What is impersonation?
Impersonation is pretending to be someone the target already trusts or would normally obey, in order to get information, access or money. The attacker may pose as a specific person, such as the CEO, a coworker or a named vendor contact, or as a role that carries built-in authority: an IT support technician, an auditor, a delivery driver, a building inspector or a new employee. The disguise does the work. People who would refuse a stranger will often help someone who appears to belong.
The story that explains why the impersonator needs something is the pretext, and deepfake audio or video can make the disguise far more convincing. Both have their own pages; impersonation is the act of claiming the identity.
Where impersonation happens
- In person: a visitor in a vendor's uniform asks to be let into a wiring closet or follows staff through a secured door.
- By phone: a caller claims to be an employee locked out of an account, or the help desk calling about a security problem.
- By email and chat: a display name and lookalike domain imitate an executive or supplier, or a message arrives from a real account the attacker has taken over.
- On social media and websites: fake recruiter profiles, cloned brand pages and support accounts that ask users to verify their logins.
A help desk example
A caller tells the service desk she is a regional sales manager, traveling with a new phone, and can't sign in because MFA prompts go to her old device. She knows her employee ID and her manager's name, both easy to find or guess, and she is in a hurry for a client meeting. If the technician resets her password and MFA on the strength of that call, the attacker now holds a real account. Reporting on the 2023 MGM Resorts breach described a call like this to the IT help desk as the way in. A sound procedure refuses resets based on facts an outsider could learn and verifies through something the caller doesn't control: a callback to the number in the HR directory, approval from the user's manager through a separate channel, or an in-person check of photo ID.
Warning signs and defenses
Impersonation tends to show the same tells. The visit or request wasn't scheduled, it skips the normal process, it asks for more than the role needs, it comes with urgency or name-dropping, and the person pushes back on verification. The defenses are mostly procedural:
- Verify identity through a separate, known channel before acting on any request for access, credentials or payment.
- Give staff explicit permission to challenge and delay anyone, including people who claim seniority.
- Use visitor sign-in, badges and escorts, and confirm contractor work orders with facilities.
- Tag external email, enforce DMARC and teach users to check the real sender address.
Impersonation vs. related terms
- Pretexting: the cover story; impersonation is the identity the attacker claims while telling it.
- Spoofing: forging technical identifiers such as a caller ID, email header or IP address, often the technical half of an impersonation.
- Deepfake: synthetic voice or video that makes an impersonation look real. When a scenario mentions a cloned voice or fake video, deepfake is the more specific answer.
- Tailgating: getting through a door behind someone, which may or may not involve pretending to be anyone.
Impersonation on the CompTIA Security+ exam
Impersonation appears twice in SY0-801: objective 2.3 lists it among human-based threat vectors, and objective 2.5 includes it among the social engineering attacks you should recognize from their indicators. Scenario wording such as "claims to be from IT", "a man in a uniform says the property manager sent him", "an email that appears to come from the CFO" or "the caller knew an employee ID but the request was unscheduled" points to impersonation. The best answer is usually a verification step through an independent channel. Distractors include pretexting, vishing, which names the phone channel, spoofing and deepfake. Impersonation also appears in A+ Core 2 (220-1202) objective 2.5.