ICU6
ReportAlerts

Identity impersonation

When a person, organization, or brand is imitated (or an account is hijacked) to deceive: how to identify and respond.

What it is

Fraudulent use of someone else’s identity (name, photo/logo, communication style, email/phone number, domains) or takeover of an existing account to pose as the person or organization, in order to obtain money, data, or access.

Common vectors

  • Profiles/clones on social networks and messengers (WhatsApp/Telegram)
  • Spoofed emails (display name, different “Reply-To”, lookalike domains)
  • Spoofed phone numbers (caller-ID spoofing), SIM-swap/port-out
  • Deepfakes/voice clones, logos and mirror sites

Common examples

  • CEO fraud / BEC: imitating an executive to obtain a wire transfer or data
  • Fake bank/agency phone support (spoofed caller ID)
  • Cloned Facebook or Instagram page/account of a city hall/brand to collect payments/donations
  • Supplier email with a lookalike domain (rn→m, 0→O, .fr→.com) and a modified IBAN
  • WhatsApp from a “relative” asking for an urgent transfer (unknown number)

How to respond

  1. Stop the exchange and verify via an official channel (public number/site, already-known contact)
  2. Do not share codes/OTPs; do not install remote-control tools
  3. Secure your accounts: change passwords, enable MFA, review sessions and mail forwarding rules
  4. Preserve evidence and report to ICU6 / the relevant platform
Report Learn more

Everything you need to prevent and respond

Main impersonation routes

  • Profile/page clone: name, photo, bio, posts copied
  • Lookalike domains & email spoofing: misleading display name, different “Reply-To”
  • Account Takeover (ATO): genuinely compromised mailbox/social account
  • Caller-ID spoofing, SIM-swap/fraudulent number porting
  • Video or voice deepfake to simulate a person

Concrete warning signs

  • Email/URL very close to the original (rn/m, 0/O, .fr/.com)
  • “Reply-To” or sending domain different from the visible address
  • Recent account, little history, stolen photos; changing phone numbers
  • Requests for secrecy/urgency, unusual payment, modified IBAN
  • Unknown forwarding rules or sign-ins from unexpected countries

Quick verification (5 min)

  1. Compare the official email/URL (verified site or profile) with the contact address in the message
  2. Open full email details: real sender, “Reply-To”, domains and signatures
  3. Test an independent channel (official number from the site, encrypted message to a known contact)
  4. Reverse-search the photo/name + check the account’s history
  5. If in doubt: don’t pay, don’t install anything, report to ICU6

For organizations (brands, city halls, schools…)

  • Deploy SPF/DKIM and DMARC (p=quarantine or reject); monitor reports
  • Harden accounts: mandatory MFA, review permissions and forwarding rules
  • Reserve typo-domains and monitor lookalike domain registrations
  • Payments policy: dual IBAN validation and an out-of-email channel for any change
  • Official pages: verification badge when possible, clear legal and contact info

For individuals

  • Enable 2FA, use unique passwords, manage active sessions
  • Limit public visibility (friends, numbers, emails) to reduce profile cloning
  • Check profile age and inconsistencies in posts
  • Avoid sharing codes/OTPs; refuse any remote-control request

If an account is compromised / money sent

  • Bank: call the official number, attempt a recall/stop; report the IBAN and reference
  • Accounts: change the password, revoke tokens/devices, remove forwards/rules
  • Platforms: report the fake/takeover and recover access
  • Inform contacts that a fake account is circulating (pinned message)

Preserve & transmit evidence

  • Screenshots with date/time; emails with full headers; sign-in logs
  • URLs, domains, profile IDs, calling numbers, IBAN
  • Don’t post sensitive data publicly; submit via the ICU6 form
Report Learn more