Impersonation Scam Prevention: Verify Before Acting

Impersonation scams succeed by making an unexpected request appear to come from someone you trust. This guide applies when a message, call or webpage claims to represent a person or organization and asks you to act.

Read the message element by element

A typical message may say: “This is your service provider. Your account has a problem. Act immediately through this link to confirm your information.” Each element has a purpose: the sender creates trust, the claim creates concern, the deadline blocks reflection, the link controls where you respond, and the requested information delivers the payoff.

Make the decision in this order

1. Stop before replying or clicking. Do not use contact details, links or reference numbers supplied in the unexpected message.
2. Inspect the sender. Expand the email address or account details and look for misspellings, unrelated domains or a display name that hides a different address. Caller ID and familiar profile images are not proof of identity.
3. Separate the claim from the pressure. Write down what supposedly happened, then ignore threats of immediate closure, punishment or loss while you verify it.
4. Examine the requested action. Treat requests for passwords, verification codes, payment, remote access or sensitive documents as unsafe until independently confirmed.
5. Avoid the supplied link. Open the organization’s official website yourself or use a trusted contact method already saved in your records.
6. Verify through a second channel. Ask the claimed sender whether the request is genuine, without forwarding the suspicious message as your only explanation.
7. Preserve evidence and report it. Save the message, sender details, webpage address and call information before blocking the contact.

If you already responded

• Change any exposed passwords from a trusted device and replace reused passwords elsewhere.
• Contact your bank or payment provider immediately if money or financial details were involved.
• Tell the affected organization that someone impersonated it.
• Review account sessions, recovery details and recent activity, then sign out unfamiliar devices.
• Report exposed verification codes or identity documents to the relevant account provider and local fraud authority.

Most common warning signals

• The sender claims to be a trusted person or organization but contacts you unexpectedly.
• The message creates urgency or threatens immediate negative consequences.
• A supplied link is presented as the required way to resolve the issue.
• The sender requests passwords, verification codes, payment or sensitive documents.
• The displayed sender name does not match the underlying email address or account.
• The sender discourages independent verification or insists that you remain in the same conversation.

What to do now

1. Stop replying, clicking links or following instructions from the sender.
2. Verify the claim using contact details obtained independently.
3. Change exposed passwords and revoke unfamiliar account sessions.
4. Contact the payment provider immediately if money or financial details were shared.
5. Save the message and report the impersonation to the affected organization and fraud authorities.

Sources

• www.infosecurity-magazine.com
• heimdalsecurity.com
• www.group-ib.com
• cyble.com
• www.proofpoint.com

Further reading

• Impersonation Scams in 2026: 7 Checks Before Paying
• Investment Scam Prevention Guide: Verify First
• Job Scam Campaign Trend Analysis and Damage Control

FAQ