored to their needs. We fuse robust data collection with a deep understanding of the adversarial mindset delivering smarter defense and more effective response against advanced cyber attacks, disinformation, and abuse of digital platforms.