Impersonation Scams: Verify Others, Protect Your Name

Mistake: Approving changed supplier details without a callback

Approving revised supplier bank details without calling back can cause the greatest loss. An instruction may appear to come from a manager or payroll, then direct a payment to a fraudulent account. The request can arrive while you are in a meeting, presented as an invoice payment or urgent change.

Other versions ask for revised bank details, a staff list, gift cards, or login approval. Being told not to check is a warning, not a reason to comply. Treat any unexpected payment instruction as unverified, even when it arrives through a familiar channel or appears to come from someone senior.

Confirm using an internal channel you already use, a number from the company directory, the company system, or an in-person visit. Make callback confirmation a policy for payment changes. A shared procedure means no individual has to bear the awkwardness of challenging a request alone.

Mistake: Treating familiar signals as proof of identity

A familiar caller ID, name, logo, message format, or reference number does not prove who contacted you. These details can be copied, caller ID may be spoofed, and a genuine colleague's mailbox may be controlled by someone else. A real email address does not make a message safe.

Caller ID is not verified end to end. Sender and profile names are free text, while letters and printed notices can be copied. A voice is not identification either: short speech samples can be used to produce a convincing imitation. Treat an unexpected familiar voice as a claim, not confirmation.

Start a fresh contact using a route you already know. Apply the same principle when an identity check involves your own information; identity verification both ways explains why the request and the information you share both need scrutiny.

Mistake: Letting the claimant choose how you verify them

A threat claiming to come from a government agency may invoke taxes, police, courts, immigration, or benefits. It can allege a debt, warrant, compromised identity number, visa problem, or investigation, then add an immediate deadline, secrecy, and an unusual payment demand.

Hang up and find the agency number or account portal yourself. Agencies write to people, but do not demand gift cards or cryptocurrency. No genuine investigation requires you to hide the matter from your bank or family. If someone claims to be your bank's fraud team, end the call and dial the number printed on your card.

A caller posing as a bank protector may ask you to move money to a safe account, read out codes, approve a login, or install software. No bank moves your money to keep it safe or needs a code sent to you. Check claims through a route you find independently:

Do not use contact details supplied by the claimant, and give yourself time to call back. Nothing genuine collapses during the ninety seconds that takes, while impersonation attempts depend on you not pausing. Verify the route independently even if the caller ID matches your bank's real number.

Mistake: Assuming an unsolicited support offer or small fee is harmless

Fake technical support may arrive through a search result, pop-up, advertisement, or reply to your public complaint. The supposed helper may seek remote access or payment for a subscription you never bought. An unsolicited offer to fix an unreported problem is not trustworthy, even when it looks helpful.

Start support inside the app or from a bookmark. Do not follow a support contact that approaches you about a problem you have not reported. Beginning from a route you already trust separates a real support request from an unexpected message designed to gain access or money.

A delivery, utility, or subscription message may cite a small fee, redelivery, an expiring card, or an over-payment refund. The amount can be deliberately trivial because the aim is to get card details, not the fee. Open the company's own app or account page; a delivery or refund should appear there, or it is not real.

A fake brand support account may reply to your complaint from a near-identical handle, then move you to a private message and a link or payment. Start from the brand's verified profile or website, and do not follow an account that approached you first. A badge is weak evidence because some platforms let people buy one.

Mistake: Trusting an urgent voice without checking another way

A relative or friend may call from a new number and explain a bad connection with an accident, arrest, or broken phone. Urgency combined with a request for money or secrecy from the family does not prove identity, even when the voice sounds familiar or the story seems plausible.

Call the person using the number already saved in your contacts, then contact another family member. Agree on a simple family question in advance; it can help even against a convincing voice. Verify a relative or friend in trouble through a route you already have, not one introduced during the emergency.

Mistake: Continuing after a demand for money, access, or secrecy

A demand for money, account access, or secrecy is enough to stop the interaction. You do not have to identify the caller or prove the claim false before ending the exchange. Common demands include:

Gift cards are also a frequent demand made to private sellers. If a buying or selling exchange raises this concern, review marketplace scams. Do not continue just to work out who is behind the request; any one of these demands is enough to end contact.

Mistake: Reporting a fake profile before preserving evidence

A cloned profile, fake account using your photos, copied business page, or false statement attached to your name can mislead people who trust you. Reporting immediately may remove the account and its evidence, leaving you with less information to show what happened or what was sent in your name.

Before reporting, save profile URLs and handles, screenshots of the account and its content, dates, and messages sent in your name. Keep the material together so you can refer to it during the platform report and any later follow-up.

