Millions of dollars are lost each year from counterfeit products around the world.

While many companies attempt to combat counterfeiting by merely measuring the number of web removal metrics, the actual threats to consumers are growing exponentially. In this guide, we will provide the exact brand protection framework necessary to identify, quantify, and eliminate the threat of counterfeiting from digital marketplaces, websites, email, and social networks.

Why Takedown Metrics Do Not Equal True Brand Protection

A count of removed URLs is not synonymous with brand protection. A few hundred URLs may appear on a takedown report generated by monitoring software, but when the senior management team views a dashboard displaying these numbers, they are led to believe that the issue has been resolved. This is a dangerous misconception and serious operational mistake.

When the takedown report indicates that 1,000 counterfeit product listings have been removed, but the first page of the Amazon search results still contain counterfeit products, then the customer's exposure to these counterfeit products has not changed.

To effectively protect one's brand, we need to shift our focus away from raw metrics of activity to an exact percentage of consumer-visible listings that violate your rights within the search category that you have defined. This is referred to as infringement saturation. Until the saturation is reduced, your current enforcement strategy is failing. There is wide consensus among competitors and vendors that true brand protection goes beyond just legal work for trademarks.

It is an ongoing coordinated effort involving legal rights, technical controls, monitoring, investigating, and reporting across all areas of the internet. Companies need to create a unified enforcement system that integrates each of these elements within legal, security, ecommerce, marketing, and customer support departments.

How to Build a Measurable Brand Protection System

Assigning Team Responsibilities

Any program that does not assign a cross-functional owner will fail immediately.

Though a legal team may understand trademark law well, it is not fast enough to stop a phishing server as a security team can do. A security team may be able to stop a fake website from being used. However, a security team does not understand commercial nuances of a grey-market distributor in the regional marketplace.

The first step is to have an executive sponsor oversee a unified workflow and assign direct accountability to teams based on threat channels. The e-commerce team must be responsible for leaking across marketplaces and unauthorized sellers, while the security and fraud teams have a responsibility to protect against phishing domains and email spoofing.

The legal department continues to retain control over complex trademark disputes and physical counterfeit escalations. Without this clear division of labor, alerts will sit in queues as teams internally argue who has the authority to approve the response.

Listing Your Assets and Rights

To protect against any potential risk, first and foremost, an accurate inventory of corporate assets must be built. A comprehensive corporate asset inventory system must include each corporate asset's corporate name, trade names, registered trademarks, product names, logos, packaging designs, and owned domain names.

The inventory should include all items and not just name identifiers. A full listing should include the names of all the executive staff members, as well as all products in a corporate library, and a full list of third-party authorized sellers.

When a bad actor launches a clone site, the response team cannot waste valuable time requesting a trademark registration number from the legal department; they must have such information available for immediate use as evidence.

Defending Against Threats on Specific Digital Channels

Stopping Marketplace Counterfeits and Product Leaks

Digital marketplaces provide consumer brands with a great risk exposure, especially Amazon, eBay, Alibaba, Temu, and TikTok Shop. Attackers frequently steal pictures from the brand's website and create counterfeit listings on digital marketplaces at a lower price, stealing their sales from the brand.

Recently, Amazon's Counterfeit Crimes Unit took legal action against over 24,000 counterfeiters and made many criminal referrals. They say that their technology automatically blocks millions of suspected infringers from their marketplace every day. However, no marketplace will ever be able to self-police a brand's sales, so brands must take active measures to protect their sales on digital marketplaces, such as registering through Amazon Brand Registry, Amazon Transparency, and Project Zero.

Brands must also separate counterfeit products from unauthorized grey market products.

For counterfeit products, a brand should immediately send in a notice of infringement to the online marketplace for takedown of the potential infringer. For grey market products, a brand should conduct a commercial investigation into its own supply chain leaks.

Stopping Fake Websites and Domain Abuse

Attackers also register almost identical domains to your domain.

