Impersonation Attacks Explained: How Fake Identities Trick Victims

---

You receive a message from someone using your manager’s name and profile photo.

The message says:

“I am in a meeting. Please urgently send the latest customer file.”

The name looks correct.

The photo looks familiar.

The tone seems believable.

You send the file.

Later, your real manager says:

“I never sent that message.”

The attacker was pretending to be someone you trusted.

This is impersonation.

A simple definition is:

Impersonation = A Social Engineering Technique Where an Attacker Pretends to Be a Trusted Person, Organization, Employee, Official, or Service Provider to Manipulate a Victim

The key idea is:

FALSE IDENTITY

The attacker wants the victim to believe:

“I KNOW WHO THIS PERSON IS.”

The basic pattern is:

FAKE IDENTITY → TRUST → REQUEST → VICTIM ACTION → ATTACKER BENEFIT

---

How an Impersonation Attack Works

Impersonation often combines publicly available information with psychological manipulation.

A simplified attack chain is:

SELECT IDENTITY → COPY DETAILS → CONTACT VICTIM → BUILD TRUST → MAKE REQUEST → EXPLOIT RESPONSE

Step 1 — The Attacker Chooses Someone the Victim Trusts

The attacker may impersonate:

• Manager
• CEO
• IT administrator
• Bank employee
• Police officer
• Government official
• Vendor
• Customer
• Friend
• Family member

The chosen identity is important because the victim already has a reason to trust that role.

Step 2 — The Attacker Copies Familiar Details

The attacker may use:

• Name
• Job title
• Profile photo
• Company logo
• Email display name
• Phone number
• Writing style

Some of this information may come from:

• Social media
• Company websites
• Data leaks
• Public directories
• Previous conversations

Step 3 — The Attacker Contacts the Victim

Communication may happen through:

• Email
• SMS
• Phone call
• Messaging application
• Social media
• Fake website
• In-person interaction

The channel may change, but the core deception remains:

“I AM SOMEONE YOU TRUST.”

Step 4 — The Attacker Builds Credibility

The attacker may mention:

• Real employee names
• Current projects
• Recent events
• Supplier names
• Business terminology

For example:

“This concerns the Phoenix migration project.”

A real project name can make a fake identity seem convincing.

Step 5 — The Attacker Makes the Request

The victim may be asked to:

• Send confidential files
• Reset an account
• Transfer money
• Change payment details
• Reveal an OTP
• Approve MFA
• Provide employee information
• Grant physical access

---

Common Types of Impersonation

Impersonation can target both individuals and organizations.

Executive Impersonation

An attacker pretends to be:

• CEO
• Director
• Manager
• Finance leader

Typical requests include:

• Urgent payment
• Gift cards
• Confidential files
• Account changes

Authority increases the pressure to comply.

IT Support Impersonation

The attacker may say:

“This is the help desk.”

They may ask for:

• Password
• MFA approval
• Remote access
• Device information

This can lead to account or endpoint compromise.

Bank Impersonation

The attacker may pretend to be from:

• Fraud department
• KYC team
• Card security
• Customer support

The victim may be asked to reveal:

• OTP
• PIN
• Password
• Card details

Government or Police Impersonation

Attackers may claim:

“This is the police.”

or:

“This is the tax department.”

They may threaten:

• Arrest
• Fine
• Investigation
• Account freeze

The goal is often money or personal information.

Vendor Impersonation

The attacker pretends to represent a known supplier.

A common request is:

“Our bank account has changed. Please update payment details.”

If finance staff accept the change, payments may be redirected.

Customer Impersonation

Attackers may impersonate customers to convince support staff to:

• Reset passwords
• Change contact details
• Reveal account information

Friend or Family Impersonation

A message may say:

“Hi, this is my new number.”

Then later:

“I urgently need money.”

The attacker relies on emotional trust.

Social Media Impersonation

Attackers may copy:

• Name
• Profile photo
• Biography
• Posts

to create a fake profile resembling a real person or organization.

Physical Impersonation

An attacker may appear at an office pretending to be:

• Technician
• Delivery person
• Contractor
• Auditor
• New employee

The goal may be access to restricted areas or information.

---

Why Impersonation Works

Impersonation exploits how people naturally make trust decisions.

Familiar Names Create Trust

Seeing:

“RAHUL SHARMA — FINANCE DIRECTOR”

may immediately feel trustworthy.

But names can be copied.

Profile Photos Are Easy to Copy

A profile image from social media can be reused on:

• WhatsApp
• Telegram
• Email accounts
• Fake social profiles

Therefore:

FAMILIAR PHOTO ≠ VERIFIED PERSON

Authority Creates Pressure

People are more likely to follow instructions from:

• Managers
• Police
• Bank officials
• Government representatives

Attackers exploit this natural respect for authority.

Real Information Strengthens the Fake Identity

The attacker may know:

• Your manager’s name
• Your employer
• Your city
• Recent purchases

This information may simply have been gathered elsewhere.

Urgency Reduces Verification

Messages often say:

“I NEED THIS NOW.”

or:

“DO NOT DELAY.”

The attacker wants speed to replace normal verification.

Communication Channels Feel Personal

A direct message on a personal messaging app may feel more authentic than an unfamiliar email.

That feeling should not replace identity verification.

---

Impersonation vs Pretexting, Phishing and Spoofing

These techniques often work together but describe different parts of an attack.

Impersonation vs Pretexting

Impersonation focuses on:

FALSE IDENTITY

Pretexting focuses on:

FALSE STORY OR SITUATION

For example:

“I am your IT administrator.”

is impersonation.

“We are migrating your account and need your MFA code.”

is the pretext.

