The FTC's Rule on Impersonation of Government and Businesses, 16 CFR Part 461, took effect April 1, 2024. It makes impersonating a business, a government agency, or their officers a violation the FTC can take directly to federal court, seeking money back for victims and civil penalties of up to $53,088 per violation. Since it took effect, the FTC has completed 14 enforcement actions worth more than $80 million in consumer redress.
Impersonation was already illegal before 2024. What changed on April 1, 2024 is what the FTC can do about it. Before the rule, the agency had to prove a violation of the FTC Act first, then seek relief in a separate proceeding. The Impersonation Rule, codified at 16 CFR Part 461, makes impersonation of a government entity, a business, or their officers a standalone rule violation, which means the FTC can go straight to federal court and ask for money back for victims plus civil penalties.
The numbers since then are the measure of whether it works. The FTC has completed 14 enforcement actions under the rule, resulting in more than $80 million in redress for consumers. In September 2026 it announced it was seeking public comment on whether to update the rule or write a new one aimed at the platforms that promote impersonation scams, with comments due November 30, 2026.
The rule reaches the classic scams first: a fake account posing as a real company, a spoofed website, a phishing email from a lookalike domain. It also reaches the newer methods, including cloned voices and synthetic likenesses used to make the deception convincing. The FTC wrote it that way deliberately, because the same impersonation that used to need a call center can now be done with a voice clone and a spoofed number.
What it does not yet cover is impersonation of private individuals. The rule as written covers government and businesses only. A supplemental proposal to add individuals is pending: the FTC held an informal hearing on January 17, 2025 and has not finalized it. That gap matters for brands, because the most damaging impersonations right now are often of a named executive, and those sit in the gap until the proposal lands.
The cases the FTC has brought since early April 2025 show the shape of the problem. MediaAlpha was charged with deceptive government-affiliation claims by an online lead generation firm in the health insurance market. Innovative Partners faced similar claims over marketing healthcare plans. The largest case is Credit Glory, an alleged sham credit repair scheme that impersonated debt collection entities and creditors and took $200 million from US consumers, including military servicemembers. In August 2026 a federal court temporarily halted the scheme and froze its assets at the FTC's request.
The agency has also gone after the infrastructure. In response to FTC letters, registrars took down 19 websites impersonating the FTC itself, including fttc.us, FTC-Support.org, and federaltradecommission.net. Each fake account or spoofed domain can constitute a separate violation, so the $53,088 per-violation penalty multiplies fast across a campaign. The enforcement cases so far have targeted the fraudsters, not the impersonated brands, which is the point: the rule is a weapon for the brands being copied, not a liability for them.
Report impersonation the moment you find it, through the FTC's ReportFraud site and through the platform hosting the fake account. The rule gives the FTC a direct path to court, but it still needs the complaint to start the case, and the cases that move fastest are the ones with a clear record: screenshots, URLs, dates, and the losses customers report.
Then make the real thing easy to verify. Publish the domains you actually operate, the email addresses you actually send from, and the payment details you actually use, in one place customers can find. Most impersonation works because the customer has no reference point for what real looks like. A brand that publishes its own canonical contact details gives every customer a check that takes ten seconds, and gives the FTC a cleaner case when the fake appears.
For the background behind “The FTC Impersonation Rule: What It Changed for Fake Brands”, these earlier guides help: Fake Ticket Listings: The Resale Checks That Catch Most Scams, Fake Charity Scams After a Disaster: How to Check Before You Give, and Counterfeit Listings on Marketplaces: How to Report Them, and What Actually Gets Taken Down.
It is the FTC's Rule on Impersonation of Government and Businesses, 16 CFR Part 461, in force since April 1, 2024. It makes impersonating a government entity, a business, or their officers a violation the FTC can take directly to federal court, seeking money back for victims and civil penalties of up to $53,088 per violation.
Up to $53,088 per violation, and each fake account or spoofed domain can count as a separate violation. Since the rule took effect, the FTC has completed 14 enforcement actions resulting in more than $80 million in consumer redress.
Not yet. The rule as written covers government and businesses only. A supplemental proposal to add impersonation of individuals is pending after an informal hearing in January 2025, but it has not been finalized.
Report it to the FTC through ReportFraud and to the platform hosting the fake account, with screenshots, URLs, and dates. Publish your real domains, email addresses, and payment details in one place customers can find, so they have a ten-second check against the fake.