This practice is called typosquatting, where they create a web address that has almost the same spelling, but either has a typo in it or adds additional words, or uses letters/characters from a different alphabet. An attacker who has created an identical domain will build a duplicate of your checkout page or sign-in page. The attacker can then run ads through paid search to drive traffic to the counterfeit infrastructure set up.

Therefore, all security teams need to monitor for suspicious domain registrations at least once a day as part of their brand protection routine to identify potential clone pages collecting credit card data. If a page is identified, it presents an emergency incident that must be dealt with immediately.

The team needs to ensure that all evidence is submitted to the hosting provider and domain registrar within hours so that the infrastructure can be shut down.

Fighting Social Media Impersonation and Fake Ads

The rise of social media commerce has created new opportunities for abusive behaviours by bad actors. They create fictitious social media accounts that replicate your exact logo and brand name on Meta, Instagram and TikTok. These fake social accounts promote "too good to be true" discounts through the use of false advertisement services. When someone clicks on an advertisement originating from one of these fake social media accounts, they are redirected to a fake online web store.

To properly address these accounts and their associated actions, you need to actively monitor for exact name matches, phonetic variations and hijacked user-generated content on social media.

Taking down the creation of the final web store is not enough to prevent traffic from being directed back to the original source. You must identify each fake social account and report each fraudulent advertisement to the original platform administrator to break the chain.

Blocking Email Spoofing and Executive Impersonation

Another common method used by bad actors to impersonate a founding member, financial lead or recruiter is through email, LinkedIn and WhatsApp. They contact the victim with requests for fake payments, credentials or data from applicants.

It is essential that you have safeguards in place to verify the authenticity of any email correspondence you may receive using email authentication. Unfortunately, there is much misinformation about email authentication, especially with respect to its limitations. Email authentication is created by means of protocols such as SPF, DKIM and DMARC, and is designed to provide safeguards to your legitimate domains.

Companies like Allure Security, Valimail and Red Sift advocate strongly for the implementation of email authentication.

However, DMARC only verifies emails using your actual domain, which means it cannot stop an attacker from using a different domain and entering your CEO's name into the sender field. DMARC also cannot prevent the use of lookalike domains that are fully controlled by an attacker. To properly detect external threats you must monitor them separately from your emails as well as separately from your internal setup.

Validating Threats and Collecting Evidence

Setting Detection Rules Without Relying on AI Magic

Constantly promoted by software vendors as "the way to go," AI and automation will "solve all your detection problems"; however, they are actually changing the economic model of production for impersonation (impersonating a person), making it possible for attackers to create fake social asset libraries and generate fake reviews at lightning speed.

Thus, AI by itself does not become an enforcement strategy. You need to define very specific rules for your software to abide by in order to successfully enforce compliance and to maintain compliance with other established laws and regulations. You must detail what data sources you will accept as a valid data source, how often you want your website to be crawled, and what languages or regions you want to cover.

Most importantly, you must document which alerts need to be validated by a human.

If you rely solely on automated enforcement based on suggestions from an AI system, you will eventually end up issuing false takedown requests against legitimate distributors, customer commentaries, and reviews that are fair and lawful uses. Over-enforcement creates significant internal friction within your organization and damages your relationship with your commercial clients.

Building a Strong Evidence Chain

When you file a takedown request with a marketplace or web host, if your evidence does not have sufficient strength, your takedown request will be denied. Therefore, with each evidence type you submit, you need to create a standardized and repeatable evidence package.

An adequate evidence package includes the exact URL of the offending website, the specific ID of the seller account in violation, time-stamped screenshots of the offending website, and a thorough explanation of how the seller's actions violated your company's policies. Additionally, you need to include your official trademark registration details. In order to successfully enforce compliance, you must demonstrate that the offending product violated the specific rules established by the marketplace or web host.

Weak evidence packages lead to higher rates of rejected claims, which cause delays in the removal of the offending products from the marketplace. Evidence from persistent threat networks must be maintained using strict chain-of-custody standards by the teams.

Evidence may need to be used for a future civil action or law enforcement referral. Therefore, it is paramount that it is maintained correctly, and it must be available for some form of follow-up.