Combined:

FAKE IDENTITY + FAKE STORY

creates a stronger attack.

Impersonation vs Phishing

Phishing is a broader deceptive communication technique.

A phishing email may impersonate a trusted organization.

Example:

FAKE MICROSOFT EMAIL → FAKE LOGIN PAGE

The impersonation makes the phishing message believable.

Impersonation vs Vishing

Vishing describes:

VOICE-BASED PHISHING

The attacker may impersonate a bank employee during the call.

Therefore:

VISHING = CHANNEL

IMPERSONATION = IDENTITY DECEPTION

Impersonation vs Smishing

A fake SMS may impersonate:

• Bank
• Courier
• Government service

The text delivery is smishing.

The fake identity is impersonation.

Impersonation vs Spoofing

Spoofing is the technical or visual falsification of identity-related information.

Examples include:

• Caller ID
• Email sender
• Website domain

Impersonation is the broader act of pretending to be someone else.

Think:

SPOOFING → HELPS SOMETHING LOOK REAL

IMPERSONATION → CLAIMS TO BE THE TRUSTED IDENTITY

Impersonation vs Business Email Compromise

Business Email Compromise frequently relies on executive or vendor impersonation.

For example:

FAKE CFO → URGENT PAYMENT REQUEST

Impersonation may therefore be a major component of BEC fraud.

---

How to Recognize and Prevent Impersonation

The strongest defense is independent identity verification.

Do Not Trust Display Names

An email may display:

CEO — SANCHIT AGRAWAL

while actually coming from an unrelated address.

Always inspect the actual sender information.

Verify Unexpected Requests

Be especially cautious when a familiar person suddenly requests:

• Money
• Credentials
• OTP
• Confidential documents
• Payment changes
• Remote access

Unexpected requests deserve additional verification.

Use a Different Communication Channel

If someone messages:

“SEND THE MONEY NOW.”

contact them through a known:

• Phone number
• Corporate chat
• Email address
• In-person method

Do not rely only on the channel used by the requester.

Establish Payment Verification Procedures

Organizations should require additional verification for:

• New suppliers
• Changed bank details
• Large payments
• Unusual transfer requests

For example:

EMAIL REQUEST + VERIFIED CALLBACK

Protect Authentication Information

Never give another person:

• Password
• OTP
• PIN
• MFA code
• Recovery code

simply because they claim to represent a trusted organization.

Use MFA

MFA can reduce the impact of stolen passwords.

However, users should never approve unexpected login requests.

Limit Public Organizational Information

Attackers can use publicly available details to build convincing impersonation attempts.

Organizations should consider unnecessary exposure of:

• Internal reporting structures
• Employee phone numbers
• Project details

Verify Physical Visitors

Organizations should use:

• Visitor registration
• Identification
• Badges
• Escorts
• Restricted-access controls

A uniform or toolbox does not prove someone is an authorized technician.

Report Fake Profiles

If a social-media account is impersonating you or your organization:

• Report the profile to the platform
• Warn contacts
• Preserve useful evidence

---

What to Do If You Fell for Impersonation

The correct response depends on what you provided or approved.

Use:

STOP → VERIFY REAL IDENTITY → SECURE → REPORT → REVIEW → MONITOR

If You Shared a Password

Treat it as compromised.

From a trusted device:

• Change it
• Review sessions
• Review MFA
• Check recent login activity

If You Shared an OTP or MFA Code

Secure the account immediately.

Review:

• Active sessions
• Authentication methods
• Recent changes

If You Sent Money

Contact:

• Bank
• Payment provider
• Appropriate cybercrime reporting service

as quickly as possible.

If You Shared Confidential Information

Report the disclosure to the relevant:

• Security team
• Privacy team
• Manager
• Organization

Determine exactly what information was exposed.

If You Changed Vendor Payment Details

Stop pending payments where possible.

Contact the legitimate vendor using known contact information and verify:

• Bank account details
• Previous communications
• Affected invoices

If You Granted Remote Access

Disconnect the session.

Investigate the device and secure accounts from a trusted system.

If a Physical Impersonator Entered the Office

Notify physical security immediately.

Review:

• Visitor records
• Access logs
• CCTV where authorized
• Areas accessed
• Missing equipment or information

Warn Other Potential Victims

An attacker impersonating one manager may contact multiple employees.

Fast internal communication can stop additional compromise.

---

Summary

Impersonation is a social engineering technique where an attacker pretends to be a trusted person, organization, official, employee, or service provider.

The basic attack model is:

FAKE IDENTITY → TRUST → REQUEST → VICTIM ACTION → ATTACKER BENEFIT

Attackers may impersonate:

• Executives
• IT support
• Banks
• Government agencies
• Police
• Vendors
• Customers
• Friends
• Family members
• Technicians

They may seek:

• Credentials
• MFA codes
• Money
• Confidential information
• Account resets
• Payment changes
• Remote access
• Physical access

The relationship is:

SOCIAL ENGINEERING → MANIPULATES PEOPLE

IMPERSONATION → FALSE IDENTITY

PRETEXTING → FALSE STORY

PHISHING → DECEPTIVE COMMUNICATION

SMISHING → TEXT-BASED DELIVERY

VISHING → VOICE-BASED DELIVERY

SPOOFING → FALSIFIED SOURCE INFORMATION

Strong protection includes:

VERIFY IDENTITY INDEPENDENTLY + CHECK SENDER DETAILS + VERIFY FINANCIAL REQUESTS + PROTECT OTPs AND PASSWORDS + CONTROL PHYSICAL ACCESS + REPORT FAKE IDENTITIES

---

Useful Links and References

SanchitGurukul Static Resources

Official External References