Someone Is Pretending to Be Your Business Online: Shutting Down a Fake Website and Finding Who Runs It
Last updated: November 2026. Reviewed by Pavel Kolmogorov, California business litigation attorney (State Bar No. 321018).
When someone clones your website on a look-alike domain, work two tracks at once. The fast track is takedown: reports to the host, the registrar, and the payment and advertising services the site depends on. The legal track is a lawsuit for false designation of origin and cybersquatting, which lets a court transfer the domain and award statutory damages of $1,000 to $100,000 per domain name. (15 U.S.C. §§ 1117(d), 1125(d)(1).) Kolmogorov Law, P.C. pursues these civil remedies for businesses in Orange County, Los Angeles, and across California.
Call (909) 235-6116 or contact us online to discuss a fake website, profile, or email address that is posing as your company.
Preserve the evidence before you report anything
A successful takedown also removes your proof. Capture it first.
Save full-page captures of every page of the fake site, with the address and the date visible. Save the page source. Record the domain's registration details as they appear today. Make one test purchase with a card you can trace, and keep the confirmation email and the charge descriptor. Collect the customer complaints that tipped you off. This takes an afternoon, and it is what the claims below are built on.
Getting the fake site offline
Most clones can be disrupted without a judge, because they rely on companies that do not want the liability.
- The web host. If the clone copied your text or photographs, a copyright notice is usually the quickest tool. A host keeps its statutory safe harbor from copyright liability only if it responds expeditiously to a proper notice by removing the material or disabling access to it. (17 U.S.C. § 512(c)(1)(C).) Our DMCA takedown guide covers the notice itself.
- The registrar. Most have an abuse channel for phishing and fraud.
- Payment processors, ad networks, search engines, and social platforms. Cutting off payments and traffic often matters more than removing the pages.
- The domain itself. A domain complaint can transfer a look-alike address without a lawsuit, as our page on domain name disputes explains.
Expect the operator to reappear on a new domain. Keep the evidence file running.
Claims against an operator you can identify
Two federal claims do most of the work. Using your name and look on a site in a way likely to confuse customers about its source is a false designation of origin. (15 U.S.C. § 1125(a)(1)(A).) A registrant who registers or uses a domain identical or confusingly similar to a mark that was already distinctive, with a bad faith intent to profit from that mark, is liable for cybersquatting. The court may transfer the domain and award statutory damages in place of proven loss. (15 U.S.C. §§ 1117(d), 1125(d)(1).) The domain disputes page linked above covers the elements.
Copied pages and photos add a copyright claim, covered on our page about copied website content. Fake goods shipped under your brand raise the separate remedies on our counterfeit products page.
California adds a statute aimed at this exact scheme. It is unlawful to use a web page or email to induce someone to provide identifying information by posing as a business without its approval. (Bus. & Prof. Code, § 22948.2.) The owner of a web page or trademark who is adversely affected may seek the greater of actual damages or $500,000. (Bus. & Prof. Code, § 22948.3, subd. (a)(1).)
When the impostor poses as a person at your company
Some schemes use a fake email account or profile in the name of the owner or a salesperson. California's online impersonation statute covers knowingly and credibly impersonating another actual person online, without consent, in order to harm or defraud someone. It gives anyone who suffers damage or loss a civil action for compensatory damages and an injunction. (Pen. Code, § 528.5, subds. (a), (e).) The text speaks of an actual person, so it fits best when a named individual is being imitated.
When you do not know who is behind it
This is the usual case, and it is not a dead end.
In California state court a complaint can name a defendant whose identity is unknown under a fictitious name and be amended when the true name is found. (Code Civ. Proc., § 474.) In federal court we ask for permission to serve early subpoenas on the registrar, the host, and the payment processor, which usually hold a real name or a bank account. A copyright owner has an additional route against a host that stores the copied material: a subpoena from the district court clerk requiring the host to identify an alleged infringer. (17 U.S.C. § 512(h)(1).) In the Ninth Circuit, that subpoena cannot issue to a provider that only transmits the data.
If the registrant cannot be found or reached, the mark owner may sue the domain name itself, in the district where the registrar or registry is located. That kind of case can take the domain away, but it awards no money. (15 U.S.C. § 1125(d)(2)(A), (D)(i).)
If the impersonator is a rival or a former insider
Not every clone is run by an anonymous fraud ring. A competitor that copies your name and layout to catch your search traffic, or a former partner who keeps a mirror site running, is a defendant with an address and assets. Those cases move on a different footing: a demand letter, then a motion for an injunction, with unfair competition and contract claims alongside the federal ones. Account takeovers by insiders are covered on our page about social media handle disputes.
Warning customers and limiting the loss
Post a short notice on your real site and send it to your customer list, naming the fake address. Tell your bank and card processor. Keep a log of refunds, chargebacks, lost orders, and staff time, because that log becomes the damages evidence. If customers were tricked into sending money to a false account, our page on wire transfer fraud covers recovery steps.
What to bring to the first meeting
- The captures, page source, and registration details described above.
- Your trademark registrations and proof of when you began using the name.
- Customer complaints and a running total of losses.
- Copies of any takedown reports already filed and the responses.
Frequently asked questions
Someone built a copy of our website on a similar domain and is taking orders from our customers. How do we shut it down?
Preserve evidence first, then report the clone to its web host, registrar, and payment processor, and consider a domain complaint. If the operator can be identified and sued, a federal suit under the Lanham Act can transfer the domain and award damages. If only the domain can be reached, the court can transfer it but awards no money. California businesses can add state claims where the site collects customer information by posing as the company.
Can I sue someone for pretending to be my business online?
In most cases, yes. Federal law provides claims for false designation of origin and, where a look-alike domain is involved, cybersquatting. California's anti-phishing statute lets the owner of a web page or trademark sue a person who poses as the business online to obtain identifying information. Copied text and images support a copyright claim as well.
We cannot tell who registered the fake domain because the owner's details are hidden. Can we still sue?
Usually, yes. A California complaint may name unknown defendants under fictitious names, and courts can authorize subpoenas to the registrar, host, and payment companies to identify the operator. Federal law also permits a suit against the domain name itself when the registrant cannot be found, though that route yields only the domain and no damages.
Is impersonating a business illegal in California?
It can violate several California laws. Posing as a business online to collect identifying information is unlawful under Business and Professions Code section 22948.2, and credibly impersonating an actual person online to defraud is covered by Penal Code section 528.5. Both carry civil remedies, which is the side of these statutes our firm handles.
How long does it take to get a fake website taken down?
It varies with who hosts it. Reputable hosts and payment companies often act within days of a well-documented report, while a domain complaint or a court order takes longer. Where customers are being defrauded right now, a California business can ask a court for emergency relief at the start of a lawsuit.
Talk to a California brand protection attorney
If a fake site or account is trading on your company's name, call (909) 235-6116 or contact us online. Kolmogorov Law, P.C. is at 327 Magnet, Irvine, CA 92618, and represents businesses in Orange County, Los Angeles, and throughout California. Our IP litigation practice page describes the wider practice.
This page provides general information about federal and California law and is not legal advice. Outcomes depend on who the operator is, where the site is hosted, the strength of your mark, and the court.