Reduce police impersonation scams by telling users that genuine officers do not demand secrecy, payment over the phone, or immediate transfers to a safe account. Build verification steps that require ending the call and contacting the organisation through a known number. Add transaction warnings for urgency, fear language, and requests to move funds quickly.
How to reduce the success rate of police impersonation scams
The most effective mitigations interrupt the scammer’s ability to create urgency and authority at the same time. People should be coached to distrust secrecy, immediate payment demands, and “safe account” transfers, then verify the caller independently by hanging up and using a trusted number. Transaction friction helps because it buys time for doubt, confirmation, and escalation.
Design the controls around behaviour, not just awareness. A scammer often succeeds by keeping the target on the line, pressuring them to act before they can verify, and framing the request as confidential or urgent. The mitigation therefore has to make the payment path slower, more visible, and easier to question than the scammer’s script.
What verification steps actually break the impersonation pattern
The strongest verification step is a hard break in the conversation. Users should be told to end the call, wait, and contact the organisation through a known number or official channel, rather than calling back on the number provided by the caller. That simple reset removes the attacker’s control of the interaction and prevents the scammer from improvising around objections.
Verification should also be tied to a clear rule: real officers do not demand secrecy, do not ask for payment over the phone, and do not tell people to move money into a new account to keep it safe. Those are not just suspicious signals, they are the exact cues that should trigger a stop-and-check decision before any transfer is made.
Authorised Push Payment (APP) Fraud Guide is the most directly relevant NHIMG guide for this pattern because it covers impersonation scams, safe-account fraud, confirmation of payee, and payment controls that reduce scam conversion.
Where warnings and payment controls reduce harm fastest
Warning design matters most at the point of payment, not at the point of education. Alerts that appear when a user is about to transfer funds under urgency, fear, or confidentiality pressure can interrupt the scam narrative and force a second thought. Good warnings are specific, timed to the action, and framed as a verification prompt, not a generic risk notice.
Payment friction is also useful because it gives the organisation time to detect patterns that look like coercion. A transfer delay, additional confirmation step, or review threshold can stop an impulsive transaction long enough for the user to re-check the request and for the institution to surface a scam warning. In practice, the best mitigations are the ones that make rushed payment harder than safe verification.
CISA cyber threat advisories provide a useful external reference point for understanding how social engineering and impersonation campaigns are presented to defenders, especially when building awareness and response material.
Risk and Threat Considerations
police impersonation scam work because they combine authority, urgency, and fear. The main risk is not just fraudulent payment, it is the collapse of normal decision-making under pressure, which can lead victims to ignore warnings, bypass trusted channels, and disclose sensitive information or approve transfers they would otherwise reject.
Failure mechanism: The attacker keeps control of the conversation long enough to prevent independent verification, then drives the victim toward a fast transfer or other irreversible action by using secrecy, threat language, and a fabricated need to protect funds.
Impact: Victims may lose money quickly, and the same coercive script can be reused to obtain account access, personal data, or additional payments if the target remains engaged.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-17 — Incident Response Management | Impersonation scams need rapid reporting and response handling. |
| Recommendation — Standardise scam reporting and escalation so suspicious payment requests are triaged immediately. | ||
| NIST CSF 2.0 | PR.AA-05 — Authenticator Management | Independent verification and trusted-channel recontact depend on sound authentication controls. |
| DE.CM-08 — People, assets, data, and systems are monitored to find anomalies | Transaction warnings and behavioural cues rely on detecting unusual payment patterns. | |
| Recommendation — Require users to re-authenticate through a trusted channel before approving unusual payment actions. Monitor for urgent, atypical, or coerced payment behaviour and trigger step-up review. | ||
| NIST SP 800-53 Rev 5 | AT-2 — Awareness Training | Users must recognise impersonation cues such as secrecy and urgent transfer demands. |
| AC-3 — Access Enforcement | Payment friction is an access decision over high-risk transaction actions. | |
| Recommendation — Train users to challenge secrecy, urgency, and safe-account requests before paying. Enforce approval checks on unusual or high-risk transfers before execution. | ||
Practitioner Guidance
What to prioritise: Put the strongest friction at the moment a user is about to send money, because that is where the scam becomes costly. The goal is not to eliminate every suspicious call, but to slow any action that would move funds outside normal verification.
What to verify: Test whether the user can easily leave the call, find a trusted contact number, and re-initiate contact without relying on the caller’s instructions. If that path is unclear, the control is too weak.
Decision rule: If the request includes secrecy, urgency, or a demand to move money to a “safe” account, treat it as a verification event, not a normal service interaction. The right next step is to stop the transaction and confirm independently.
Practitioner takeaway: The most effective defence is a predictable interruption of the scammer’s tempo, because once the victim can pause, verify, and re-contact the organisation through a trusted path, the impersonation usually loses force.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org