A brand impersonation scam is a fraud that uses a trusted company’s name, logo, or voice to trick people into revealing secrets, sending money, or approving access. In cybersecurity, it often relies on spoofed domains, fake support messages, cloned websites, and social engineering to compromise human or non-human identities.
How brand impersonation scams work
Brand impersonation scam exploit the trust people place in familiar names. The scammer borrows a brand’s credibility, then pushes the target toward an urgent action such as entering credentials, approving a login, making a payment, or sharing a one-time code.
The social engineering usually succeeds because the message feels routine, time-sensitive, or helpful. Attackers may use a spoofed sender identity, a lookalike domain, a cloned login page, a fake support chat, or even voice cloning to make the request seem legitimate.
Why they are dangerous
These scams are dangerous because they do not need to defeat strong technical controls first, they only need to persuade the target to act on the attacker’s behalf. That makes them effective against both human identities and the systems or workflows that humans approve on trust.
Once a target enters secrets or approves an action, the scam can turn into account takeover, fraudulent payment, unauthorized access, or delegated abuse. In enterprise settings, the same pattern can be used to trick staff into granting access to a business application, cloud console, or support channel.
Brand impersonation also scales well. A single lure can be reused across many victims, and the same fake brand presence can be adapted for phishing, invoice fraud, payroll diversion, help-desk abuse, or session theft.
Common impersonation techniques and indicators
Common techniques include cousin domains, homograph lookalikes, cloned landing pages, fake password resets, fake delivery notices, and messages that ask for an out-of-band confirmation. Some campaigns add phone calls or chat follow-up to increase pressure and reduce the chance that the target checks independently.
Useful indicators include slight spelling changes, mismatched domains, unexpected urgency, requests for credentials or payments, and support requests that do not follow the brand’s normal process. The presence of a real logo or correct branding is not proof of authenticity, because those elements are easy to copy.
Brand impersonation is often strongest when the scam blends technical and social cues, such as a believable sender display name plus a link that resolves to a convincing fake site. The target experiences the interaction as ordinary, which is exactly what the attacker wants.
How organisations reduce exposure
Organisations reduce exposure by making brand trust harder to fake and easier to verify. That includes domain monitoring, domain protection, message authentication, customer-facing verification steps, and clear rules for when staff or customers should stop and re-check a request through an independent channel.
Security teams also need to watch for brand abuse outside the perimeter, including lookalike domains, cloned support pages, fake mobile apps, and social media impersonation. The best defence is usually layered: public education, strong identity verification, abuse reporting, and rapid takedown processes.
For the identity side of the problem, the issue is often not the brand itself but the approval path. When a scam convinces someone to grant access, approve a prompt, or share a secret, the trust boundary has already been crossed. Phishing Guide is useful here because it covers lookalike domains, counterfeit websites, and layered defences that also apply to brand impersonation.
Risk and Threat Considerations
Brand impersonation scams create direct financial, access, and reputation risk because the attacker is borrowing a trusted identity to bypass normal suspicion. They are especially effective when the target believes the request is part of an established business process, support interaction, or account recovery flow.
Failure mechanism: The scam works by substituting attacker-controlled communication for a trusted brand interaction, then converting that borrowed trust into credential capture, payment diversion, or unauthorized approval.
Impact: The result can be account compromise, fraudulent transfers, help-desk abuse, unauthorized tool access, or wider trust erosion when customers and staff become less able to distinguish real brand activity from abuse.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Brand impersonation scams use phishing-style social engineering to trick targets into action. |
| Recommendation — Map impersonation lures to phishing tradecraft and monitor for delivery, credential capture, and user interaction patterns. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Scams often steal secrets or session material to impersonate a trusted user or service. |
| Recommendation — Harden authentication flows and detect attempts to reuse stolen credentials or session tokens. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Brand impersonation frequently aims to obtain or misuse authenticators, codes, and tokens. |
| Recommendation — Manage authenticator lifecycle tightly and reduce exposure of reusable secrets and one-time codes. | ||
| CIS Controls v8 | CIS-14 — Security Awareness and Skills Training | User deception is central to brand impersonation fraud and social engineering. |
| Recommendation — Train users to verify high-risk requests through trusted out-of-band channels. | ||
| NIST SP 800-63 | phishing-resistant auth — Phishing-Resistant Authentication | Impersonation scams often succeed when users can be tricked into revealing reusable credentials. |
| Recommendation — Prefer phishing-resistant authenticators for sensitive access and approval flows. | ||
Related resources from NHI Mgmt Group
- Who is accountable when brand impersonation leads to fraud or credential theft?
- How should security teams operationalise digital risk protection for brand and executive impersonation threats?
- Why do SPF, DKIM, and DMARC reduce the risk of phishing and brand impersonation?
- How should crypto compliance teams adjust controls when scam revenue falls but impersonation scams keep rising?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org