Incident Playbook
Disinformation & Fakes
Summary
False information, fake accounts or manipulated media are being spread to discredit the organisation or its people.
- Category
- People and safety
- Typical severity
- Medium to high
- Response led by
- Incident lead, with communications lead and leadership
First 15 minutes
- Save copies of the content, links and account names before they disappear.
- Publish a calm, factual correction on your official channels.
- Report fake accounts and impersonation to the platforms.
1. Overview
Disinformation is false information spread on purpose to damage your organisation or your people. It includes fake statements, doctored images and documents, impersonating accounts, and increasingly AI-generated voice notes and videos that sound and look real.
2. How it happens
- Fake pages and accounts using your name and logo.
- Fabricated documents, screenshots and letters.
- Deepfake audio or video of leaders saying things they never said.
- Coordinated accounts that push the content so it trends.
- Real material taken out of context to mislead.
3. Indicators
Signs that this incident may be happening:
- Partners or the public asking about statements you never made.
- New accounts or pages using your name.
- Sudden spikes in mentions of your organisation or leaders.
- Content that is emotionally charged and spreading fast.
4. Triage questions
Answer these first to understand scope and severity:
- What is being claimed, and is any of it true?
- Where is it spreading, and how fast?
- Is it impersonating your organisation or staff?
- Does it include manipulated images, documents, audio or video?
- Who is likely to believe it, and what harm could result?
5. Severity guide
Use your plan's severity levels. As a guide for this incident:
| Level | Typical situation |
|---|---|
| Low | A single false post with little reach. |
| Medium | False claims spreading in a limited network. |
| High | Impersonation or manipulated media gaining traction, affecting partners or funders. |
| Critical | Content that endangers staff or communities, or threatens the organisation's ability to operate. |
6. Response steps
Work through these in order. Record every action, with the time and who did it, in your incident log.
- Save copies of the content, links and account names before they disappear.
- Publish a calm, factual correction on your official channels.
- Report fake accounts and impersonation to the platforms.
- Ask independent fact-checkers to verify the content.
- Brief partners, donors and communities directly.
- Avoid repeating the false claim in your own messages more than necessary.
7. Communication
Who to inform, and when:
- Incident lead, communications lead and leadership.
- Partners, funders and communities, directly and early, before they hear it elsewhere.
- Platforms, to report impersonation and manipulated media.
- Independent fact-checkers and trusted journalists.
- Staff, with guidance on how to respond and what not to share.
8. Evidence to preserve
Keep these before making changes, wherever it's safe to do so:
- Copies and screenshots of the content, with links, dates and account names.
- Archived copies of pages and posts.
- Original versions of any manipulated material.
- Data on how the content spread.
- Platform report numbers and responses.
9. Recovery and review
- Keep watching for the story resurfacing.
- Consider legal advice on defamation.
- Support any staff who were targeted.
- Update your communications plan with what you learned.
10. Prevention checklist
- Make your official channels easy to find, and verify accounts where you can.
- Monitor mentions of your organisation and leaders.
- Prepare a short response template and agree who can approve it quickly.
- Build relationships with journalists and independent fact-checkers.
- Keep original copies of your own statements, photos and documents.