Overview
Impersonation is pretending to be someone the target trusts — a colleague, an executive, IT support, a delivery person, or a vendor — to gain access or information. It is a thread running through many social-engineering attacks and can occur digitally, by phone, or in person.
Learning objectives
- Define impersonation and its channels.
- Recognize common impersonation scenarios.
- Understand verification as the primary defense.
Core concept
Impersonation exploits the trust attached to a role or identity. Common forms:
- Executive impersonation (BEC): posing as a CEO/CFO to order an urgent payment or data release.
- IT/help-desk impersonation: posing as support to "fix" an issue and obtain credentials or remote access.
- Vendor/partner impersonation: posing as a supplier to change payment details or send malicious files.
- Physical impersonation: wearing a uniform or badge to walk into a facility, or tailgating — following an authorized person through a secure door.
How it works
The attacker adopts the trusted identity and leverages the target's reluctance to challenge authority or seem unhelpful. Digitally, they spoof display names, use look-alike email domains, or compromise a real account. Physically, a confident manner, a plausible uniform, or simply carrying boxes and waiting for someone to hold the door can bypass access controls. Increasingly, attackers use deepfake audio or video to impersonate a known voice or face convincingly.
Practical example
A finance clerk receives an urgent email appearing to be from the CFO (spoofed display name, look-alike domain): "Wire $40,000 to this new supplier before end of day — I'm in meetings, just handle it." The authority and urgency discourage questioning. A simple defense — an out-of-band verification call to the CFO's known number — exposes the fraud instantly.
Cybersecurity relevance
Impersonation underlies business email compromise, one of the costliest categories of cybercrime, and physical intrusions. It shows why out-of-band verification (confirming via a separate, trusted channel) and challenge-friendly culture are essential defenses that technology alone cannot provide.
Common mistakes
- Acting on authority and urgency without independent verification.
- Holding secure doors open for unverified people (tailgating).
- Trusting a display name or caller ID, both of which are easily spoofed.
Key takeaways
- Impersonation abuses the trust in a role or identity, across digital, phone, and physical channels.
- It drives business email compromise and physical intrusions like tailgating.
- Out-of-band verification and a culture where challenging is acceptable are the primary defenses.
Check your understanding
- What is "tailgating," and how does it defeat badge-based access control?
- Why is an out-of-band verification call an effective defense against executive impersonation?