Multi-channel impersonation is outpacing email-centric defence

At a glance

What this is: NHI Mgmt Group's analysis, drawing on imper.ai's blog post: Multi-channel impersonation is shifting social engineering away from email and into chat, voice and collaboration tools, exposing a trust gap that content filters cannot close.

Why it matters: IAM, security and fraud teams need controls that assess the trustworthiness of live interactions across channels, not only the content of inbound messages.

By the numbers:

• Nearly 60% of breaches now involve a human element.
• Third-party and supply-chain-related breaches now account for 30% of incidents.

Context

Social engineering is no longer an email-only problem. Attackers exploit collaboration platforms, voice calls and internal chat because those channels carry trust signals that people already rely on during normal work.

That shift matters because most legacy awareness and filtering programmes were built to inspect links, attachments and sender reputation rather than the credibility of a live interaction. For identity, fraud and help desk teams, the control question has moved from message hygiene to interaction assurance.

Key questions

Q: How should teams verify work requests in collaboration tools?

A: Teams should verify collaboration requests by checking the requester’s identity through a separate trusted channel, confirming the requested action against known workflows, and requiring step-up verification for payments, credential resets, data exports, or access changes. For collaboration requests, use call-back procedures, out-of-band approval, and recorded authorisation so a spoofed account or hijacked thread cannot drive action on its own.

Q: Why do attackers prefer chat and voice over email for impersonation?

A: Attackers prefer chat and voice because they feel immediate, conversational and lower friction than email, which helps them pressure targets before suspicion rises. They can exploit real-time trust, mimic colleagues, and pivot between channels to reinforce a false story, especially when a voice call is used to validate a message already seeded in chat or text.

Q: What are the first signs of a multi-channel impersonation attempt?

A: The first signs are a request that arrives through one channel and is quickly reinforced by another, a sense of urgency, and a mismatch between the requester’s normal behaviour and the action asked for. Other warning signs include pressure to bypass normal approval, unusual language, and a request to move to a more private channel for verification or action.

Q: How can organisations protect the help desk from social engineering attacks?

A: Protect the help desk by requiring stronger identity verification for password resets, MFA changes, and account recovery. Use call-backs, out-of-band approval, and scripted checks for high-risk requests. Train staff to recognise urgency, authority, and pretexting, and monitor for repeated attempts against the same users or accounts.

Technical breakdown

Why content filtering misses impersonation attacks

Traditional email defences look for malicious payloads, suspicious links, dangerous attachments and other machine-readable indicators. Impersonation campaigns often avoid those markers entirely, using plain language, familiar timing and normal-looking requests to pass as legitimate conversation. The defensive gap is not just in detection coverage. It is in the assumption that the attack will arrive as obviously hostile content. When the channel itself is trusted, the threat can look indistinguishable from routine work.

Practical implication: Add controls that assess sender credibility, channel context and identity signals, not just message content.

How real-time identity assurance changes the trust model

Real-time identity assurance shifts the decision point from the inbox to the interaction. Instead of asking whether a message is dangerous, the control asks whether the person in front of the user, help desk or finance team looks consistent with normal behaviour, device posture and network context. That makes the control useful for chat, voice and video where static content analysis has limited reach. It also fits distributed work, where identity confidence has to be evaluated in the moment rather than after the fact. See the Social Engineering Guide.

Practical implication: Use live interaction signals to decide whether to pause, escalate or allow a request before credentials or money change hands.

Why collaboration tools expand the social engineering surface

Collaboration platforms concentrate routine trust: colleagues reply quickly, managers make urgent asks and support staff are expected to resolve friction. Attackers exploit that social rhythm with short, plausible messages that do not need to look technical. The result is a broader attack surface where the same impersonation play can move across Teams, Slack, Zoom, SMS and ticketing systems. Detection strategies that stay confined to email miss the channel where the request is actually being accepted.

