26.11.2025

ANCOM has developed and released a Guide for public institutions that outlines concrete measures to prevent and combat the unauthorized takeover of visual identity elements on social media accounts—a phenomenon commonly known as impersonation -, methods for detecting fake accounts and the necessary steps for reporting them to online platforms. The document is available on ANCOM's website, here.

Amid the increasing use of social platforms and digital services, the risk of fake accounts impersonating official accounts of public authorities has also increased. These accounts can be exploited for:

• disinformation: such pages spread fake news and information that misrepresents/distorts reality, under the guise of official institutions;
• scams and financial fraud: fake accounts that appear to belong to public institutions are used to collect personal data and obtain financial benefits;
• identity theft: stolen personal data can be used for criminal activities;
• reputational damage: citizens' trust in public institutions is eroded.

Prevention measures

The guide provides public institutions with a set of proactive protection measures, which include securing official accounts, staff training and education, and continuous monitoring. Thus, ANCOM recommends that public institutions regularly verify the use of their visual identity elements across relevant platforms, define clear response procedures for cases of identity takeover or implement escalation procedures for urgent situations that could impact public order or even national security.

Identifying fake accounts

The Guide offers a detailed list of indicators that may signal the impersonation of an official account/page belonging to a public institution. Public institutions and users are encouraged to pay attention to both visual identity elements and the specific behaviours of suspicious accounts.

For example, fake accounts have similar names/acronyms but with subtle changes (e.g., Ministerul.X instead of Ministerul X, or minor alterations like Ministerul1 X) or they may have unusual web domains linked to the social media account, such as .tk, .ml, .ga instead of .gov.ro or or misleading formats like ministerul.X.ro instead of ministerulx.gov.ro.

As for the behavior indicators associated with fake accounts, these include online activity during time slots inconsistent with Romania’s time zone, repetitive posts with the same/similar content published at short intervals or an unrealistic number of followers compared to the account’s posting history.

Reporting fake accounts

The ANCOM Guide details the steps for reporting fake accounts to online platforms (e.g. Facebook/Meta, Twitter/X, Instagram, LinkedIn) and specifies the required documentation.

Thus, to report an unauthorized takeover of an account, institutions should use the platform's internal reporting mechanism and provide complete documentation (official link, evidence confirming the status of the person submitting the report and credible information regarding representation). If an online platform does not fulfill its obligations under the Digital Services Act (DSA) - e.g., by failing to respond, providing an inadequate or incomplete response, or denying access to its internal complaint-handling system - affected parties may file a non-compliance complaint. Complaints must be accompanied by a detailed description of all steps taken with the platform, the reference number assigned by the platform at the time of reporting, as well as any evidence supporting the complaint. Subsequently, the complaint is analysed according to DSA.

As Romania’s Digital Services Coordinator, ANCOM urges public institutions to pay close attention to protecting their institutional identity in the digital environment, given that impersonation of official accounts can undermine the integrity of public communication, generate confusion among citizens, and facilitate the spread of misleading or manipulative content.