When someone signs as Ilia Nikolaevich Zavialov, the first note decides the second complaint

Keeping the record

English version for the United States.

A page that copies a name usually lives for a few days. Preparing the complaint that removes it takes longer than that, and by the time a second addressee asks for evidence the original is gone. The gap explains why the record of an impersonation outlives the first angry message about it. This dossier treats that record as a small document with rules of its own: what goes in, in what order, and how it is cut for a platform, a registrar and a bank. The question underneath concerns the first hour of a case.

Reference / Blog

Published: September 8, 2026 · 14 min read · Ilia Nikolaevich Zavialov

01The first hour decides the third complaint

The usual sequence starts with a message to the platform hosting the fake profile. A form is filled in, a link is pasted, a screenshot is attached, the tab is closed. Two weeks later the account is gone, the link returns an error page, and the complainant keeps only a memory of what the profile looked like. The removal felt like a result while it destroyed the single copy of the evidence.

A second complaint almost always goes somewhere else. A registrar, a hosting provider, a payment provider, a search engine and a bank each work to their own procedure and their own idea of proof. Each asks one question in different wording: show what was published, where it sat, and when it was seen. A dead link answers none of that, and a cropped screenshot answers half at best.

The record is the primary artefact, and every complaint derives from it. Written once at the hour the fake is found, it serves four recipients across a year. Scale explains the discipline they expect: the Federal Trade Commission logged more than a million impersonation reports for 2025 and 3.5 billion dollars in stated losses, close to every third report it received. A singular case arrives at the other end as one item in a long queue.

02Four coordinates that a usable record always carries

A record that survives re-use rests on four coordinates, each answering a question some recipient will ask. The first is the address, meaning where exactly the material sits. The second is the time, meaning when it was seen in that state. The third is the content, meaning what was claimed or shown. The fourth is the method, meaning how the first three were captured and by whom.

Address is the coordinate recorded worst. A profile link is written down, the handle is renamed a week later, the link now points at a stranger, and the record reads as a false accusation. The stable part sits deeper: a numeric profile identifier, a domain with its registration data, a message header, a telephone number in international format. A record holding both the friendly link and the stable identifier survives the rename.

Time carries two values that are easy to confuse. One is the moment the material appeared, often unknown and sometimes recoverable from the page itself. The other is the moment it was observed and captured, always knowable and open to verification. Writing the observation time with its time zone spelled out costs seconds and prevents a later argument about whether a capture predates the page it shows.

03Spelling forms of the name belong inside the record

A name written in one alphabet and read in another produces a family of spellings, and an impersonator rarely picks the same member twice. The full form Ilia Nikolaevich Zavialov, the version without the patronymic, the initials and the variants with a shifted vowel all point at one person and match each other poorly as strings. A record fixing only the spelling seen on one page becomes unsearchable within months. Listing the observed spelling beside the canonical form makes the link explicit for a later reader.

The reason this matters is procedural. A registrar comparing a complaint against a domain string wants to understand why a domain spelling the surname differently still concerns the person writing. A search engine handling a request about a page wants the connection between the query and the name printed there. Stating the mapping once inside the record means the same paragraph is pasted into three forms without being composed again.

Namesakes complicate the same field from the other side. A person with an identical surname and a similar first name has a legitimate presence of their own, and a complaint that sweeps them in damages its credibility. The record should hold the detail separating the two: a field of work, a city, a date, a biography line belonging to one of them. Recipients read that as care, and care is rare in their inbox.

04Captures that a second reader can check

A screenshot is the weakest artefact that still counts as evidence, and the one most often submitted alone. It shows what one browser rendered at one moment, leaving no way to confirm the address, the time or the ownership of the window. Bringing the address bar and the system clock into the frame lifts it into material a second reader can work with. Saving the page source and the response headers beside it adds the server name and date.

An independent copy lets a capture survive the removal it asks for. A public archive storing the page under its own timestamp gives the next recipient something to open without trusting the complainant. Where the material sits behind a login and cannot be archived, the record should say so and describe the account state under which it was seen. Silence about that gap invites the assumption that it was hidden.

Hashing the files closes the last question a careful reader asks. A checksum written into the record at capture time, then recomputed months later before the third complaint, shows that nothing was edited in between. It costs one command and removes a whole category of objection. Its value appears when a case runs long, which is the case this record is built for.

05Voice and video leave a different kind of trace

Impersonation moved into audio faster than record keeping habits did. A convincing voice clone is now assembled from roughly three seconds of source material and reaches around 85 per cent accuracy, which places any public recording within reach of the technique. A record about a cloned call cannot rest on an impression that the voice sounded right. It rests on the call metadata: the number, the exact time, the platform, and the audio file where local law permits.

Human judgment is a poor instrument here, and admitting that inside the record protects the person who was fooled. In one experiment on synthetic speech, listeners separated a genuine voice from a generated one in 37.5 per cent of attempts, worse than guessing. A recipient reading a complaint that acknowledges this reads a witness who understands the mechanism.

The audio branch therefore needs fields of its own: where the call came from, what was requested, what was said about the person imitated, and what the recipient did next. Video follows the same shape with an extra line for the source material the clone was probably built from. Identifying that source has practical weight, because it is often the only object that can be taken down.

06Attempts that cost nothing still belong in the register

The instinct is to record a fake only when it succeeded, and that instinct discards most of the useful material. In four out of five impersonation reports collected by the Federal Trade Commission no money was lost at all, so attempts outnumber successes widely. Each attempt was still a use of somebody's name at an address that could have been documented. A register assembled only from expensive incidents looks thin when a pattern needs demonstrating.