Practical implication: Extend policy, training and monitoring to the collaboration channels where employees actually verify work requests.

Threat narrative

Attacker objective: The attacker wants to convert ordinary workplace trust into a credential, payment or access event that advances fraud or compromise.

1. Entry occurs when an attacker initiates contact through a trusted collaboration or voice channel instead of email.
2. Credential access or task completion follows when the target accepts the impersonated request and shares secrets, approves a reset or transfers value.
3. Impact is achieved through account takeover, fraudulent payment, support-tool abuse or further internal compromise.

Breaches seen in the wild

• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Trust has become the primary security object in modern social engineering. Email content remains relevant, but the stronger signal now sits in the interaction itself, where identity, timing and context can be manipulated across multiple channels. That makes social engineering a governance problem for IAM, help desk operations and fraud teams, not just an awareness problem. Practitioners should treat trust validation as a control plane, not a user education slogan.

Multi-channel impersonation is a named governance gap, not just a new phishing variant. The attacker does not need a malicious attachment when the request is delivered through a channel that staff already trust. That changes the control objective from blocking bad content to challenging suspicious intent in real time. The organisations most exposed are the ones still funding email-first defences as though collaboration platforms were secondary.

The identity bridge here is operational, not theoretical. Social Engineering Guide becomes relevant because the core weakness is human trust exploitation across channels, including help desk and manager impersonation. Once an attacker can sound like an internal actor, the issue becomes identity assurance at the moment of contact. Practitioners should align people, process and signal-based controls around that interaction boundary.

Security teams need to reclassify collaboration tools as high-value trust surfaces. Voice, chat and video now carry business requests that can lead directly to access changes, reset actions or financial loss. That widens the governance scope for identity teams, who must work with SOC and fraud functions to detect suspicious interactions before they become authorised actions. The practical conclusion is to fund controls where trust is actually consumed.

From our research library:

• Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.

What this signals

Interaction assurance is replacing message assurance as the control objective. Security programmes that still optimise for malicious links will miss the main failure mode in hybrid work: a believable request delivered through a trusted channel. Teams should measure how often users are asked to validate identity outside email, because that is where fraud and account compromise now begin.

Trust surfaces now extend across the collaboration stack. The practical response is to align IAM, help desk, SOC and fraud processes around the same escalation logic when a request arrives through chat, voice or video. If those teams operate different verification standards, attackers will keep choosing the weakest channel.

For practitioners

• Expand trust controls beyond email Apply verification steps to chat, voice and video requests that can trigger password resets, payment changes or privileged access.
• Review help desk escalation paths Require stronger challenge and callback procedures for requests that appear to come from executives, managers or internal support staff.
• Instrument collaboration channels for risk signals Correlate device fingerprint, network location and behavioural consistency so suspicious interactions can be paused before action is taken.
• Rebalance awareness budgets toward live interaction risk Shift training and monitoring away from email-only scenarios and into the channels where employees now make trust decisions.

Key takeaways

• Social engineering now reaches employees through collaboration tools and voice, so email-centric controls only cover part of the attack surface.
• The core weakness is trust abuse at the moment of interaction, where attackers can imitate legitimate colleagues without needing malicious files or links.
• Effective defence now depends on real-time identity and context checks across the channels where staff actually make decisions.

Related NHI Mgmt Group resources: Social Engineering Guide · Phishing Guide · Email Identity and BEC Guide

Key terms

• Multi-Channel Impersonation: Multi-channel impersonation uses two or more communication channels to make a fraudulent request appear legitimate. The attacker may start in email and continue in chat or SMS, creating consistency that defeats controls built to inspect only one channel at a time.
• Real-Time Identity: Real-Time Identity is an identity model that evaluates who or what is requesting access at the moment of use, rather than relying only on static records. It combines live signals such as device state, behavior, context, and risk to adjust authentication, authorization, and privileges continuously across human and non-human identities.
• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity controls to the wider security and fraud risks that shape modern programmes.