Someone is selling trips under your agency's name: the takedown

A fake page using your agency's name is live right now, running Dubai or Bali offers you never quoted and collecting advances from people who think they're paying you. It copied your reels, team photos and logo. Clients find out when a stranger calls your real number asking why "their booking" isn't confirmed.

You cannot stop someone cloning a public page, but you can shorten its life and build a paper trail that keeps victims' anger off your desk. Check Point Research counted 47,318 new travel-related domains registered in May 2026, one in every 112 already classed malicious or suspicious (no India breakdown given), as reported by ITVoice. This playbook gives you the evidence drill, every takedown route, the client notice, a victim-call script, a hacked-page drill, and a weekly check.

The first 30 minutes: capture the evidence before anything comes down

Screenshot and log everything before you report anything. A platform must preserve removed content for 180 days under India's IT Rules, for investigation by police and courts, not for you (IT Rules, as quoted by the Kerala High Court). Report first and your own record may end up thin.

Evidence log - one row per sighting
Date/time seen (IST), platform, handle/URL:
Ad Library link, if running paid ads:
Website registrar (from a WHOIS lookup):
Phone/WhatsApp numbers and UPI IDs shown:
Assets copied (reel/photo/logo), your original's upload date:
Screenshot file name(s):
Victim: first name, date, amount, consent to share (Y/N):
Reports filed: route, date-time, reference, response, date removed:

Get a victim's consent before keeping their payment screenshot. You'll reuse these rows below.

Every takedown route, what it needs, and how fast it moves

No single complaint ends a clone; file every route that applies, in parallel. Accurate as of October 2026.

Route	Use it for	What it needs	Clock
Meta impersonation/IP report	Fake profile, or reels/photos/logo reposted (identity policy, IP report)	Report as impersonation in-app, or file Meta's IP form	Not published
Platform Grievance Officer	Removal demand with a legal clock	Complaint naming impersonation and deception	24h ack, 36h resolve
Registrar or .in abuse desk	Lookalike website, found via WHOIS	Phishing evidence to the abuse contact (ICANN RAA s.3.18)	ICANN registrars: confirm, act promptly; .in: no timeline published
Chakshu	Fraud call, SMS, WhatsApp or link received	Report within 30 days (Chakshu)	Analysed; links (beta) go on a suspect list
NCRP	Your own dated record, even with nothing lost	Agency and fake's details (I4C)	Tracked online

Complain as impersonation, not trademark, to get the 36-hour clock

Lead your Grievance Officer complaint with impersonation and deception, not trademark: the two sit on different clocks. Under the IT Rules as amended in February 2026, a removal request on most rule 3(1)(b) grounds must be resolved within 36 hours, but one on a patent, trademark or copyright ground is carved out and gets the ordinary 7-day window (Kerala High Court, quoting rule 3(2)(a)). Impersonation is a listed ground under rule 3(1)(b); lead with it, adding copyright on your reels second.

Example: Say you email the Grievance Officer at 11:00 Monday on the impersonation ground. Acknowledgement is due by 11:00 Tuesday, resolution by 23:00 Tuesday, 36 hours later. On a trademark ground alone, the 7-day limit applies instead: by 11:00 the following Monday. If the officer rejects it, appeal to the Grievance Appellate Committee within 30 days of the decision, or after 30 days with no reply.

Don't expect a writ petition to be the quick route either: in May 2026 the Kerala High Court dismissed one asking it to make platforms remove allegedly defamatory YouTube videos, and left the petitioners to their civil and criminal remedies.

Kill the website at the registrar and the host

Report a lookalike booking site to its registrar first. Run a WHOIS lookup to find the registrar, then send evidence to its abuse contact; every ICANN-accredited registrar must confirm receipt and act promptly on actionable phishing evidence (ICANN RAA s.3.18). For a .in domain, send it to abuse@registry.in under NIXI's anti-abuse policy, with no published timeline.

Behind Cloudflare, report it there too: it forwards your complaint to the operator and host rather than removing content itself (Cloudflare). Also file a Google Safe Browsing report, which can get browsers warning visitors before the site comes down.

Getting the domain itself transferred is a slower dispute, needing proof that it's confusingly similar to your mark, that the holder has no legitimate interest in it, and bad faith. For a .com, WIPO's UDRP fee for up to five domains is USD 1,500 with a single panelist (WIPO fee schedule). Save this for after the site is down.

File the NCRP complaint even though you lost nothing

File an NCRP complaint even with nothing lost; it's a dated record ahead of any victim's complaint reaching a police station. The portal takes all types of cybercrime, with online tracking (I4C). Cheating by personation is an offence, under section 319 BNS and section 66D IT Act; name them, but let the officer decide which applies.

Non-financial complaint, paste into NCRP
Who you are: legal name, GSTIN, agency since [year], handles
What the fake is: URLs, handles, numbers, UPI IDs found so far
What it copied: reels, photos, logo (link your originals)
That it is collecting payment from the public in your name
Number of people who contacted you, and since when
Reports already filed, with references and their response
Request: flag these accounts/numbers/UPI IDs, keep you informed

A client who paid the fake files their own financial-fraud complaint separately; a one-star review later naming your real agency gets removed separately.

What big brands get from the Delhi High Court, and when it's worth it

Two interim orders show what a civil suit buys a brand with the marks and money to fight. In May 2024, against unknown persons running lookalike "Ginger" hotel sites with the hotel group's registered marks and photographs, the Delhi High Court restrained use of both, ordered the registrars to suspend the domains, banks and NPCI to freeze or suspend the linked accounts and UPI IDs, and telecom operators to block the numbers (Indian Hotels v John Doe). In July 2025, a similar order against a fake-dealership network using the TATA marks went further: Tata could write directly to registrars to lock future lookalike domains, and the directions carried a 7-day compliance deadline (Tata Sons v John Doe).

