Six strategies to protect your business against account takeovers and impersonation

Is your brand being used for malicious purposes? A concerning trend shows threat actors are posing as known businesses online to capture login credentials or sensitive financial information from employees and the public alike. Credentials stolen through this brand impersonation can be wielded to steal funds and shut down operations in what’s known as account takeover (ATO).

An organization’s reputation and finances are at stake with this threat. Understanding brand impersonation and ATO tactics, as well as preventative measures, can help you mitigate these imposter risks.

Understanding brand impersonation and account takeover threats

Brand impersonation occurs when threat actors mimic a trusted entity, such as a well-known brand or business partner, to deceive employees, customers, vendors, and other users. Attackers can gain access to sensitive financial and account information through tactics like mimicking a trusted entity's websites, emails, and ads. The FBI has noted a rise in cybercriminals posing as known companies in search engine advertisements to lure victims to malicious sites where they can steal credentials or install ransomware.

Corporate account takeover (ATO) involves threat actors stealing employee credentials – often through social engineering tactics or malware – to gain access to corporate accounts. From there, threat actors can initiate unauthorized transactions, steal funds, expose sensitive information, and even disrupt organizations.

Easier access to generative AI and machine learning tools has unfortunately aided these malicious attacks by enhancing the frequency and efficacy of tactics. A 2026 report on data breaches found that more than one in four organizations surveyed experienced an AI-driven malicious attack, a 56% increase over the previous year. These attacks, which were largely AI deepfake impersonation and AI-enabled malware, averaged $1 million per breach¹. Threat actors are leveraging AI tools to generate realistic impersonation emails and replicate trusted brand imagery, making it harder to identify malicious activity.

Who is most at risk from brand impersonation and account takeovers?

Industries such as healthcare, utilities, and eCommerce are particularly vulnerable due to their reliance on sensitive data and high transaction volume. However, the threat extends across all sectors for businesses of every size. Larger companies and brands are typically the focus for brand impersonations, but any business could be targeted.

Individuals are also commonly targeted. These attacks on companies and individuals come at great cost, with AARP reporting that ATO fraud resulted in nearly $15.6 billion in losses in recent years, a sharp increase from $12.7 billion in years prior².

How account takeover attacks work

Cybercriminals use a variety of tactics to lure victims into downloading malware or sharing their credentials. Here are four strategies commonly employed to execute brand impersonation and ATO schemes:

• Deceptive advertising: Threat actors purchase ads that appear at the top of search engine results using a domain similar to a legitimate business. These ads, known as “malvertising”, use known brand logos and voice to mimic legitimate businesses and direct users to fake websites designed to collect credentials or deploy malware.
• Fake websites and login pages: Threat actors replicate login pages of trusted platforms such as Office 365, luring employees into entering their credentials. Once the login information has been harvested, attackers can gain access to sensitive accounts often undetected.
• Social engineering: People are inherently trusting and helpful, and threat actors use that to their advantage. In a social engineering attack, threat actors impersonate executives or trusted business partners (both within the organization and outside of it) to manipulate employees into taking an action. Typically, that action is transferring funds or divulging login information delivered with a sense of urgency.
• Phishing: This tactic is a classic for a reason. In this surprisingly effective strategy, threat actors send an email mimicking a known brand or trusted person that contains a malicious link or attachment containing malware. With the continuing emergence of generative AI, these attacks have only become more effective and difficult to recognize.

Suspicious messages and security reminders

You might be contacted as an account holder by a vendor, bank, partner company, or other business about your account, but always be vigilant in what is communicated. Any unexpected message or link asking for account numbers, login credentials, two-factor authentication numbers, or to “secure” your account should be viewed as suspicious and ignored.

Here are four examples of phone, email, or text messages you should never receive from a reputable brand, company, or financial institution:

1. “We’ve detected suspicious activity on your account. Please verify your username and password so we can act.”
2. “We need remote access to your computer to stop the fraud before it spreads.”
3. “Your account has been compromised. We need you to move your money to a safe account immediately.”
4. “Click the link we sent to login securely. Do not use the system you normally would. It has been compromised.”

