Impersonation and Verification

Build the mental model

Social engineering is already familiar from Cybersecurity Basics. This lesson narrows in on impersonation — pretending to be a manager, bank staff, support, or family member to push you into acting quickly.

Impersonation exploits an existing trust relationship rather than a fabricated one. That's why verifying using the contact info the suspicious message itself provided can quietly fail.

The core principle: verification only counts through a channel obtained independently before this contact happened — a saved number, the official app, or asking directly in person.

Impersonation Attack

A social engineering attack where someone pretends to be a person you already trust (a manager, bank staff, support, or family member), exploiting an existing trust relationship to push you into acting quickly without questioning them.

VERIFYING AN IMPERSONATION ATTEMPT
----------------------------------
VERIFYING AN IMPERSONATION ATTEMPT
------------------------------------

  suspicious contact arrives
  ("your manager", "your bank", "your relative")
              |
              v
      DO NOT use the reply info,
      callback number, or link
      IT provided
              |
              v
      instead, use a channel YOU
      already knew before this:
        - number saved earlier
        - official app
        - ask them in person
              |
              v
        verify identity
              |
              v
        THEN, and only then, act

Connect it to a real scenario

The code below checks whether a verification attempt was trustworthy, based only on which channel was used, not any message content.

• Called the number from the suspicious message -> "not trustworthy", just reconnects to the same source
• Used an independently-known channel (official app, saved number) -> "trustworthy"

The trustworthiness of a verification step depends entirely on where the channel came from, not on how official-looking the message was.

• Impersonation exploits an existing trust relationship
• Never use the contact info the suspicious message itself provides
• Only a channel you obtained independently makes verification count

Try the working example

function isVerificationTrustworthy({ usedContactInfoFromTheSuspiciousMessage, usedIndependentlyKnownChannel }) {
  if (usedContactInfoFromTheSuspiciousMessage && !usedIndependentlyKnownChannel) {
    return {
      trustworthy: false,
      reason: "Calling or replying to contact info supplied inside the suspicious message just reconnects you to the same attacker -- it verifies nothing."
    };
  }
  if (usedIndependentlyKnownChannel) {
    return {
      trustworthy: true,
      reason: "Using a number or app saved before this message arrived reaches the real party independently of anything the suspicious message provided."
    };
  }
  return {
    trustworthy: false,
    reason: "No independent verification channel was used, so identity has not actually been confirmed."
  };
}

const usedTheScammersOwnNumber = isVerificationTrustworthy({ usedContactInfoFromTheSuspiciousMessage: true, usedIndependentlyKnownChannel: false });
const calledTheSavedNumberInstead = isVerificationTrustworthy({ usedContactInfoFromTheSuspiciousMessage: false, usedIndependentlyKnownChannel: true });

console.log(JSON.stringify({ usedTheScammersOwnNumber, calledTheSavedNumberInstead }, null, 2));

{
  "usedTheScammersOwnNumber": {
    "trustworthy": false,
    "reason": "Calling or replying to contact info supplied inside the suspicious message just reconnects you to the same attacker -- it verifies nothing."
  },
  "calledTheSavedNumberInstead": {
    "trustworthy": true,
    "reason": "Using a number or app saved before this message arrived reaches the real party independently of anything the suspicious message provided."
  }
}

FTC Consumer Advice — How To Avoid a Scam — Digital Privacy & Modern Security