How do attackers use impersonation fraud?

How impersonation fraud works in practice

impersonation fraud is an access-and-trust attack, not just a communication trick. The attacker is trying to make the target treat a false request as routine by borrowing the credibility of a known person, role, supplier or institution. The method works because many organisations still rely on names, tone, logos and timing cues instead of stronger verification for sensitive actions.

The fraud usually succeeds when the victim is moved out of normal decision-making. A request that arrives through email, phone, text or chat may feel familiar enough to bypass scrutiny, especially if it asks for a rapid payment, a password reset, a bank detail change or another high-impact action. In that sense, the core exploit is social engineering wrapped around a business process failure.

At a technical level, impersonation fraud can be the opening move for credential theft, account takeover or payment diversion. That is why phishing-resistant verification, out-of-band call-backs and approval gates matter for high-risk workflows. The common pattern is not merely “someone lied”, but “someone inserted themselves into a trusted process and redirected the outcome.”

Why authority and urgency are the attacker’s strongest tools

Attackers lean on authority because people are conditioned to comply with seniority, vendor relationships and urgent operational pressure. They often impersonate executives, finance staff, IT support, banks or suppliers because those roles naturally issue requests that others are expected to act on quickly. Familiarity lowers resistance, and urgency reduces the chance that the target will pause to verify.

The technique also works because many organisations have uneven controls across channels. A team may have strong login protection but weak protection around invoice changes, payroll updates or help desk resets. When the control gap sits in the workflow rather than the mailbox or phone system, the attacker only needs one convincing interaction to trigger a loss.

For broader context on the abuse patterns behind these schemes, see CISA cyber threat advisories and FinCEN, which help frame how fraud, social engineering and financial abuse show up in real operations.

Controls that interrupt impersonation fraud before money or access moves

The most effective defences are process controls, not just awareness training. High-risk requests should require a second channel, a known contact method and a clear approval path. If a request changes payment details, resets an account, adds a beneficiary or exposes sensitive data, the organisation should make verification a mandatory step rather than an optional judgment call.

Staff also need simple rules they can apply under pressure. A request that arrives unexpectedly, changes instructions at the last minute, or discourages verification should be treated as suspicious until proven otherwise. Teams should know which requests are exempt from normal speed expectations and which ones require escalation to a supervisor, treasury, help desk or security function.

Where the fraud touches payment rails, Authorised Push Payment fraud guidance is useful because it shows how impersonation scams translate into bank transfers, mule accounts and reimbursement disputes. Where the fraud is used to steal access rather than cash, token and delegation misuse become part of the same trust problem, which is why standards such as RFC 8693: OAuth 2.0 Token Exchange are relevant when organisations design controlled on-behalf-of flows.

Risk and Threat Considerations

Impersonation fraud is dangerous because it bypasses controls that assume the requester is genuine. Once the attacker can steer a trusted workflow, the result can be direct financial loss, credential compromise or unauthorised changes to accounts and records. The same playbook also scales well across organisations because it targets human trust and process gaps, not a single vulnerable system.

Failure mechanism: The attacker abuses a believable identity, channel or sense of urgency to push the victim past verification and into an action that benefits the fraudster.

Impact: The organisation may suffer fraudulent transfers, exposed credentials, compromised accounts, data loss or delayed detection because the action looked legitimate at the point of execution.

Practitioner Guidance

What to prioritise: Put the strongest controls around instructions that can move money, change bank details, reset accounts, approve exceptions or expose sensitive data. Those are the workflows where impersonation fraud converts fastest into real loss.

What to verify: Check whether staff can name the exact out-of-band verification step for each high-risk request type, and whether the approver is independent of the requester. If the answer is vague, the workflow is still too easy to abuse.

Practitioner takeaway: The right defence is to make trust expensive for the attacker, by forcing unusual requests through deliberate verification before any irreversible action is taken.

Related resources from NHI Mgmt Group

• How should organisations reduce CEO fraud risk when attackers use executive impersonation and urgent payment requests?
• How should security teams reduce supplier invoicing fraud when attackers use both impersonation and compromised accounts?
• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?