Topic starter
06/11/2026 6:40 pm
TL;DR: Gartner split impersonation into workforce and candidate detection categories, both rated emerging, according to imper.ai’s analysis as social engineering, deepfakes, and low-assurance verification increasingly target employee and recruiting workflows. The governance gap is no longer whether identity checks exist, but where trust is created, repeated, and exploited across the lifecycle.
Editorial analysis by NHI Mgmt Group, based on content published by imper.ai: “Why impersonation detection just became its own category”.
Key questions
Q: What signs suggest an identity workflow has been impersonated?
A: Signs include a burst of recovery requests, changes to contact details or MFA factors, unfamiliar devices or IP addresses, repeated failed authentication followed by success, and parallel sessions from unusual locations.
Q: Why do help desk resets remain vulnerable to social engineering?
A: Help desk resets remain vulnerable because attackers can impersonate users, exploit urgency, and steer agents with partial personal data or convincing backstory details.
Q: How does candidate impersonation differ from workforce identity impersonation?
A: Candidate impersonation is when an applicant tries to deceive identity proofing, for example by using another person’s documents, synthetic identity elements, or a stand-in during verification.
Practitioner guidance
- Strengthen service desk verification Require step-up checks for resets, MFA changes, and urgent access requests, with clear rules for when staff must refuse the request.
- Separate low-risk and high-risk verification paths Use lighter confidence signals for routine interactions and reserve document, location, or live verification for moments that create new access or financial exposure.
- Add impersonation controls to recruiting workflows Define stronger checks for pre-offer, pre-provisioning, and high-risk roles so candidate verification becomes part of the hiring control model.
Bottom line: Impersonation is moving from an informal fraud pattern into a recognised identity governance problem spanning recruiting, onboarding, and account recovery.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Impersonation is now an identity governance category, not just a fraud pattern. Gartner’s emergence of workforce and candidate impersonation detection shows that the control problem is no longer confined to customer onboarding or isolated social engineering cases. The same trust abuse now spans employee lifecycle events, help desk recovery, and recruiting. Identity teams should read this as a signal that verification is becoming continuous and situational, not a one-time gate.
A few things that frame the scale:
- Impersonation fraud accounted for over 85% of all fraud attacks in 2025.
A question worth separating out:
Q: What should teams do when identity verification creates too much friction?
A: Teams should simplify the application journey without weakening assurance. That means removing unnecessary steps, improving user guidance, supporting a wider range of government issued documents, and using feedback to help applicants complete verification the first time. The best approach is to reduce avoidable friction while keeping controls strong enough to confirm that the applicant is real, eligible, and consistent with the submission.
👉 Read our full editorial: Impersonation detection is becoming a core identity control