An impersonation attack is a scheme in which someone pretends to be a trusted person, brand, or office to obtain money or access.
The pretence can use a similar email domain, a copied website, a phone call, or a social profile with a familiar photo.
How it works
An attacker writes to a finance clerk as the chief executive and asks for a secret transfer before the board meeting.
A second pattern copies a bank login page so customers type the real password into the wrong site.
The company may send money to a criminal account, or the customer may hand over a mailbox that later exposes invoices and contacts.
Trust is the tool, so the technical system can be healthy while the person still acts on a lie.
Concrete examples
- A caller claims to be the help desk and asks an employee to read out a login code from a text message.
- A lookalike domain one letter off from the supplier sends a revised contract to the purchasing desk.
- A social profile copies a mayor's photo and asks residents to pay a fee into a private account.
Protective measures
- Publish the domains and phone numbers you really use so customers can compare a message with a list you control.
- Require a second approval for payments above a set amount, even when the request appears to come from a director.
- Train staff to hang up and call the help desk back on an internal number when a caller asks for a code.
- Register obvious lookalike domains of your brand where you can, and watch for new ones that start sending mail.
Related articles
Readers who want more on a finance department should open What are email filters? next.
For day to day work on a finance department, add What are email scams? to the same reading list.
People who look after a finance department compare this explanation with What is anti phishing protection?.