Business Impersonation Response for Executive Offices in 2026

Research question

What should an executive office coordinate when it discovers that an outsider is impersonating the company or an executive to deceive customers, employees, vendors, or applicants?

What the primary guidance establishes

FTC business guidance describes business impersonation through lookalike email and urges organizations to use email authentication, current security controls, staff training, reporting, and timely customer warnings when scammers misuse the business's identity. The FTC's reporting material shows the factual information a reporter may provide and explains that a report number and tailored next steps follow submission.

The FTC provides business-focused impersonation prevention and warning guidance plus an official fraud-reporting walkthrough. Those resources inform the response path while security, legal, communications, and affected-person owners retain their separate decision authority.

Scope and decision boundary

The assistant can preserve reports, verify genuine channels, convene security, legal, communications, HR, and customer owners, and maintain the action log. The assistant should not attribute the attack, contact a suspected perpetrator, promise reimbursement, declare a breach, direct takedown activity, or submit a government report unless an authorized owner approves the exact action.

Intake triggers

Activate the route for a lookalike domain, fake executive account, spoofed email, fraudulent recruitment message, false invoice, cloned social profile, counterfeit support page, or customer report that someone used the company name to seek money or data. Treat similar reports as potentially related while preserving each reporter's facts separately.

Minimum record

The incident record should include discovery time, reporter contact and consent limits, impersonated identity, channel, account or domain, exact message, headers or platform identifiers, links preserved safely, payment or data request described by the reporter, affected audience, genuine-channel verification, security case, legal owner, communications decision, platform report, government report reference, corrections, and closure criteria.

Ten operating controls

1. Preserve the original report before forwarding

Keep the message, headers, sender handle, destination, timestamp, attachments, and screenshots in the incident channel approved by security. Forwarding alone can strip useful metadata. Do not ask a reporter to click the suspicious link again or continue the conversation merely to gather more detail.

2. Verify the genuine executive or company channel

Use a known directory, official website, or established contact to confirm that the message did not originate from the real account. Do not call a phone number or follow a link contained in the suspicious communication. Record who performed the independent check and which trusted source supplied the contact.

3. Create one cross-functional incident owner

Name the person coordinating security, legal, brand, communications, HR, recruiting, finance, and customer teams. Multiple groups can work in parallel, but one timeline prevents contradictory warnings and duplicate reports. The assistant maintains actions and dependencies without making the technical or legal findings assigned to specialists.

4. Map channels and audiences before warning

Identify which domain, email pattern, platform, advertisement, job board, vendor list, or customer segment is affected. A broad warning can amplify the scam or confuse people who never encountered it. Communications and security decide the audience and wording from the known pattern, not from speculation about reach.

5. Use warnings that point to trusted destinations

An approved warning should explain the observed behavior, the genuine contact route, and what recipients should avoid or report. FTC guidance notes that a customer warning sent by email can omit hyperlinks so it does not resemble phishing. Test sender authentication and publish through channels the audience already recognizes.

6. Separate applicant and employee impacts

Fake recruiting and fake-boss requests may reach different people and require different owners. Route applicant messages to recruiting and privacy contacts while employee payment or credential requests reach security and finance. Do not collect identity documents or financial details in a general impersonation spreadsheet.

7. Coordinate platform and domain reports

Provide the exact account, URL, screenshots, timestamps, trademark or identity documentation approved by counsel, and case reference to the designated reporting owner. Track submission and response identifiers. Avoid personal accounts, public confrontations, or repeated clicks that can complicate evidence and expose staff.

8. Route financial and data harm immediately

If someone sent money, credentials, or personal data, connect them promptly with the organization's approved fraud, bank, privacy, and identity-recovery paths. Do not guarantee recovery or ask them to send account secrets by email. Preserve only the minimum facts needed for the responsible owners to act.

9. Submit official reports with authorization

Prepare a factual chronology and supporting references for the authorized reporter. Confirm the reporting destination independently and retain the receipt or report number. The assistant should not embellish loss, victim count, attribution, or technical cause to make the report appear more urgent.

10. Close only after channel and communication checks

Verify that reported accounts or pages received a disposition, warnings remain accurate, genuine channels are functioning, and unresolved affected people have an owner. Record lessons about authentication, monitoring, recruiting, vendor verification, and response timing. Keep investigative detail restricted while sharing practical prevention changes.

Evidence an auditor can sample

• original message and metadata.
• trusted-channel verification.
• cross-functional owner and timeline.
• affected-channel map.
• approved warning.
• applicant or employee routing.
• platform or registrar report.
• financial or privacy handoff.
• official report receipt.
• closure reconciliation.

Tabletop test

Test a fake executive asking a new hire to buy gift cards, a lookalike support domain collecting customer credentials, and a cloned recruiting profile requesting identity documents. The exercise should preserve evidence, verify genuine channels, tailor warnings, protect victims' sensitive data, and obtain authorization before reports or public statements are made.

Operating cadence

The first hour should establish authenticity, evidence custody, and one incident owner. Capture the suspicious material without interacting with it, verify through trusted contact data, and separate confirmed observations from assumptions. A compact channel map helps specialists decide whether the problem is isolated, part of a campaign, or connected to another security event.

Warnings require coordination because they can either reduce harm or unintentionally spread a malicious link. Use familiar authenticated channels, state only what is known, give a verified route for questions, and avoid collecting sensitive victim details through ordinary email. Recruiting, customer, employee, and vendor audiences may need different instructions even when the impersonated executive is the same.

Closure is more than a takedown status. Reconcile platform reports, official report numbers, affected-person follow-ups, genuine-channel health, and open financial or privacy actions. Feed neutral lessons into authentication, onboarding, payment verification, and monitoring while restricting allegations and personal data to the incident team.

Implementation handoff

Run a tabletop with security, legal, communications, recruiting, finance, and the executive office before an incident. Use a fictional lookalike account and ask the team to preserve metadata, verify the genuine channel, assign one owner, draft audience-specific warnings, and identify who may submit each external report. Confirm that victim details have a protected intake path and that public communications cannot publish a suspicious hyperlink by mistake.

Record time-to-owner and missing contact data as process findings. Repeat the exercise after major domain, platform, recruiting-vendor, or executive-role changes so the response map stays accurate. Test the after-hours path and the process for an executive who is traveling or unreachable.

A response should not depend on the impersonated person personally validating every report before basic evidence preservation begins.

Limits and decision use

Impersonation events can involve security, privacy, employment, fraud, trademark, and law-enforcement questions. This operating model does not establish attribution, liability, breach status, or recovery; authorized specialists must direct those decisions and current reporting steps. Preserve uncertainty explicitly until those owners document their conclusions and response authority.

Keep the verified public contact route current throughout the response.

Executive offices can place this incident model beside the Executive Assistant Agency research library, evaluate the C-suite executive assistant service, or discuss impersonation-response coordination with security, legal, communications, and finance owners.