Impersonation
Impersonation
The fraudulent practice of using someone else's account or name without permission to pose as that person.
In Simple Terms
Impersonation is when someone uses another person's account without permission, or fakes a name or address, to act online as if they were that person. For example, attackers log into someone's social media account and post fake messages, or pretend to be a friend to send scam emails. By stealing passwords to log in or forging an email's sender information, they make it look like the access or message really came from that person.
Behind the Name
"Impersonation" describes pretending to be someone else in order to deceive the people around you. Its technical counterpart is "spoofing," a broader term for technical methods used to deceive systems — for example, by disguising a sender's information. Both describe the same basic trick: hiding behind someone else's identity to fool others.
Take a Closer Look!
Impersonation is the fraudulent act of using someone else's name or account without permission to pose as that person online.
It generally breaks down into three types, each with its own mechanism and countermeasures.
1) Account takeover: attackers steal someone's ID and password to log in as that person.
This usually happens because of a weak password or a successful phishing scam.
Effective countermeasures include using complex, unique passwords and enabling two-factor authentication.
2) Fake account creation: attackers use a person's name and photos without permission to set up a brand-new, fake account.
This can lead to victims' followers being tricked into sending money, for example.
Since the real account itself is untouched, effective countermeasures include checking social media privacy settings and reporting the fake account to the platform.
3) Spoofing (sender forgery): attackers rewrite information like an email's sender details to pose as someone else.
This happens because of how communication systems work — sender information can be altered.
Countermeasures include setting up sender authentication (SPF and DKIM, plus DMARC, which checks that these match the displayed sender) and carefully verifying messages when they arrive.
Since impersonation comes in these different forms, it's important to apply the right countermeasure for each specific type.