Someone copied my shop's Instagram profile photo and started taking deposits

Pooya · 10 Aug 2026

A customer sent me a screenshot in July asking whether she should transfer the deposit to the card number "we" had sent her. I had sent her nothing. Somebody had built an account with my shop's name, my logo as its profile photo, and eleven of my own photographs reposted in order, and had been messaging people who commented on my posts.

She had not paid. Two other people had.

What the fake account got right, and what it did not

The handle was my handle with an underscore added. That is the ordinary pattern: fake accounts use a name close to yours with small changes — an added number, an underscore, a doubled letter — because the real handle is taken and the eye skips over the difference.

The bio was mine, word for word. The posts were mine, in order, which is why they looked convincing in a feed.

The profile photo was mine too, and that is where it came apart.

The check that took thirty seconds

My shop logo is text on a dark background — the shop name in small type above a line drawing of a hand plane. Text is unforgiving when an image has been through the wrong pipeline.

Instagram publishes a profile photo to visitors at 320 by 320 pixels. That is the ceiling for anybody outside the account, whatever a site advertising "HD profile pictures" tells you. Whoever built the fake account had screenshotted my photo from a phone screen, where it renders at 110 pixels across, then scaled it up to fill the frame.

So I opened both at the published size, side by side. Mine was sharp enough to read the small text under the plane. Theirs was the same image with the edges of the letters smeared, because upscaling adds pixels and cannot add detail. Once you have seen the two together it is not subtle.

That is now the first thing I check, and I would suggest it to anyone with a logo rather than a face as their profile photo. A copied logo is almost always a degraded logo.

The other signals, in the order I checked them

The follower shape. The fake had 604 followers and was following 3,900 accounts. Nothing legitimate looks like that. It had been mass-following people who engage with my posts, which is also how it found my customers.

The posting history. Eleven posts in four days, all of them mine, all posted within one afternoon and backdated by nothing. Real accounts do not arrive fully formed.

The audience underneath. I ran the handle through the same audience quality check I use on myself. It scored 19. The signals it flags — engagement far below the band for the size, comments almost absent, a following list wildly out of proportion — describe a bought audience, and they describe a four-day-old impersonation account just as well.

Reverse image search. Dropping the profile photo into a reverse image search returned my own account and my own website. This is standard advice and it works, though in my case the logo comparison had already settled it.

What to record before you report

I lost time here by reporting first and documenting afterwards, and the account was taken down before I had a copy of anything. That sounds like a good outcome and was not: the two customers who had paid needed evidence for their bank, and I had screenshots of my own outrage rather than of the account.

Do this first. It takes four minutes.

• The profile URL, written down as text, not as a screenshot of an address bar.
• Timestamped screenshots of the profile, the bio, the follower counts and each message the account sent.
• The profile photo saved as a file, at the size Instagram publishes it.
• A one-line description of what was copied — logo, name, posts, all three.

Then report it through Instagram's own flow. The three dots, Report, then "Pretending to be someone else", then the option for a business you represent. Red Points has a decent walkthrough if you have not done it before. Instagram's own flow is faster and more effective than any third-party service that offers to do it for you, and it is free.

What I changed on my side

I pinned a post saying the shop never asks for a deposit by direct message and never sends card numbers, and I repeat it in stories every few weeks. It feels excessive. It is the single thing that would have stopped this.

I also stopped assuming the risk scaled with size. This is a woodworking shop with 13,410 followers. I had read about brand impersonation as something that happens to large accounts, and the truth is that a small local business with customers who trust it is a better target than a large one, because the customers are individually reachable and the shop is not watching.

The measuring habit I picked up after the May sweep turned out to be the useful part. I knew what my own numbers looked like, so a profile claiming to be me with the wrong ones was obvious within a minute.