Email Impersonation

How email impersonation works

Email impersonation relies on trust signals that recipients often process quickly: a familiar display name, a convincing sender domain, a thread that appears to continue an existing conversation, or a message header chain that is difficult to inspect manually. The attacker does not need to fully compromise an email system to create impact, because the goal is usually to trigger a human decision before verification happens.

In practice, the technique can range from simple lookalike domains to more advanced abuse of compromised mailboxes, forged headers, or mailbox rules that make malicious traffic blend into normal business communication. The danger comes from the fact that the message can look routine even when the underlying sender identity is false.

Common impersonation paths and why they succeed

The most common paths are brand impersonation, executive impersonation, supplier impersonation, and internal account impersonation. Each works by exploiting a different trust shortcut: brand familiarity, authority bias, payment urgency, or the assumption that an internal sender must be legitimate.

Email authentication controls reduce some of this exposure, but they are not a complete guarantee against fraud. A message can still appear credible when a real account is compromised, when the attacker registers a deceptive domain, or when the target is conditioned to act on the visible sender name rather than the underlying domain and authentication signals.

For practical reference on the defensive side, NHIMG’s Email Identity and BEC Guide covers the controls and patterns that most directly reduce impersonation risk.

Detection and verification signals

Detection works best when organisations combine technical signals with human verification. Mail gateway results, domain authentication results, unusual reply-to behaviour, first-time payment requests, and sudden changes in tone or urgency all matter, but no single signal should be treated as proof by itself.

Recipients should be taught to verify the request through an independent channel when the message asks for money, credentials, gift cards, file access, or a change in banking details. On the defensive side, mailbox monitoring, sender-domain review, and header inspection help identify whether the message is an outside forgery, a lookalike brand message, or a compromised internal account.

Containment after a successful impersonation attempt

If impersonation succeeds, the response is not limited to deleting the message. The organisation should treat the event as a potential trust breach affecting mail, identity, finance, and customer communications at the same time. If a mailbox was compromised, the attacker may have used it to reset passwords, harvest replies, or plant rules that preserve access.

That is why post-incident review should include message tracing, account activity review, rule and forwarding inspection, and verification of whether any actions were taken because of the fake message. Where payment or credential exposure occurred, the response often extends beyond email cleanup into account recovery and fraud containment.

External authority for the underlying email delegation and impersonation mechanics is available in RFC 8693: OAuth 2.0 Token Exchange, which helps explain why delegated access flows must be controlled carefully.

Risk and Threat Considerations

Email impersonation is dangerous because it weaponises trust at the point where employees are most likely to act quickly. The same technique can support fraud, credential theft, invoice diversion, malware delivery, or broader account takeover when the message convinces a recipient to click, reply, transfer funds, or approve access.

Failure mechanism: The attacker creates a believable sender identity and uses urgency, familiarity, or authority to bypass scrutiny before technical or human verification can intervene.

Impact: The result can be financial loss, account compromise, data disclosure, or a second-stage intrusion that starts with a single trusted-looking email.

Practitioner Guidance

Why practitioners should care: Email impersonation is not only an awareness problem, because it often exposes gaps in domain protection, mailbox security, and business process verification. Controls that look strong on paper can still fail if staff rely on sender appearance alone or if high-risk requests are not independently validated.

Governance implication: Ownership should sit across security, messaging, and finance or operations teams, since the right response usually combines email authentication policy, mailbox abuse monitoring, and clear verification rules for sensitive requests. The most effective programs treat impersonation as a business control issue, not just a spam problem.

Related resources from NHI Mgmt Group

• Why do email impersonation attacks still work in Zero Trust programmes?
• What do organisations get wrong about email impersonation controls?
• Why do email impersonation attacks keep bypassing content filters?
• Who is accountable when email impersonation leads to account takeover?