Use the platform's dedicated impersonation reporting route, not an ordinary abuse report. Find it through the official Help Center or app. Routes include Instagram's Report an account that's impersonating you, Facebook's Report a profile or Page pretending to be you or someone else, X's impersonation report, LinkedIn's Report a fake profile, and TikTok's Report an account for impersonation.

Menu wording can change, so do not start from a search advertisement or a message. A form may request the fake profile URL, the account being copied, your contact information, and proof of identity. Provide identity documents only through the platform's official reporting flow, never by direct message to the fake account.

A platform may ask for a government-issued ID or other documentation, and its form explains acceptable proof. Requirements and review times vary, and a report does not guarantee removal. Tell your circle before the fake account does: a short post saying someone copied your account and you are not asking for money can help prevent losses. Ask people to report the account, not engage with it.

Do not contact the impersonator, since that confirms the account is worth running and may escalate into harassment. A public profile audit can help you review what is exposed. Public photos, friend lists, and posts provide material for convincing copies; reviewing visibility and friend-list exposure reduces what is available for another attempt. The existing privacy settings are another place to check.

Mistake: Treating a copied profile and a stolen account as the same problem

A fake copy and an account takeover are different problems. With a copy, your actual account may still be yours; with a takeover, somebody else controls it.

Treating both situations alike can leave the real account exposed or cause you to overlook the recovery steps needed for an account under someone else's control.

For a takeover, sign in from a device you trust, change the password, sign out every other session, check the recovery email and phone, and turn on a passkey. Keep recovery details current, since stale ones can allow an account to be taken permanently. The full sequence is in account security.

Make public accounts harder to misuse by choosing a passkey or security key instead of text codes where available. Agree on a family verification question in advance through this family check, and treat pressure to act at once as a sign to verify first. The phishing scams checklist is built around that caution.

Public friend lists, birthdays, employers, and photo archives give impersonators material to make a copy convincing. At work, make callback confirmation for payment changes a policy. For account warning signs, review account security risks; for the messaging side, CISA's guidance on recognizing and reporting phishing is a usable starting point.

Mistake: Waiting to act after money or personal information is misused

If money moved, whether yours or someone else's, report it and work through scam reporting and recovery.

If personal information was taken or misused, contact the affected account provider through a route you find independently and keep copies of reports and messages. Act promptly, but do not assume a report guarantees recovery.

In the US, report consumer fraud to the FTC and internet-enabled crime to the FBI's Internet Crime Complaint Center. FTC guidance on what to do after a scam organizes advice by payment method. Submit reports at ReportFraud.ftc.gov and ic3.gov if the crime happened online; these reports do not guarantee an individual investigation or recovery.

Both forms ask for core details: what happened, the date, amount, payment method, names and handles used, and copies of messages or screenshots. Keep those records available when submitting a report. FTC and IC3 reports do not guarantee an individual investigation or recovery, so preserve your own copies as well.

If personal information was stolen or misused, use the FTC's IdentityTheft.gov recovery plan, notify the affected bank or account provider through a route you find independently, and keep copies of your reports. You can also follow identity theft steps and review identity verification risks.

Ask Equifax, Experian, or TransUnion to place a fraud alert; asking one bureau triggers notice to the others. A credit freeze can be requested separately from each bureau. Fraud alerts and credit freezes are free. You can also report identity theft to local police and ask for a copy of the report for your records.

Whether an institution needs a police report depends on the circumstances. The FTC's Government and Business Impersonation Rule addresses deceptive impersonation of government entities and businesses, but not every person-to-person impersonation. The Identity Theft and Assumption Deterrence Act is federal criminal law addressing misuse of another person's identifying information; law enforcement decides whether it applies to a specific case.

Do not assume there is a fixed response time: platform review times vary, and reports to the FTC or IC3 do not promise an investigation or recovery. FTC and IC3 reports, as well as credit freezes, are free. You can file reports yourself without paying a recovery service, and dating-profile impersonation can be reported through the platform's impersonation route after saving evidence.

Mistake: Letting personal details stand in for identity proof

Knowing your address, account details, or a recent transaction does not prove that a caller is genuine. Personal details can come from breaches, receipts, and public posts, then make an opening seem credible.

A claimant's knowledge may persuade you to trust the contact, but it does not establish who is actually speaking.

Reduce the material available for a copied identity by reviewing what is public, including photos, friend lists, birthdays, and employers. Public information may give an impersonator details to build a convincing approach, so check visibility rather than treating a caller's knowledge as confirmation.

If someone is using your photos on a dating profile, save evidence, report it through the platform's impersonation route, and tell people likely to be contacted. Do not engage with the account; report suspected fraud to the authorities as well as the platform.