Prioritizing Threats with a Risk Score

Moving Beyond Handling Alerts in Order

Most internal teams handle alerts in the same way as they come in, which creates a significant operational failure. "Prioritize high-risk threats" is often seen as an industry best practice, but it is rare to find specific scoring variables to assess a threat's risk level for brand protection.

In order for teams to prioritize which alerts should be acted upon, they require a documented mathematical score calculation to determine which may have more impact on the overall business. This should help ensure teams do not spend valuable resources acting on alerts that are relatively simple, small, or may not provide a direct monetary return.

A scoring model is a method of multiplying the individual risk factors of each incident to create a functional risk score. It is recommended that priority is calculated based on four risk factors:

• Customer harm

• Revenue exposure

• Total visibility of the threat

• Legal confidence in the evidence supporting the incident

Each risk factor's score is assigned as either 0, 1, 2, 3, 4. Security and fraud teams should focus on the incidents with the highest totals.

Priority 1: Immediate Action Required

Any incident that scores in the highest tier will require an immediate response (e.g., a clone checkout page or executive impersonation).

Incidents that fall within this tier will not be subject to a legal review. The security and fraud teams must respond through technical channels to mitigate the potential of loss (e.g., contacting the host registrar, using platform abuse reports, issuing immediate warnings to customers that have been affected by a clone checkout page).

Priority 2: Urgent Action Required

Any incident scoring in the second tier will require action to be taken within one business day (e.g., counterfeit listing of a high-visibility product found ranking on the first page of a major marketplace and a fraudulent paid ad directing large traffic volumes to a scam website). Loss of revenue and immediate damage to a brand due to the threat posed by counterfeit products can come from multiple sources and areas of concern for brands and sellers.

Some of these areas also fall under the umbrella of marketplace activity where counterfeiters often act in an unprofessional manner. These are typically considered to be violations of the seller policy or commercial review processes in many marketplace situations unless otherwise certified. The action plan for these areas includes using enforcement portals to combat counterfeit activity through various means such as taking down listings from sellers or removing their accounts.

The second part of the action plan is to establish a link between the counterfeit sellers and the larger networks that support them. This will help mitigate future threats by preventing the counterfeit sellers from continuously submitting new listings for their fake goods after being identified.

Priority 3 and 4: Standard Response and Commercial Review

As we continue to track support issues related to counterfeit activity as a priority, priority 3 and priority 4 items can vary based on their level of urgency and likelihood of potential sales to the customer. Priority 3 items typically include cases where an individual created a fake social account with little to no traffic volume, has an isolated trademark infringement issue, or is involved in a dispute over reseller policy with a vendor.

All of these cases require a response within three to five business days depending upon the urgency and likelihood of impact to sales for the brands associated with the counterfeit activity. An example of a priority 4 issue is where there is ambiguity around the legality of the actions taken by an entity, whether the action taken is against a distributor or in violation of a trademark requirement, due to the ambiguity created by the third parties involved in a contract dispute with the brand and sellers.

In those situations, they should be escalated to the commercial and legal teams for a deeper review of the contractual obligations. This must happen prior to taking any technical action against a legitimate partner for misrepresenting a trademark or reselling goods incorrectly.

The Problem With Time-Based Performance Metrics

When tracking outcomes from vendors, they suggest tracking outcomes based on time. However, many do not provide a model that defines the manner in which they derive estimated revenue benefit from recovered revenue. Tracking and reporting using time-based metrics provides validation of the positive impact of operational systems on reducing counterfeiting and increasing sales recovery through multiple data points, including:

• Measurements of Time to Detection: Time between identification of threat by your company and the moment the system identifies the threat. This provides evidence of the extent of the monitoring support available to you in combating counterfeit activity.

• Time to Submission: Time taken to open the case to the time taken to submit the complaint to an enforcement portal. This illustrates an internal processes bottleneck that may prevent timely response to verification of counterfeit activity. It allows brand owners to identify opportunities to improve their internal processes to maximize their protection from counterfeit activity.

