What do I do if someone is falsely representing my company online?

While I agree that it may be a good idea to send a cease and desist letter and speak with an attorney, this is likely more of a cybercrime issue than business matter. If you alert them with a cease a desist they may disappear. Not alerting them, and contacting law enforcement first may allow authorities a better chance to address the issue.

Claiming to be your company to take advantage of your reputation for competitive reasons would seem more of a civil issue, but this is unlikely to be what is happening here. More likely, it is claiming to be your company to take advantage of your reputation to help advance ID theft, account compromise, or other more nefarious criminal activity and that is something else. 

The FBI IC3 form is a better place to look than the BBB or other business issue related resources. (You can do a web search for IC3 complaint to reach the form). You have sufficient 'evidence' and a witness of sorts to assist in the case, and every minute that passes could be another victim.

https://www.ic3.gov/complaint/default.aspx

Thank you everyone for the advice and resources.  I don't think I want to approach this person myself because they will likely just change all their info and continue to victimize people.  I like the suggestion of contacting law enforcement first to see if they can help.  Thank you for the links and other info.  I'll come back and let you know what happens.

You can really do a few things depending on the outcome you are looking for.  You can definitely go to the police precinct and file a report and have them assign the case to a cyber fraud unit and hope that they will get to the bottom of it ASAP. I would do that regardless of the next steps you take. However, you can also hire a cyber fraud firm to represent you and they will use their resources to try to get to the bottom of it as well.   The best course of action I can recommend for faster results would honestly be to report the fraud to google, leave bad reviews on their site, and report each one of their commentators.  Google is usually pretty quick with taking fraudulent sites down, but you have to report them and try to have others report them to Google as well. This would probably get the job done quicker and free of charge. Best of luck to you !!! 

Find out his true name and address if you can; you may need to use a tech expert to see if he can be identified by his IP address or other means.  If you think he is using his real  name we can perhaps locate him using tools at our disposal.  Once we have the information we can send a strongly worded cease and desist letter followed by a lawsuit 

Hello

Sorry to hear what happen to you.  The first thing I would do is call the police and have a report made out in case legal action is taken against this person via your company and you are caught in the middle of it.  Second I would inform Google what is going on.  Then put out a scam alert on all social media about this person.  Plus contact an attorney. I hope this helps.

Actually you should call the local FBI office.  They do take this seriously and pursue it.  I had someone about 3 years ago try to phish our email to steal money.  I called and an FBI agent along with a State Police officer from the cyber crimes division were at my office the next morning.

You would contact IC3 the division of the FBI that deals with online crimes. You can fill out a complaint online by going to their website. 

Although I don't handle cyber crimes, I suggest you speak with your IT people about securing your online presence and/or trying to track this person's activity.  I also recommend that you contact your local police department as they may have detectives assigned to these types of crimes.

One of my clients recently had a similar situation. An individual created a fake website using my client's name and logo. The individual then began listing high-end, imported cars on Craigslist and elsewhere and directed deposit payments be made to them. We were able to subpoena the web hosting company to learn the identity of the individual and sue them. The fake website was shut down. Bottom line is that you should take action so that you are not liable. 

The last post is spot on.  Many such scams employ tangled webs of IP addresses originating abroad, raising complex jurisdictional issues and other hurdles to enforce or collect civil remedies.   The FBI takes these crimes very seriously:  www/fbi.gov/investigate/cyber.  Perhaps start there; and also hire qualified IT professionals to overhaul your business IT infrastructure.  I'm very sorry to hear you were victimized by this nonsense during these difficult times for all businesses.