X (Twitter) Support Impersonation: Evidence and Escalation Playbook
A reply under a brand’s post can copy its support name and direct customers into a fake recovery conversation. Compare the full X handle with the brand’s published support account.
Check the reply and destination
- Compare the exact handle and profile URL with links from the brand’s own website.
- Open the published support page independently and compare domains with those in the reply or message.
- Read account and reply history for context. Confirm an unexpected request through the established support channel.
- Do not provide passwords, login codes or a direct payment to an account offering recovery in a message.
Give the report the full conversation
- Save profile and reply permalinks, message screenshots and capture times.
- Include the external destination and the official support reference used for comparison.
- Report the account and harmful replies. If customers are being targeted, publish the correct support route from the brand’s established account and record related lookalike handles.