• Time to Remove: This measures the entire length of time from detection to confirmed takedown and is a point of emphasis for some vendors, such as BrandShield, in the number of takedowns they have performed. This is because slow takedowns allow the infringing party to gain profit during this time period.

Measuring Infringement Saturation and Repeat Sellers

Data on the amount of infringement remains unchanged even though there are an excessive number of takedowns.

The best way to measure this is by measuring the first-submission success rate, which shows how many times they have taken action against infringing parties without an appeal. The lower the success rate, the poorer the quality of evidence provided or the misunderstanding of the platform rules. Tracking the recurrence rate and repeat seller rate is much more important than counting the number of takedowns.

If you take action against an infringer and they upload the same product three hours later under a different name, it means that your enforcement measure was a waste of time. A large recurrence number shows that your enforcement measure disrupted one digital asset but did not disrupt the infringer behind the computer. Tracking the saturation rate is a focal point of platforms such as MarqVision and not simply the number of times an enforcement action has been taken.

True Cost Avoidance Versus Fake Revenue Recovery

The only way a finance stakeholder will believe what you say regarding recovery of revenue or the cost of recovering affected revenue is with credible attributions of non-inflated revenue. Most software vendors have fake revenue recovery dashboards, claiming they recovered millions of dollars from the removal of malicious sites.

This is mathematically impossible since taking down a fake ad does not create an instant opportunity for those users to purchase the original product. To determine a reasonable estimate of the cost estimated from threat, you need to keep track of revenue exposure. Do not refer to the recovered revenue and instead, consider outlining the cost avoidance realized by the initiatives of your enforcement strategy.

You will want to account for the time spent on employee workforce procedures, legal expenses, customer service support, refunds processed for customers that resulted from enforcement actions you took, and chargebacks related to fraud that were prevented as a result of your enforcement program.

Evaluating Software for Monitoring and Takedowns

The abundance of software creation materials has created a marketplace that is so convoluted with vendor sales pitches, which are often found on review sites such as Gartner Peer Insights and Expert Insights. Each vendor offers their version of an enforcement or enforcement-related product offering based on the way they have created their own product.

Some of these vendors include, but are not limited to, ZeroFox, Netcraft, MarqVision, and BrandShield.

When evaluating different vendor offerings, you will want to carefully consider how the vendor provides access to their platform and the vendor's ability to act as a trusted reporter for your organization. Do not simply ask the vendor how many alerts their software generates; instead, ask the vendor for the average time it takes them to remove infringing products from those platforms where your organization loses the greatest amount of revenue. A luxury retailer has different enforcement requirements than what a B2B software corporation would require.

The overall scores that you will be provided with from the various vendors as part of their platform evaluation will therefore be completely misleading, as it does not accurately account for these significant distinctions.

Establishing Implementation Limits

The vast majority of vendors do not accurately represent how the day-to-day usage of the software will involve a certain amount of friction when it comes to enforcing the takedowns of infringing products. Several factors play into the problems associated with enforcement: the geographic coverage maps, the languages that are available to utilize with the software, and the legal jurisdictions of your trademarks.

If a vendor is unable to perform takedowns in the language spoken by the marketplace you target, then you cannot use the vendor's tool in that marketplace. Prior to signing a software contract with a vendor, assess your company's current capability to utilize the vendor's offerings and identify possible areas where you may have issues with regard to escalation of legal matters within your company.

For instance, if the vendor's software produces 500 alerts with high confidence each day and your internal team only has the ability to process and approve 50 alerts per day, the vendor's software has many more features than your company's current ability to utilize the vendor's offerings.

The First 90 Days of Active Enforcement

Stop attempting to maximize the number of removals you are receiving through software that you have chosen but do not effectively reduce the actual visible consumer risk of your brand on large-volume e-commerce marketplaces such as Amazon, eBay, etc.

If your vendor continues to provide you with the reports, then you should strongly consider replacing the vendor rather than continuing to pay for a service that does not meet your needs or helping you implement an effective enforcement program.