Meeting impersonation is the use of a false or manipulated identity in an online meeting to make participants believe the attendee is a different person. It usually involves stolen credentials, account takeover or synthetic media, and can undermine meeting access controls, attendee verification and authorisation for sensitive discussions.
What Meeting Impersonation Means in Practice
Meeting impersonation is not just a social engineering label, it is an access and trust problem. The core issue is that participants rely on a presented identity, display name, voice, or video presence to decide who is “in the room,” and that trust can be manipulated before anyone notices the mismatch.
In practice, that makes the threat bigger than simple deception. A fake attendee can join a board meeting, vendor call, incident bridge, or confidential planning session and influence decisions, harvest sensitive context, or create a false sense of legitimacy around later requests.
How Meeting Impersonation Works
The impersonation path usually begins with some form of stolen access or identity abuse, then adds presentation-layer deception. Attackers may use compromised meeting credentials, hijacked accounts, invite forwarding, or synthetic media to appear as a known person, sometimes combining more than one technique to reduce suspicion.
Many organisations focus on whether a meeting link is protected, but the real issue is whether the platform and the participants can verify the attendee’s identity at the moment it matters. If the meeting workflow does not clearly bind a person to their account, device, or prior verification step, an impostor can often blend in until they ask for something sensitive.
Why It Becomes Dangerous
Meeting impersonation is dangerous because meetings are often used for decisions, approvals, and disclosure of non-public information. Once an attacker is accepted as a real participant, they may collect secrets, observe internal language and process details, or pressure attendees into authorising something they would otherwise challenge.
It also undermines confidence in the meeting itself. When attendees cannot trust who is present, collaboration slows down, verification becomes ad hoc, and sensitive discussions may move to less secure channels. That creates both security exposure and operational friction.
What Stronger Defences Need to Cover
Defences should focus on identity verification, session control, and human confirmation paths, not just meeting link secrecy. Organisations should treat high-risk meetings as events that need stronger attendee verification, controlled admission, and a clear way to challenge unexpected participants before sensitive information is shared.
That also means protecting the upstream identity material that enables impersonation. If credentials, session tokens, or admin access are compromised, meeting controls may still fail even when the meeting platform itself is configured well. Hardening the surrounding identity layer is part of preventing the impersonation event, not a separate problem.
Risk and Threat Considerations
Meeting impersonation is risky because it exploits trust in human presence, not only technical access. The attacker’s objective is often to obtain confidential information, influence decisions, or redirect payments and approvals while appearing to be a legitimate attendee.
Failure mechanism: The attacker gains or forges access to a meeting identity, then uses familiar names, accounts, or synthetic media to pass as a trusted participant while bypassing informal verification habits.
Impact: Sensitive discussions can be exposed, decisions can be manipulated, and downstream fraud or account abuse can follow if participants rely on the impersonated identity for approval or authentication.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Meeting impersonation depends on weak attendee identity verification. |
| IA-5 — Authenticator Management | Stolen or abused credentials often enable meeting impersonation. | |
| AC-6 — Least Privilege | Limiting meeting and admin privileges reduces the blast radius of compromised identities. | |
| Recommendation — Enforce strong organizational-user authentication before participants can join sensitive meetings. Rotate and protect authenticators that could be reused to enter or impersonate meetings. Restrict meeting administration and sensitive-event access to the minimum required users. | ||
| NIST SP 800-63 | IAL2 — Identity Assurance Level 2 | Higher assurance identity proofing supports stronger confidence in who is present. |
| Recommendation — Use higher-assurance identity proofing for workflows that require trustworthy participant identity. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Impersonation commonly uses legitimate or stolen accounts to blend in. |
| T1111 — Multi-Factor Authentication Interception | Compromised authentication paths can enable account takeover used for impersonation. | |
| Recommendation — Detect and investigate legitimate-account abuse that enables unauthorized meeting participation. Hunt for MFA interception patterns that could precede meeting account takeover. | ||
Practitioner Guidance
What practitioners should care about: The most effective response is to make “who is this really?” a deliberate step in high-risk meetings, rather than assuming the platform’s attendee list is enough. That is especially important where executives, finance, legal, HR, or incident-response conversations are involved.
Common misunderstanding: A familiar display name, profile photo, or voice does not prove identity. Teams should be trained to use stronger verification cues when the meeting content or request is sensitive, unexpected, or time-pressured.
Practitioner takeaway: Treat meeting impersonation as a combined identity, access, and trust problem, and verify the person behind the presence before the conversation turns operational or financial.
Related resources from NHI Mgmt Group
- Guide: Pretexting Guide
- What is the difference between phishing and deepfake-based impersonation?
- How should security teams respond to deepfake impersonation of employees or executives?
- Who is accountable when a SAML implementation allows impersonation or outage?
- When should teams use impersonation instead of changing redirect URI settings?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org