Impersonation

Impersonation uses a borrowed identity, role, organisation, authority, service, platform, supplier, or physical role to make a request appear trustworthy enough to act on. The objective may be an action, disclosure, access decision, approval, payment, or process exception that would be refused if the requester were correctly attributed.

The borrowed identity may be presented through a name, role, account, voice, video, brand, badge, uniform, or platform. A genuine account or recognisable likeness can make the identity appear authentic, but identity evidence does not establish that the requested action is expected or authorised.

A genuine identity can also carry an unsafe request. The person or account may be compromised, coerced, mistaken, operating outside process, or relaying another party’s instructions. Assessment therefore considers both the identity and the request.

Impersonation can be assessed by asking:

• What identity or role is being presented?
• What trust does that identity create?
• What action is being requested?
• What identity, verification, approval, or workflow check is being avoided or weakened?

---

Techniques

Impersonation includes the techniques below. Select a technique to open its behavioural method, common examples, relevant taxonomy boundaries, and control-domain orientation in the Technique Catalogue.

• SE-T001.001 — Executive or Senior Leader Impersonation — Posing as a senior leader or decision-maker so that authority, urgency, or seniority discourages scrutiny.
• SE-T001.002 — Internal Staff Impersonation — Posing as a colleague or internal role to trade on familiarity, workflow trust, and assumed legitimacy.
• SE-T001.003 — Helpdesk or IT Support Impersonation — Posing as technical or identity support to influence credential, access, device, or MFA actions.
• SE-T001.004 — Supplier, Vendor or Partner Impersonation — Posing as an external organisation with an existing or plausible business relationship.
• SE-T001.005 — Authority, Regulator or Law Enforcement Impersonation — Posing as an official authority to manufacture fear, compliance pressure, or a sense of obligation.
• SE-T001.006 — Customer, Client or Community Member Impersonation — Posing as a legitimate external stakeholder to influence service, support, access, or information-handling decisions.
• SE-T001.007 — Physical Role Impersonation — Posing as someone with a legitimate physical reason to be onsite or near assets, people, or restricted spaces.
• SE-T001.008 — Digital Service or Platform Impersonation — Posing as a trusted technology platform, portal, service, or digital brand.
• SE-T001.009 — Synthetic Media or Deepfake Impersonation — Using generated or altered voice, video, image, or writing to make a borrowed identity appear authentic.
• SE-T001.010 — Compromised Account Impersonation — Using a genuine but compromised account or session to impersonate a trusted user, supplier, or role.

---

Behavioural Indicators

Impersonation activity tends to show up as a combination of the behaviours below rather than through one behaviour alone.

Identity and role presentation

• borrowing a trusted name, role, brand, job title, team, service, supplier, or organisation
• adopting the language, tone, and terminology the claimed identity would be expected to use
• reproducing a familiar display name, signature block, logo, email template, badge, uniform, portal, or document style
• using a cloned voice, a deepfake video likeness, or AI-generated correspondence so the identity sounds or looks authentic
• sending from a genuine but compromised account, or inserting into an existing email thread, so the identity is technically real
• claiming authority, entitlement, expertise, or responsibility that is hard to challenge in the moment
• dropping in internal terms, project names, system names, supplier names, staff names, or recent business context to indicate legitimacy

Request and workflow behaviour

• asking for a payment, access change, credential reset, MFA approval, file share, information release, visitor entry, asset release, or supplier record change
• framing the request as routine, pre-approved, confidential, urgent, or operationally necessary
• seeking an exception to normal process
• discouraging callback, verification, peer review, ticketing, or approval checks
• steering the exchange onto a different channel, SMS, a messaging app, personal email, phone, or a supplied portal
• directing the target to a QR code that resolves to an attacker-controlled portal or payment page (“quishing”)

Pressure and manipulation behaviour

• generating urgency, fear, guilt, obligation, scarcity, or consequence pressure
• implying that delay will cause harm, embarrassment, financial loss, operational disruption, reputational damage, or executive displeasure
• using familiarity or helpfulness to lower the target’s guard
• making the target feel personally responsible for resolving the issue
• separating the target from their normal escalation paths

Timing and context

• making contact at an unusual time or outside the normal workflow
• appearing abruptly with no prior relationship
• making a request that does not fit the claimed role, the relationship, or the usual process
• exploiting periods of reduced oversight, after hours, holidays, peak operational periods, incidents, events, payroll runs, audits, or supplier transitions