A scammer posed as a bank officer, claimed suspicious activity, and tricked a victim into sharing their OTP. Minutes later, the account was drained.

Such incidents are becoming more common in the news these days. In fact, impersonation scams have surged by 148%, as reported in the 2025 Trends in Identity Report. I wouldn’t be surprised if you’ve received such a call multiple times.

I examined the 26-page report more closely to understand the common types of impersonation scams and the reasons for their increase. 

What is an Impersonation Scam?

An impersonation scam is a fraud technique where a cybercriminal pretends to be a trusted individual or organization to deceive someone into sending money or sharing confidential information. 

It is a form of social engineering attack that uses psychological manipulation to persuade victims to take actions they normally wouldn’t consider.

In impersonation scams, cybercriminals use guilt, urgency, and fear to trap unsuspecting users.

For example, you wouldn’t share your system password with anyone. But if someone pretending to be from your IT department urgently emails you, warning that your system needs an immediate after-hours operating system (OS) patch to prevent security risks, you might feel pressured to share it.

Common Types of Impersonation Scams

Although impersonation scams come in many forms, their goal remains the same: to steal money or gather confidential information to target victims effectively.  

According to the Trends in Identity Report, the following were the most common types of impersonation scams during 2024:

• Business: Scammers pose as representatives from reputable companies to trick victims into sending money or disclosing confidential information.
• Financial Institution: Impersonators act as bank staff and create urgency or fear of account loss to pressure victims into giving money or revealing account details. 
• Federal/State Agency: Fraudsters pretend to be government officials and demand fines or personal information. Victims comply with the request, fearing legal troubles. 
• Police/Sheriff: Criminals claim to be law enforcement officers, threatening arrest to extort money.  
• Friend/Family: Scammers impersonate loved ones in distress and exploit victims’ empathy and guilt to extract money.  

As you can see, cybercriminals follow the same tactics regardless of the type of impersonation. 

They pretend to be trusted or authoritative figures and manipulate human trust, emotions, and social behavior to accomplish their harmful goals.

They also impersonate celebrities, charities, employers, and foreign embassies to scam innocent victims, as mentioned in Trends in Identity Report. 

All these scams experienced year-over-year growth in 2024 compared to 2023.

The Cost of Falling Victim

Impersonation scams not only cause emotional stress but can also cost victims money. Unsurprisingly, these scams are among the top reported frauds to the US Federal Trade Commission (FTC), costing consumers over $2.95 billion in 2024. 

Needless to say, older adults are more vulnerable to impersonation scams due to limited tech awareness, isolation, and susceptibility to fear-based urgency. 

Furthermore, many grew up in an era when official-looking communication was seldom fake.

According to the FTC, the combined losses reported by older adults who lost $100,000 reached $445 million in 2024. 

The reality is that scammers don’t discriminate. 

A UK finance survey revealed that impersonation scams affected 71% of young adults, with scammers convincing them either to send money or disclose confidential information.  

If scammers cannot extract money from victims, they might use stolen credentials to commit other crimes, such as identity theft, account takeover, or more targeted scams.

Why is There a Surge in Impersonation Scams?

People depend on digital communication more than ever. They use phone calls, texts, and online messages to stay connected with colleagues, friends, and family. This heavy reliance on digital communication gives scammers easy opportunities to exploit.

Besides, impersonation scams are low-cost, high-reward activities. It’s much easier to trick an unsuspecting victim than to hack a secure system. Scammers don’t need advanced cybersecurity tools to target people. 

Sometimes, a straightforward, convincing email is enough to gain access to a highly secured system.

They also have access to a wealth of publicly available data through social media and our oversharing habits, which helps them research their victims. This makes planning and carrying out impersonation scams easier.

A constant stream of notifications from social media and chat messages also leads to digital fatigue, causing people to lower their defenses and making it easier for scammers to get in.

All these reasons contribute to the rise in impersonation scams.

The AI Factor in Impersonation Scams

Deepfake videos, AI voice cloning technology, conversational AI chatbots, and other various Gen AI tools have made it easier to carry out impersonation scams. 

Now, hackers can easily impersonate legitimate websites and pretend to be people in authority or celebrities.  

In a recent impersonation scam, scammers posed as famous actor Brad Pitt and tricked a French woman out of $850,000.

With these AI tools, scammers can operate on a much larger scale, reaching more victims with highly convincing and realistic messages. 

How to Protect Yourself

Here are some tactics to stay safe from impersonation scams.   

1. Verify Identities Before Acting

Scammers can fake email addresses, phone numbers, and even voices. So, the best way to protect yourself is to develop a habit of trusting no one and verifying everything.

If someone claims to be from a bank or agency and pressures you to act immediately, hang up. Then, reach out to the organization or individual using contact details from their official website.

When handling emails, verify the sender’s name and domain carefully. If your bank’s domain is example.com, official emails from the bank will share that domain. Therefore, any unsolicited email from [email protected] is a warning sign.   

2. Strengthen Your Account Security

Consider using a good email security tool to block email impersonation attacks. 

Privacy-focused email service providers, such as Proton Mail and Tuta Mail, have built-in features to block impersonation emails.  

You should also enable two-factor authentication on all your accounts. This provides an extra layer of security and helps prevent scammers from accessing your accounts, even if they have your passwords. 

3. Limit What You Share Online

Scammers research their targets before reaching out. The more details they know about you, the more convincing their story can be to lure you into their traps.

For example, if you post about an upcoming trip and ask questions about the airline or hotels you booked, scammers could impersonate those companies to target you.

That said, you should limit what you share online. 

Never share personally identifiable information online that could be combined to impersonate someone who knows you.  

4. Follow the 15-Second Rule

Scammers depend on creating urgency. The 15-Second Rule is an easy technique to help prevent impulsive decisions.

If you get an unexpected call, email, or text urging you to send money, share confidential information like a password, or act quickly, stop. Count to 15 before taking any action.

In those few seconds, take a deep breath and ask yourself:

• Does this make sense?
• Do I trust this source?
• Can I verify it another way?

That brief pause is often enough to help you stop the scammer’s manipulation and confirm the situation. 

However, keep in mind that the 15-Second Rule is a useful safety reminder. It works best when used along with other verification methods, rather than on its own.

Always use multiple verification methods before honoring a request for money or sensitive information. 

Stay Vigilant to Stop Impersonation Scams

Impersonation scams are increasing. With AI tools, scammers can now produce convincing voices, messages, and images to make their scams more believable and harder to detect. 

The best way to fight these scams is to remain vigilant. 

Enhance your account security, restrict sharing of personally identifiable information online, and always confirm through an alternate channel if someone requests money or confidential details. 

And practice following the 15-Second Rule to avoid acting on impulse.