S.M.M.

Stop Manipulating Me · A Field Guide to Psychological Influence

ENTRY No. T12.12
CATEGORY Deception
CLEARANCE Public / Essential
EDITION 01
Dossier · Manipulation Tactic

Impersonation

Impersonation · Identity Spoofing · Very Common
Critical
How It WorksSEC 01

Impersonation is pretending to be a specific person or role to win the trust or access that identity commands. It is the engine beneath many of the costliest frauds — business email compromise, executive and agency-official scams, tech-support and bank impersonation, and grandparent/relative-in-distress schemes. The tactic exploits trust transfer and authority: we extend to a recognized identity a level of compliance we would never grant a stranger, and impersonation simply borrows that recognition.

The mechanism pairs a stolen persona with authority and urgency. Richard Dawkins and John Krebs framed signaling between organisms as manipulation exploiting a receiver’s response system; impersonation is the human case — it counterfeits the identity cues we use as shortcuts for “safe to comply.” Spoofed sender names, look-alike numbers, cloned accounts, and (increasingly) synthetic voice or video make the persona convincing, while a time-critical, keep-it-quiet request suppresses the verification that would expose it. Authorized role-play exists in sanctioned security testing; malicious impersonation is distinguished by its refusal to be verified.

Because the persona can be faked but the person can be reached, the defense is out-of-band authentication. Call back on a known number, enforce dual-approval process for money and access regardless of who is asking, agree on a shared code phrase for urgent requests, and treat the combination of urgency plus secrecy plus resistance to verification as the reliable signature. A genuine contact welcomes the callback; an impersonator needs you to skip it.

Warning SignsSEC 02
  • Channel anomaly. The "person" contacts you somewhere they never use for this — a personal number for a work request, a new address for the boss, DM instead of official line.
  • Urgency plus secrecy. An unusual, time-critical ask paired with a reason to keep it quiet or skip normal process.
  • Refuses verification. Resistance to "let me call you back on your known number" — excuses for why you can't confirm independently.
  • Authority pressure. Invokes rank, agency, or relationship to discourage the questions you'd normally ask.
  • Off-pattern request. A payment, credential, gift card, or access request that deviates from how this person or office normally operates.
Frequently Paired WithSEC 03
  • Deepfakes · T12.9
    Synthetic face/voice makes impersonation live and convincing
  • Pretexting · T14.7
    The fabricated backstory an impersonator inhabits
  • Forged Authority / Credentials · T2.13
    Fake role backed by fake standing
  • Relative-in-Distress Scam · T24.21
    Impersonation aimed at family emotion
How the Impersonation LandsSEC 04
  • Stage 01 · Assume Identity
    The attacker adopts a trusted persona — executive, agency official, IT, bank, relative — often with spoofed names, numbers, or accounts.
  • Stage 02 · Apply Authority & Urgency
    The borrowed status plus a time-critical, keep-it-quiet ask suppresses the verification you'd normally perform.
  • Stage 03 · Extract
    You wire funds, hand over credentials or access, or bypass process — before contacting the real person through a known channel.
Counter-ProtocolSEC 05
Defense: Authenticate the person, not the persona — verify out-of-band through a known contact before acting.
  • Call back on a known number. Independently reach the real person or office using a saved/official contact — never the number, link, or address the request supplied.
  • Enforce process for money and access. Require dual approval and standing verification steps for payments, credential changes, and access grants; let policy, not rank, gate the action.
  • Use a shared code phrase. Agree in advance on a verification word for urgent family or executive requests; the real person can supply it, an impersonator usually can't.
  • Treat urgency + secrecy as the tell. An unusual ask that also can't wait and can't be checked is the signature of impersonation — slow down precisely there.