Could scammers send email as your business today?
We test your domain’s SPF, DMARC and DKIM, and hunt for lookalike domains that could be used to send fake invoices to your customers.
The losses are real, and reported
Figures from government and industry bodies, linked to the source. Most cybercrime is never reported.
lost to business email compromise in reports to the FBI in 2025, the 2nd-costliest cybercrime type.
Source: FBI IC3 Internet Crime Report 2025lost by Australians to payment-redirection (fake invoice) scams in 2024, the only top-5 scam type whose losses went up.
Source: National Anti-Scam Centre, Targeting Scams Report 2024average self-reported cost per cybercrime report for an Australian small business. BEC fraud is the 2nd most-reported business cybercrime (15%).
Source: ASD’s ACSC Annual Cyber Threat Report 2024–25lost to invoice & mandate scams in the UK in 2025, with 68% of it taken from business accounts.
Source: UK Finance Annual Fraud Report 2026Minutes and a few dollars for them. A lost client for you.
A lookalike domain
They register a domain one letter off yours, or spoof your real domain if DMARC isn’t enforcing.
vs accounts@acmeplumbing.com
A fake invoice
Your customer gets a convincing email: “We’ve changed banks, please use our new account details.”
New BSB/Account: 062-xxx 1043xxxx
The money is gone
They pay the scammer. Funds move fast and are often unrecoverable, and the customer blames you.
Your invoice: still unpaid
“The scammer will either hack into the email system of the business or impersonate the business’ email address by changing as little as one letter.” ACCC, media release, 4 April 2024
From exposed to monitored in three steps
Scan free
Enter your domain. In about 10 seconds you see your impersonation risk score and the biggest gaps.
Get your full report
Add your email to unlock every live lookalike, your raw SPF/DMARC/DKIM records and plain-English fixes.
Monitor and get alerts
Choose a plan. We re-check your DNS and watch for new lookalike domains, and alert you when something changes.
Without an enforcing DMARC policy, many inboxes will accept email that fakes your exact domain.
Lists which servers may send as you, and how strictly receivers should treat everything else.
Cryptographic signing on common selectors (google, selector1, selector2, default, k1).
About 50 typo, homoglyph and TLD-swap variants of your domain checked for live DNS.
Example labels for illustration only. Run a scan to see your real results.
Email protection first. Your name protected everywhere.
Impersonators don’t stop at email. They hit your reviews, your social pages and even your credit file. Higher plans add the rest.
Email & domain protection
SPF, DKIM, DMARC and lookalike domain monitoring to stop fake invoices sent in your name.
Learn moreBusiness credit file correction
Review your company files with D&B, Experian Business, Equifax and others, and dispute inaccurate items.
Learn morePersonal credit report DIY kit
Education, identity theft steps and template letters for disputing inaccurate items yourself. Not available in the UAE.
Learn moreGoogle review protection
Monitoring, alerts, responses you approve, and flagging policy-violating reviews to Google with evidence.
Learn moreHacked Facebook/Instagram page recovery
Guided recovery via Meta’s official process, admin lockdown, impersonation reporting and 2FA.
Learn moreDark web & breach monitoring
Alerts when staff emails on your domain appear in known public data breaches.
Learn moreLookalike & phishing site reporting
Evidence-backed reports to registrars, hosts and Google Safe Browsing.
Learn moreFake social account reporting
Report impersonating profiles on Facebook, Instagram, LinkedIn, X and TikTok via official forms.
Learn moreStaff scam awareness training
Phishing and fake-invoice training plus authorised simulated tests.
Learn morePayment verification policy
Bank-detail change verification policy, call-back checklist and customer notices.
Learn moreWe don’t buy or write reviews, don’t promise removal of genuine reviews or accurate credit information, and can’t guarantee Meta or Google decisions. See the compliance notice below.
Stay ahead of impersonators
A one-off scan shows today. Monitoring catches new lookalike domains and DNS changes as they happen. Prices in USD, billed monthly, cancel anytime.
One domain, the essentials
- 1 domain
- Weekly DNS & DMARC checks
- Lookalike domain alerts
- Email alerts
- Payment verification policy & checklist
Growing businesses, up to 5 domains
- Everything in Starter, plus:
- 5 domains
- Daily monitoring
- DMARC report summaries
- Guided fix instructions
- Google review monitoring & alerts (1 profile)
- Review response drafts you approve
- Dark web breach alerts for staff emails
- Staff scam awareness training modules
- Personal credit report DIY kit (not in UAE)
Agencies & multi-brand, 25 domains
- Everything in Pro, plus:
- 25 domains
- Client-ready reports
- Review monitoring for up to 5 profiles
- Fake/policy-violating review flagging packs
- Business credit file correction support (company files)
- Hacked Facebook/Instagram page recovery support
- Lookalike & phishing site takedown reporting
- Fake social account reporting
- Simulated phishing tests
- Priority support
ImposterWatch Personal
Not a business? Protection for you and your family.
- Dark web breach alerts for up to 3 personal emails
- Romance scam checks
- Guided hacked Facebook/Instagram/personal account recovery
- Help reporting fake profiles impersonating you
- Scam awareness guides (romance, investment, parcel, bank impersonation)
- Identity theft action checklist
- Personal credit report DIY kit (not in UAE)
ImposterWatch reduces risk by finding gaps and alerting you. No service can guarantee that impersonation or fraud will never happen, that any review or credit item will be removed, or that Meta will restore access.
What you can count on
A real, named operator
Operated by Cloud Investments FZE, United Arab Emirates.
Secure Stripe checkout
Payments run on Stripe. Card details never touch our servers.
Public data only
Scans use public DNS. We never ask for your passwords.
Sourced, not invented
Every statistic links to its government or industry source.
Straight answers
What does the free scan check?
It reads your domain’s public DNS records: SPF, DMARC, DKIM (on common selectors) and MX. It also checks about 50 typo, homoglyph and TLD-swap variants of your domain to see which ones are live. It doesn’t touch your mailbox or need any access to your systems.
Why do you ask for my email?
The summary is free with no signup. Your email unlocks the full report (all live lookalikes, raw records and fix steps). We use it only for your report and ImposterWatch updates, and we don’t share it.
A lookalike domain showed up. Is it definitely a scammer?
Not necessarily. Some lookalikes are parked, owned by you, or belong to unrelated legitimate businesses. The report shows which variants are live so you can judge which ones could realistically fool your customers.
Can you guarantee we won’t be impersonated?
No, and nobody honestly can. Correct SPF, DKIM and an enforcing DMARC policy make exact-domain spoofing much harder, and monitoring tells you early when lookalikes appear. Staff and customer payment checks are still essential, which is why plans include a payment verification policy.
Do I need to be technical?
No. Reports are in plain English and Pro adds guided fix instructions for common providers like Google Workspace and Microsoft 365. You or your IT provider make the DNS changes; we never ask for your passwords.
How does billing work?
Plans are monthly in US dollars and paid through Stripe’s secure checkout. We never see your full card number. There’s no lock-in contract, and you can cancel anytime.
I’m an individual, not a business. Is this for me?
Yes. ImposterWatch Personal (US$9/month) covers breach alerts for your personal emails, romance scam checks, guided hacked account recovery, fake profile reporting and scam guides.
Who runs ImposterWatch?
ImposterWatch is an online-only service operated by Cloud Investments FZE, United Arab Emirates, serving clients in Australia, New Zealand, the UK, the US and the UAE. Credit information services for individuals are not available in the UAE.
Find out if you’re exposed before a scammer does.
Free, about 10 seconds, no signup needed.
Run my free scan