How to spot a fake copyright infringement notice

Two different things people call "fake"

Getting this distinction right matters, because the two need opposite responses and confusing them can create a legal problem where you had an administrative one.

An incorrect notice is not evidence of dishonesty, and describing it that way in an email you cannot unsend is a bad idea. The genuine-but-wrong category, including deliberate misuse by real parties, is covered separately in false and abusive takedowns.

Warning signs in the message itself

It wants money

This is the strongest single signal. A genuine takedown notice asks a service provider to remove material. It does not arrive in your inbox with an invoice, a settlement figure, a cryptocurrency address, or a deadline after which the amount increases. Legitimate rights holders do pursue settlements, but that happens through identifiable lawyers, on letterhead, referencing a specific work and a specific use — not through a template email demanding payment within 24 hours.

The sender does not survive a lookup

Check the actual email domain rather than the display name, which is trivially forged. Then check whether the sender exists: a real enforcement vendor or law firm has a website with history, a traceable registration, a physical address, and a presence in the public record of filings. A recently registered domain that mimics a known firm is a common pattern.

The work is described vaguely or wrongly

Genuine complaints identify a specific work — a named photograph, an article, a track, a film. Scam messages tend to stay generic ("copyrighted images on your website") because the sender has no particular work in mind. A complaint that names a work you can see has no relationship to your page is also a signal, though more often of automation than fraud.

There is an attachment you did not expect

A recurring pattern is a message claiming the "evidence" or "list of infringing images" is in an attached archive or document. Opening it is the point of the exercise. A real notice puts the URLs in the body of the message, because the recipient needs to read them without opening anything.

It pushes you to a link to "review the claim"

Credential harvesting. The link leads to something dressed up as a hosting control panel, a platform login, or a legal portal. Reach any account you need to check by typing the address you already know, never through a link in the message.

The urgency is disproportionate

Threats of imminent site suspension, account termination, or legal action "today" are pressure tactics. Real processes move on the scale of days and weeks, and the parties involved have no reason to rush you.

Small tells

• Statutory language that is almost right but subtly garbled, or citations to provisions that do not exist.
• A reply-to address on a different domain from the sender.
• Your name, company or URL missing entirely, or plainly merged from a list.
• A demand aimed at your search rankings — offers to "resolve" a delisting for a fee are not a thing rights holders do.

Verifying a claim independently

The reliable way to assess a message is to check facts it cannot control. Four checks resolve most cases:

1. Check the public record for your domain. If the message claims a copyright complaint was filed against your site with Google, that request would normally appear in Google's published data — with a date, a reporting organisation, a copyright owner and the URLs named. A complete absence of any matching request is meaningful. So is the presence of one that does not match the email's story.
2. Read the underlying notice. Where a Lumen link is available, the archived notice shows what was actually sent, by whom, and about what. How to read a Lumen record.
3. Check your platform accounts directly. If a platform or host acted on a complaint, it will normally be recorded in your account. Sign in by typing the address yourself. For a message claiming to come from Google about copyright, the genuine article also appears in Search Console — what the real notice looks like.
4. Contact the claimed sender through their own published channel. Find the firm or vendor independently and use the contact details on their site. If they did not send it, you have your answer — and they generally want to know their name is being used.

Do not use the phone number or email in the message to verify the message. That is circular, and it is the part of the scam that most often works.

Check whether a real request names your domain

What the public record can and cannot settle

Be careful about the conclusion you draw from a clean check. Google's published data covers requests made to Google Search. A genuine notice sent to your hosting provider, to a platform, or to you directly would never appear there, so absence from the record does not prove a message is fake — it proves no matching Google Search request exists.

What it does give you is a solid piece of independent evidence to weigh alongside the sender checks. A message claiming Google has delisted your pages, when no request naming your domain exists at all, is a much easier judgment than the same message read in isolation.

If you conclude it is a scam

• Do not pay, and do not negotiate. Payment confirms the address is live and invites more.
• Do not open attachments or follow links. Preserve the message, headers included, without interacting with it.
• Report it to your email provider, to the organisation being impersonated, and to the relevant national fraud or consumer body.
• Warn whoever else receives your public inboxes. These campaigns hit the contact addresses on a site, so the person who reads them is often not the person who can judge them.
• Check your accounts if anyone did click, and change credentials from a known-good route.

If it turns out to be genuine

Plenty of alarming emails are real, and the checks above will tell you so. In that case the useful next questions are what was named, by whom, and whether the claim is correct — which is where what a copyright infringement notice means and how the takedown process works pick up. If material was removed and you believe that was a mistake, read what a counter-notice involves before responding, because the response has consequences of its own.

This guide is for informational purposes and is not legal advice.

FAQs

Keep reading

Last reviewed 2026-08-31.