What does brand impersonation cost? Sourced FTC, FBI and UK figures, the cost drivers for the impersonated company and a worksheet to estimate your own.
Quick answer: There is no reliable single figure for what brand impersonation costs a company, because the cost is spread across fraud losses, reimbursement, customer support, investigation, legal work and lost trust, and nobody reports those together. The best public numbers measure what victims lose: the US Federal Trade Commission says people reported losing nearly $1 billion to business impersonators in 2025, within $3.5 billion lost to imposter scams overall. For your own organization, the cost is best estimated from drivers you can count.
Below are the sourced figures worth knowing, what each one actually measures, and a worksheet for estimating the cost of impersonation of your own brand. For wider phishing numbers, see our phishing statistics 2026 page.
What the public data shows
FTC, United States. According to the FTC's release of 15 June 2026, people reported losing $3.5 billion to imposter scams in 2025, including nearly $1 billion to business impersonators, with the highest reported losses to bank impersonators, and about $920 million to government impersonators. These figures come from reports to the FTC's Consumer Sentinel network, so they count only what people chose to report.
FBI IC3, United States. The FBI's 2025 Internet Crime Report recorded 191,561 phishing and spoofing complaints with $215.8 million in reported losses, and $3.05 billion in reported losses from business email compromise, a fraud built on impersonating a colleague, supplier or trusted company. The categories overlap with impersonation but are not the same thing, and IC3 counts complaints, not incidents.
UK reimbursement rules. Since 7 October 2024, UK payment firms must reimburse eligible victims of authorized push payment scams made by Faster Payments or CHAPS, which include impersonation scams, up to £85,000 per claim, according to the Payment Systems Regulator. For banks and payment firms, that turns part of the victims' loss into a direct cost.
Why there is no single number
Figures quoted as "the cost of brand impersonation" usually mix different things. Before using any number, check three points:
- Whose cost it is. Victims' losses, the impersonated company's costs and society's costs are different measures. The FTC and IC3 figures above are victims' reported losses.
- What is counted. Complaints, reports, incidents and breaches cannot be added together or compared directly.
- Where it comes from. A figure without a named report and period should not be repeated. Many vendor surveys do not publish their method.
Most of the cost to the impersonated company is never published at all, because it sits inside ordinary budgets: support headcount, fraud operations, legal fees and marketing.
The cost drivers for the impersonated company
Customer losses and reimbursement
Where rules or goodwill lead you to refund victims, every successful fake login or payment page becomes a direct loss. Banks and payment firms face this most directly; retailers and carriers see it as refunds, reshipments and card chargebacks.
Support and fraud operations
Each live fake site generates calls, chats and emails from people asking whether a message is real, and from victims who need accounts locked, cards replaced or orders checked. Fraud teams review affected accounts and watch for follow-on attacks using the stolen data.
Investigation and takedown
Someone has to verify each site, capture evidence, report it to blocklists, hosts, registrars and CDNs, and follow up until it is gone. The work repeats every time the same kit returns on a new domain. Our takedown process guide shows the steps.
Legal and domain recovery
Recovering a domain that contains your trademark can mean a UDRP complaint. WIPO's published fees are USD 1,500 for one to five domain names decided by a single panelist and USD 4,000 for three panelists, before any lawyer's time. See how to file a UDRP complaint for when it is worth it.
Marketing and search
Fake ads that bid on your brand name divert traffic you would otherwise get for free and can push up what you pay for your own brand terms. Our guide to fake bank ads on Google covers reporting them.
Trust
The hardest cost to measure: customers who stop opening your genuine emails, abandon a real payment page because it looks like the fake one, or hesitate before signing up. It shows up indirectly, in conversion rates and complaints.
How to estimate the cost for your own brand
A rough estimate built from your own data is more useful than any industry average. Take the last twelve months and fill in:
- Cases. The number of fake sites, lookalike domains, fake accounts and fake ads you found or were told about.
- Direct losses. Reimbursements, refunds, chargebacks and write-offs your fraud team linked to impersonation.
- Support load. Tickets and calls tagged as fake messages or sites, multiplied by your internal cost per contact.
- Response time. Staff hours per case from first report to confirmed removal, multiplied by the number of cases. Time a few real cases rather than guessing.
- Legal and external fees. Counsel, UDRP filings and any outside services.
- Exposure window. How long each fake site stayed live. Costs grow with every day a site is reachable, so this is the number most worth reducing.
Add the first five for a floor. The real figure is higher, because unreported victims and lost trust are missing from it.
How to bring the cost down
Almost every driver above grows with the time a fake site stays live, so speed matters more than anything else.
- Get blocklist warnings first. A browser warning protects visitors before the content is removed. See how long a phishing takedown takes.
- Detect earlier. Monitor new lookalike domains and certificates so you can act before the first text goes out.
- Make genuine channels easy to verify. Publish your official domains and contact routes, and enforce DMARC.
- Make response cost predictable. Per-takedown pricing makes a large campaign expensive. Phishvoid uses one all-inclusive subscription with unlimited takedowns, quoted after a demo, so a busy month does not change the bill.
For the full range of defenses, read brand impersonation protection.
FAQ
How much does brand impersonation cost businesses?
No reliable public figure covers the costs borne by impersonated companies. The best data covers victims: the FTC says people reported losing nearly $1 billion to business impersonators in 2025. Each company has to estimate its own cost from losses, support, response and legal work.
Who pays when a customer is scammed by a fake version of our site?
It depends on the country, the payment method and your own policy. In the UK, payment firms must reimburse eligible victims of authorized push payment scams made by Faster Payments or CHAPS, up to £85,000 per claim. Elsewhere, the cost may fall on the victim, the card issuer or the company as goodwill refunds.
Is a UDRP complaint expensive?
WIPO's fee is USD 1,500 for one to five domains with a single panelist, plus legal costs if you use counsel. It is worth it when you need to own the domain, not when a suspension would solve the problem.
What is the fastest way to reduce the cost of impersonation?
Shorten the time each fake site stays live: detect early, get browser warnings in place and keep following up with the host and registrar until the site is gone.
Is someone impersonating your brand?
We find lookalike domains and cloned pages and take them down. Start with a free exposure scan.