An impersonation scam is a fraudster posing as a trusted person or institution, a bank, agency, employer, family member, or vendor, to manipulate the victim into paying or handing over sensitive data. It is the parent category behind bank, government, and known-person impersonation, all built on borrowed authority or trust.
What is an impersonation scam, in plain English?
An impersonation scam is fraud built on a stolen identity of trust. The fraudster pretends to be someone the victim already believes in: their bank, a government agency, their employer, a supplier, or a family member. Because the victim trusts that party, they lower their guard and do what the imposter asks, whether that is making a payment or giving up sensitive information.
It works on borrowed authority or borrowed relationship. The scammer does not have to earn trust from scratch; they inherit it from whoever they impersonate. A message that appears to come from your boss, your bank, or your child carries instant weight that a stranger's never would.
Impersonation is best understood as a parent category. Bank impersonation, government impersonation, and known-person or CEO impersonation are all specific children of it. The common thread, and the common defense, is the same across all of them: verify through a separate, known channel before acting.
Common kinds of impersonation
The costume changes, but the trick is the same:
Who they pose as | The typical play |
Your bank | Warns of fraud on your account and pushes you to move money to a safe account or share codes. |
A government agency | Threatens arrest, fines, or lost benefits unless you pay immediately, often in gift cards or crypto. |
Your employer or CEO | Requests an urgent, confidential payment or a change to payroll or vendor details. |
A family member | Claims to be a relative in crisis needing money fast, exploiting love and urgency. |
Who is involved?
Who | Their role |
The impersonator | Adopts a trusted identity and directs the victim to pay or disclose under that borrowed trust. |
The victim | Acts on the false identity, believing they are dealing with a party they know and trust. |
The impersonated party | The real bank, agency, boss, or relative whose identity is faked without their knowledge. |
The bank or platform | Processes the resulting payment and must judge whether trust was genuine or borrowed. |
What it looks like in practice
In practice
A finance assistant at a mid-size firm gets a text, then an email, appearing to come from the company's chief executive, who is traveling. The message is friendly but firm: a confidential acquisition is closing, a deposit must be wired to a new account today, and it must stay quiet until announced.
The borrowed authority of the CEO, plus the urgency and secrecy, nearly gets the wire sent. What stops it is a simple policy: any new payment instruction, no matter who it appears to come from, must be confirmed by a direct call to the person on a known number. The assistant calls, the CEO knows nothing about it, and the impersonation collapses.
Why it matters to operators
Impersonation is the backbone of modern scams because it scales across every channel and every relationship. Whether the mask is a bank, an agency, a boss, or a relative, the underlying manipulation is identical, which means the same detection and defense logic covers a huge share of scam losses. Understanding the parent category helps operators see the pattern beneath many named scams.
The defense is consistent too. Because impersonation depends on the victim trusting the apparent sender, the countermeasure is to verify through a separate, known channel, stay aware of spoofing, and treat any unexpected request for money or credentials as suspect no matter how legitimate the source looks. Building that habit into workflows defeats impersonation regardless of the disguise.
What to watch for
- Unexpected request for money or data. Any out-of-the-blue ask to pay or share credentials, even from a familiar-looking sender.
- Pressure and secrecy. Urgency, threats, or instructions to keep the request confidential to prevent verification.
- New or changed payment details. A first-time payee or altered bank details attached to a supposedly trusted instruction.
- Channel mismatch. A request arriving through an unusual channel for that party, like a personal number for a work payment.
- Resistance to verification. Discouraging the victim from calling back or checking directly is a strong red flag.
Quick questions
How is an impersonation scam different from phishing?
Phishing is one delivery method, usually a deceptive message aimed at stealing credentials or data. Impersonation is the broader tactic of posing as a trusted party, which can play out over phone, email, text, or in person, and often aims at payments as well as data. Phishing frequently uses impersonation, but impersonation is wider.
What are the main sub-types?
The common ones are bank impersonation, government impersonation, and known-person impersonation, which includes CEO or executive fraud and family-member scams. Each targets a different trusted relationship, but all rely on the same borrowed-trust mechanism.
What is the single best defense?
Verify through a separate, known channel. If a request for money or data arrives, confirm it by contacting the supposed sender on a number or address you already trust, not one provided in the message. This defeats impersonation across every disguise.
Why is impersonation so effective?
Because it inherits trust the victim has already granted to a bank, agency, employer, or relative. The scammer skips the hard part of earning credibility and goes straight to exploiting an existing relationship, which makes the request feel legitimate.
How does spoofing fit in?
Spoofing fakes the visible identity, a phone number, sender name, or email address, to make the impersonation convincing. It is the technical layer that helps the fraudster look like the trusted party they are pretending to be.
Is impersonation authorized or unauthorized fraud?
It often leads to authorized fraud, because the victim is tricked into making the payment themselves. That distinction affects liability and reimbursement, and is why impersonation scams can be harder to reverse than a straight account takeover.
Go deeper
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.
- FBI IC3 ↗ — The FBI Internet Crime Complaint Center. Fraud reporting and annual trend reports.