United States
The FTC Impersonation Rule: what it lets you do when your brand is spoofed
The FTC’s Trade Regulation Rule on Impersonation of Government and Businesses (16 CFR Part 461), effective April 1, 2024, gives the FTC the power to seek civil penalties and consumer redress against impersonators directly. It puts no compliance obligation on your business — what it gives a spoofed brand is a federal enforcement lever, and monitoring is how you feed it.
Last reviewed: July 20, 2026
- Apr 1, 2024
- the FTC Impersonation Rule (16 CFR Part 461) took effect
- Source: FTC
- $53,088
- maximum civil penalty per violation available against impersonators under the rule
- Source: FTC
- US$2.95B
- in reported impersonation-scam losses in a single year
- Source: FTC
Most anti-scam regulation abroad works by putting duties on regulated businesses. The FTC Impersonation Rule works the other way: it makes impersonating a business or government agency an unfair or deceptive practice the FTC can act against directly, with civil penalties of up to $53,088 per violation. That distinction matters for honest positioning — there is nothing here your business must comply with, and anyone selling "Impersonation Rule compliance" is stretching it. What the rule changes is what you can do about the people impersonating you: report them, support enforcement, and document the impersonation with evidence that holds up. Against a backdrop of $2.95 billion in reported impersonation-scam losses in a single year, that lever matters.
A remedy lever, not a duty
The rule prohibits impersonating businesses and government agencies in commerce — fake websites, spoofed domains, lookalike branding used to deceive. Its obligations fall on impersonators, not on the brands they copy: there is no compliance checklist here for your business, and we will not pretend otherwise. What it does is let the FTC seek civil penalties and consumer redress against impersonators directly, where it previously had slower, weaker tools. The FTC used it actively in year one, bringing five enforcement cases and shutting down 13 websites that impersonated the FTC itself.
What the rule lets a spoofed brand do
Three things, concretely. Report: impersonation of your brand can be reported to the FTC, and rule-backed enforcement gives those reports somewhere to go. Support enforcement: penalties and redress require showing what the impersonator did — brands that can hand over clean, timestamped evidence make cases easier to bring. Document: a preserved record of the impersonating domain, its content, and its infrastructure is what turns "someone is spoofing us" into an actionable file.
Where monitoring fits
You cannot report or document an impersonation you have not found. Continuous detection of lookalike domains and cloned pages surfaces the impersonation while it is live — and captures the evidence (screenshots, DNS, WHOIS, certificates) before the site disappears or moves. That evidence pack serves double duty: it supports takedown requests to registrars and hosts today, and enforcement referrals when they are worth making.
How impersona.io helps
impersona.io generates 180+ permutations of your domain — typos, homoglyphs, combosquats, extra TLDs — and checks each against live DNS and domain-registration data, then captures a takedown-ready evidence pack and alerts you when a new lookalike or certificate appears. Pricing is transparent and self-serve — you pay in USD at checkout — and your first brand check is free.
Frequently asked questions
Does the FTC Impersonation Rule impose obligations on my business?
No. The rule prohibits impersonation; its obligations fall on impersonators. If your brand is being spoofed, you are the victim the rule protects, not the regulated party. There is no "Impersonation Rule compliance" for a legitimate business — be wary of anyone selling it.
What does the rule actually change?
It makes business and government impersonation an unfair or deceptive practice under 16 CFR Part 461, letting the FTC seek civil penalties of up to $53,088 per violation and consumer redress against impersonators directly. It took effect on April 1, 2024, and the FTC brought five enforcement cases under it in its first year.
How does monitoring help if there is no compliance duty?
Because the rule is a remedy, it only works for brands that detect and document impersonation. Continuous monitoring finds the spoofed domain while it is live; evidence packs preserve what it looked like and how it was set up. That is what feeds FTC reports, takedown requests, and enforcement.
impersona.io is EU-hosted — does that matter for a US company?
For most US buyers it is a non-issue. Your data is stored and processed in the EU (Frankfurt), encrypted in transit and at rest. If your organization specifically requires in-region US hosting, tell us — we would rather be upfront about current limits than overpromise.
Do I have to talk to sales?
No. impersona.io is fully self-serve with transparent pricing — you pay in USD at checkout via Stripe Adaptive Pricing — and your first brand check is free, no demo call required.
Other regions
See your own exposure first
Your first brand check is free. It generates roughly 160 permutations of your domain and checks them against live DNS and domain registration data.