Impersonation scams: when a trusted identity is the bait

The identity is borrowed; the request is the real signal

Impersonation scams work by borrowing trust that already exists. The scammer may claim to be a government official, police officer, bank employee, delivery company, employer, technology provider, friend or family member.

The contact can look convincing because scammers can copy branding, spoof caller ID, compromise real accounts, use leaked personal information or imitate a person's voice. Those details make the story feel familiar, but they do not authenticate the sender.

Common pressure patterns

The story usually gives you a reason not to verify normally:

• your money or account is supposedly at immediate risk;
• a fine, arrest, service cutoff or legal consequence is threatened;
• a refund or prize will disappear if you do not act now;
• a relative supposedly needs emergency money;
• a senior executive asks for a confidential payment;
• a company says you must call a number in the message to fix a problem.

For a copycat Facebook or Instagram account, use the social-profile verification worksheet to compare the exact identity and requested action without treating a badge or follower count as proof.

The safest question is not “Does this look official?” but “Why am I being asked to act outside the normal process?”

Verify outside the conversation

Leave the message, call or chat. Find the organization's official website or app yourself, or contact the person through a number you already know. Do not use the suspicious message to verify itself.

If the contact is genuine, independent verification should not create a problem. Resistance to verification, secrecy or pressure to stay on the line are reasons to stop.

If the impersonator already has personal details

Knowing your name, bank, employer, address or recent transaction does not prove legitimacy. Personal data can come from breaches, public records, social media, stolen accounts or previous scams.

Treat the requested action as the stronger signal: unusual transfers, gift cards, cryptocurrency, remote access, passwords, one-time codes or demands to keep the matter secret deserve immediate independent checking.