Both rested on registered marks (the Ginger order also on the hotel group's own photographs), and both needed a lawyer-led suit. It's worth it once a clone keeps returning, or the money is large, not the first thing to try.

Register your name before a fake does it for you

A registered trademark gives you the infringement route the orders above used; an unregistered name still has passing-off, and a genuine prior continuous user can't be stopped by a later registrant (Trade Marks Act 1999, ss.27, 34). "Whoever registers first wins" is not what the Act says.

Register more than one class if you sell packages: class 39 covers travel arrangement, but hotel reservations by an agent sit in class 43, and guided tours in class 41 (Nice Classification). Run the search in naming your agency, and the legal checks first before you file.

Example: Classes 39, 43 and 41, filed as an individual, startup or small enterprise: ₹4,500 per class e-filing, ₹13,500 total; otherwise ₹9,000 per class, ₹27,000. Official fees only; attorney fees are extra (IP India fee schedule). Registration runs 10 years, renewable.

You do not need a trademark to report copied reels: if your staff shot them, or you paid someone to shoot them, your agency is the first owner of the copyright unless agreed otherwise, with nothing to register (Copyright Act 1957, s.17). The exception is an influencer's barter-trip content, which may be theirs unless your agreement says otherwise.

Warn your clients without scaring off new ones

Name your only handles, numbers and one payment account, in your legal name, everywhere a client might look.

Pinned post / Story highlight (about 50 words)
Our only accounts: [Instagram], [Facebook], [website]. We call and
WhatsApp only from [number 1] and [number 2]. Payment only into
[bank account, LEGAL NAME] or our QR showing [LEGAL NAME], never a
personal UPI ID. Offered a trip in our name elsewhere? Send it to
[number] before you pay.

WhatsApp Status / broadcast (2-3 lines)
Fake pages are copying agency names on Instagram. We are only
[handle]/[website], and only call from [numbers]. Check before
paying anyone claiming to be us.

Website footer / contact page
[Agency legal name] trades only as [handle]/[website]. No other
page or account.

Pin the highlight permanently; repeat the Status version monthly in season.

When someone who paid the fake calls you

Stay calm, not defensive. Confirm the page isn't yours and that you've reported it, and give your NCRP reference if you have one. Don't promise a refund; you didn't take their money.

Victim call script
Opening: "That page isn't ours; we've already reported it
[NCRP ref: ___]."
Ask them to: call 1930 now, file on cybercrime.gov.in under
financial fraud with the UPI ID and transaction reference, and
report the number/link on Chakshu.
Ask permission to keep their screenshots and payment proof for
your own complaint.
Offer a genuine quote only if they ask, separately.

For a public comment naming your real agency, a calm reply, "this account isn't ours, our only page is @[handle], please report it," beats arguing. An agency's own lost money is covered in the first 24 hours after wiring money to a fraud; a client who files an NCH docket naming you gets its own reply.

If it is your own page that got hacked

Treat a hacked page as a crime against your followers, not just an inconvenience.

1. Start recovery from Instagram's own hacked-account page.
2. Warn followers on every other channel (WhatsApp Status, broadcast, Facebook page, Google Business Profile) that the account is compromised; don't pay any offer posted from it.
3. If a follower already paid the attacker, they call 1930 and you file your own NCRP complaint.
4. Remove the page from ad accounts; delete saved cards in Business Suite.
5. Change the linked email's password, then enable two-factor login and add a second admin once back in.

Be wary of anyone offering to "recover" your account for a fee; there's no reliable data either way. The GAC route is only for a wrong Grievance Officer decision (or no reply), for example a page disabled by mistake, not the hack itself.

The 15-minute weekly check that catches clones early

Weekly check (about 15 minutes)
- Ad Library: your name, handle, owner's name, "[name] + Dubai" (3m)
- Instagram/Facebook handle variants: dots, underscores (3m)
- Reverse image search of two reel stills and your team photo (3m)
- Google search for your name with "offer"/"UPI", plus lookalike
  domains (3m)
- Read client forwards in a "suspicious offers" WhatsApp label (3m)

Anyone can search all active ads on Meta's products through the Ad Library, which is how a paid Dubai offer in your name turns up before a client complains. Log any find before you report it.

Common questions

Instagram par fake page report kaise kare?

Open the profile and report it as impersonation, a ground under Meta's identity policy covering businesses too (Meta); as the business, also file Meta's IP form for any reposted reel or photo. Screens change; accurate as of October 2026.

Can I file a cyber complaint if I did not lose any money?

Yes. NCRP takes all types of cybercrime, so an agency with nothing stolen can still file a non-financial complaint for the record (I4C); a client who paid files their own financial-fraud complaint separately.

Hamare naam se fake page bana diya, police complaint kahan kare?

File it on cybercrime.gov.in as a non-financial complaint, naming the fake's URLs, handles and numbers. Cheating by personation is an offence under the BNS and IT Act, but let the officer cite the exact sections (NCRP).

The short version

• Screenshot and log before reporting anything; platforms keep removed content 180 days for police and courts, not for you.
• Lead the Grievance Officer complaint with impersonation to get the 36-hour clock; trademark or copyright alone gets 7 days.
• Report a lookalike website to its registrar's abuse desk first.
• File an NCRP complaint even with nothing lost; it's your dated record ahead of any victim's.
• Name your only handles, numbers and payment account, in your legal name, everywhere.
• Register classes 39, 43, and 41 if you guide tours, not 39 alone.
• Run the weekly check: Ad Library, handle variants, reverse image search, a name-plus-offer search.