They use your company’s name to commit fraud: how to act and protect yourself

A furious supplier asks why your company has requested a payment to an account different from the usual one. A client receives an invoice with your logo that you never issued. A website identical to yours but with different bank details is circulating. In all these cases, someone is using your company’s name to defraud third parties.

The impersonation of companies to commit fraud has grown significantly, because digital tools make it possible to replicate the appearance of a legitimate company with great ease. The consequences for the impersonated company can be devastating: loss of reputation, breakdown of business relationships and claims by third parties.

Fraudsters use several techniques. Corporate phishing consists of registering an email domain almost identical to that of the real company, changing a letter or the extension, and sending communications requesting transfers to new accounts. The clone website replicates the design and services of the real company, but with different contact details and accounts, and fraudsters may even pay for advertising to position it. The impersonated supplier or client fraud targets the company itself by posing as one of its usual suppliers to report a change of bank account. And the use of the name on social media creates fake profiles to attract clients or sell non-existent products.

The impersonated company suffers several harms. The reputational harm is usually the most serious in the long term, because deceived clients and suppliers may initially hold the real company responsible. The direct financial harm materialises if the company pays into fraudulent accounts or bears the costs of crisis management. And the legal harm arises if the victims bring claims against the real company.

The impersonated company is the victim of offences that it can prosecute criminally. The most direct is the offence of fraud under Article 248 of the Criminal Code. The usurpation of civil status or the discovery and disclosure of secrets may also apply if there was unauthorised access to its systems, as well as the offences against industrial property under Articles 274 et seq. if its registered trademark or logo was used. In addition to the criminal route, the company may claim damages through the civil courts and request interim measures to take down the clone websites, as well as turning to the Spanish Patent and Trademark Office and to the digital platforms.

When the impersonation is discovered, speed is decisive. One must document all the fraudulent material, ideally with a notarial record; notify clients, suppliers and employees, through official channels, that an impersonation is taking place, with instructions for verifying communications; file an urgent police complaint; request the removal of the fraudulent content from the platforms; and consult a specialised lawyer.

As prevention, it is advisable to register the trademark with the Spanish Patent and Trademark Office, register domains similar to the main one, implement internal protocols requiring telephone verification for changes of bank account, activate the technical email protocols that make domain spoofing difficult and periodically monitor the appearance of the company’s name on the internet. As a general rule, the company whose name was used without its consent is not liable for the fraud, although it may have to prove that it played no part in it.