What a fake support reply on X looks like

A fake support reply on X shows up under a customer's complaint within minutes, uses a name and avatar close to yours, and moves the customer to a DM or a link. It's built to look helpful, so the tells are in the details, not the tone.

If you run support for a company whose customers move money, you've almost certainly seen these. Here's the anatomy, the tells to teach customers, and what to do about it. For the full response, see fake support account takedowns.

The anatomy of a fake support reply

1. The trigger. A customer posts a complaint that tags you: a stuck withdrawal, a locked account, a missing deposit.

2. The timing. A reply lands minutes later, often before your real team has seen the post. Many of these operations appear to watch for your brand name plus words like "stuck" or "locked".

3. The handle. Close to yours but not yours: an extra underscore, a swapped letter, or words like "help", "care" or "assist" added.

4. The display name and avatar. Your logo, and "Support" in the name.

5. The ask. "Sorry about that, please DM us" or "open a ticket here" with a link.

6. The page. A cloned login, a form asking for a seed phrase, or a "wallet validation" page that drains funds.

Five tells to teach your customers

• Real support will never ask for a password, seed phrase or 2FA code.

• Check the handle against the official one listed on our website.

• Look at the account: new, few followers, and posting nothing but replies.

• Any link that isn't on our own domain is suspect.

• A request to move to Telegram, WhatsApp or a private form is a red flag.

What your team can do in public

Reply under the customer's post, not to the fake: "That account isn't us. We'll never DM you first. Our official support is here," with the link. It protects the customer in the thread and everyone reading it. A page that lists every official account helps here, and we wrote up how to build a verify page customers can check.

Honestly, this is boring advice. It's also the part that changes outcomes for the person who already got the reply.

Then take it down

Report the account and file a trademark report if your mark is used. We walk through it in how to report business impersonation on X. Get the link it sends people to blocked in wallets and browsers, because that's where the money is lost.

Frequently asked questions

Why do fake support replies show up so fast?

Many operations appear to be automated, watching for brand names alongside complaint keywords. Speed is the whole trick: they answer before you do.

Should we limit who can reply to our posts?

That can hide replies from real customers too. A fast public reply from your team, plus takedowns, usually works better.

See which fake support accounts are replying to your customers today: run a free scan.

Nikita Varabei is co-founder and CEO of ChainPatrol. He spends most of his week with fraud and trust and safety teams dealing with impersonation of their brands.