AI makes it easier for cyber criminals to avoid poor grammar and spelling that would typically give them away. These additional red flags in a message can signal that a scammer might be behind it: links that don’t match the supposed sender, lack of personalization, trying to create panic or urgent, and a generic email address or domain.

Six prevention actions to help protect against

1. Monitor account activity and verify URLs

• Enable account and transaction alerts to quickly identify unusual login attempts, changes to account settings, payment activity, or other potentially suspicious behavior.
• Access business systems through trusted channels. Encourage employees to use bookmarked websites, approved applications, and known URLs rather than clicking links in emails, text messages, or search results, which may lead to fraudulent websites.
• Consider using a password manager. These tools can help ensure your credentials are only used for authenticating your saved sites. Malicious sites will have a different address, therefore not matching the site saved in the password manager.

2. Treat messages with caution

• Use a secure email solution and monitor message change notifications.
• Be suspicious of unsolicited contact via call, messages, or social media from any individual you do not know personally and/or enticing you to open a link, download a file, or confirm a login username or password.
• Establish verification procedures for sensitive requests. Train employees to independently verify requests involving payments, account changes, credential resets, or sensitive information using trusted contact methods, not links or phone numbers provided in an email or text.

3. Verify who’s contacting you

• Use dual authentication or authorizers to make any changes to accounts, financial information, or other similar decisions.
• Confirm requests for account changes or financial actions via alternate communication channels, such as a known phone number or in-person conversation with the trusted business partner.

4. Educate employees, customers, and vendors

• Prioritize employee education on common cybersecurity tactics to reduce incidents.
• Train employees in identifying phishing attempts and recognizing legitimate software download sources.
• Vendors and other third-party entities could fall victim to impersonation and ATO, introducing further risk to your organization. Practicing strong third-party risk management that includes brand impersonation and account takeover awareness can help mitigate it.
• Consider warning customers about the rise in these threats. The dual benefit of this is it can help prevent customers from becoming victims and reinforce your organization’s commitment to security.

5. Safeguard your domain and online presence

• Register variations of your domain name to help prevent spoofing.
• Consider investing in domain protection services to notify you when similar domains have been registered to ones you own.
• Protect your brand on social media platforms by registering on official accounts, even if you’re not planning on being active on the platform.
• Registering a company's trademarks with Google and Microsoft Bing can help cut down on advertisement abuse that leads to phishing.

6. Adopt strong cybersecurity practices across your organization

• Strengthen identity and password security by using unique passwords, a password manager, and strong authentication practices.
• Require Multi-Factor Authentication (MFA) for business-critical accounts, including email, banking, cloud applications, and social media platforms.
• Implement layered cybersecurity defenses and regularly update security tools, operating systems, and software to help protect against evolving threats. Secure and manage business devices by enforcing screen locks, timely software updates, and mobile device protections for both company-owned and authorized mobile devices.

What to do if your organization is impersonated

The first step is to contain the threat by disconnecting compromised accounts from critical business systems and change all credentials immediately, especially for privileged accounts. Follow your organization’s incident response plan to help mitigate damage.

If your organization is targeted through brand impersonation or fraudulent search engine advertisement, act swiftly by:

• Reporting fake accounts or advertisements to social media platforms and/or website hosting providers' abuse reporting mechanism to request takedown.
• Reporting the incident to the FBI Internet Crime Complaint Center (IC3) and to the Federal Trade Commission.

Protecting your organization’s future

Brand impersonation and corporate account takeover threats are escalating. Businesses failing to address these risks could face severe financial and reputational damage. Huntington can support you with the insights, resources, and expertise needed to help you develop a strong cybersecurity and fraud prevention strategy. Explore our cybersecurity and fraud resources, then contact us to learn how we can help you protect your employees and your business.