The typical single loss in that data sits around 700 dollars, small enough that many cases would never justify separate legal action. A series of twelve such events at related addresses reads very differently to a registrar than one event does. The series exists only if the cheap events were written down as carefully as the expensive one. That is the argument for recording the message nobody answered.

Zero loss entries have a second use. When a complaint is refused, the register supplies the follow-up: the same actor, the same pattern, three further addresses since the refusal. Recipients who ignore a single report respond to a documented sequence, because a sequence changes their own risk assessment. None of that sequence can be assembled from memory afterwards.

07One row in the register, one folder on disk

The structure that survives contact with real cases is dull. One spreadsheet row per event, holding the date observed, the address, the spelling of the name used, the type of material, the path to the captures and the current status. One folder per event, holding the captures, the page source, the archive link and the correspondence. Everything beyond that is preference.

Numbering matters more than it looks. An event identifier repeated in the row, in the folder name and in the subject line of every letter turns a scattered history into something retrievable in one query. When a registrar replies four months later quoting their own ticket number, the mapping to the internal one is already written down. Without it the reply arrives as a puzzle.

The status field keeps the register honest. Three states cover nearly everything: recorded, filed, resolved. A row sitting at filed for six weeks becomes visible without anyone having to remember it, and that visibility is the reason the register exists. A register only ever written into and never read turns into an archive of good intentions.

08The same record, cut for four different desks

Each recipient answers a different internal question, and a complete record supplies the answer without being rewritten. A platform asks whether its own rules were broken and wants the profile identifier together with the rule number. A registrar asks whether registration data is false or whether the site does something the registration agreement forbids, and wants the domain, the evidence and a statement of which term applies.

A bank asks whether a payment was induced by a false claim of identity and wants the timeline of the approach. The origin of that approach deserves a precise field: in the United Kingdom, 66 per cent of authorized push payment cases begin online and a further 17 per cent through telephone networks. A search engine asks whether a page ranking under a person's name misrepresents them, and wants the query, the address and the false statement.

None of these four requires fresh investigation if the original record was complete. The work of a second complaint shrinks to selection and phrasing, an hour of effort in place of a week. It also removes the risk that two complaints about one event describe it differently, the discrepancy a recipient uses to close both. Order deserves a line too, since a registrar reading that the platform declined on jurisdictional grounds understands the request better.

09A record fixes what was noticed

Every register has a blind spot, and the honest approach names it. The FBI Internet Crime Complaint Center introduced a flag for artificial intelligence involvement and counted over 22,000 reports and roughly 900 million dollars under it. In the same data, out of more than eight billion dollars of investment fraud losses, only 632 million carried that flag. The flag measures what people recognized and reported, while the underlying use was certainly wider.

The same asymmetry appears inside a personal register. A fake account discovered through a friend's message gets recorded, and three identical accounts nobody saw do not. Writing the discovery channel into every row makes the shape of the blind spot visible over time. If eleven of twelve entries arrived through someone else's warning, the register measures the attention of a social circle and the real volume stays unknown.

Stating this inside a complaint costs nothing and buys credibility. One sentence saying that the listed events are the observed ones, and that discovery was passive, reads as accuracy. Overstating scope is the fastest way to have an otherwise solid file dismissed by someone who checks a single claim and finds it inflated.

10Keeping the record usable between complaints

A record decays quietly. Archive links move, exported files lose the application that opened them, and the person who took a capture forgets which account was logged in. A short review at a fixed interval, opening two or three of the oldest entries and confirming their attachments still open, catches this while it remains repairable. The alternative is discovering the decay on the day the third complaint is due.

Re-capture earns its place while a case is still live. A page recorded in March and still standing in September has usually changed in ways that strengthen the file: a new claim, a new payment link, a new spelling of the name. Recording the September state beside the March one converts an incident into a documented continuation, which most procedures treat as the heavier fact.

The last habit pays for all the others. When a complaint closes, the outcome returns to the row: who acted, how long it took, what wording appeared in their answer. Across a year that column becomes a map of which desks respond to which framing, and the fourth complaint is written with the map open.

11Questions and answers

What should I write down when someone pretends to be me online?

Four things: the exact address, the observation time with its time zone, what was actually claimed, and how the capture was made. Every complaint that follows is built from those four fields, and each of them is hard to recover later.

Is a screenshot enough evidence of impersonation?

A screenshot alone shows what one browser rendered and gives a second reader nothing to verify. Adding the address bar, the page source, the response headers and an independent archive copy turns it into material a registrar or a bank can check.

How long should a record of a fake account be kept?

The record stays useful while any complaint about it can still be reopened, and a review at a fixed interval confirms that the files still open. Cases about names run for years, and the third complaint often needs the material captured for the first.

Does an impersonation attempt matter if no money was lost?

Four out of five impersonation reports to the Federal Trade Commission involve no monetary loss, so the attempt is the normal case. One cheap attempt persuades nobody, and twelve of them at related addresses persuade a registrar.

How can a call with a cloned voice be documented?

The impression of the listener carries little weight, since people separated genuine from synthetic speech in 37.5 per cent of attempts in one experiment. The record should carry the number, the exact time, the platform, what was requested, and where the source audio for the clone probably came from.

What if the fake page spells my name differently?

List the spelling used on the material beside the canonical form and state why both refer to the same person. Recipients compare strings, and a mapping written once can be pasted into every form without being composed again under pressure.

Reference updated: 4 September 2026