How impersonation scams work and how to stop them
The confidence gap
SPONSORED BY
By Sydni Silverstone on July 1, 2026
Know the signs:
On the afternoon of May 2, 2025, an employee of ABC Company Inc., a Frost commercial customer, received an urgent phone call. An individual claiming to be a representative from Frost Bank’s fraud department reported that suspicious activity had been detected on the company’s account: four separate devices had attempted to log in from out-of-state locations.
Concerned about the alleged fraud and wanting to protect the account, the employee followed the caller’s instructions as part of what was presented as a verification process. The imposter directed the employee to enter **62*# on their phone and sent a text message requesting both sets of the employee’s usernames and passwords. As a result, the employee’s credentials were compromised, and all their incoming phone calls were forwarded directly to the imposter.
Using the stolen login information, the imposter gained access to ABC Company’s Treasury platform and initiated wire transfers totaling $392,177, plus ACH payments totaling $820,554.
The employee later became suspicious after reviewing the account and noticing unauthorized activity. The employee promptly contacted their Treasury Cash Management System, and a Frost banker assisted in identifying and deleting the fraudulent transactions. The payments were successfully removed before processing, preventing any financial loss to the customer.
Impersonation scams are a growing threat to companies and consumers. In 2025 alone, the FTC received more than 1 million reports about impersonation scams, with reported losses increasing by nearly 20% to $3.5 billion. Now, with AI making scams more sophisticated — and scammers reaching victims across phone, text, email, and social media in a single coordinated push — impersonation scams are more effective than ever.
Many of us feel we’re too smart to fall for impersonation scams, but the stats say otherwise – a phenomenon known as “the confidence gap.” According to the Global State of Scams 2025 Report, 73% of people worldwide feel confident they can recognize scams. Yet nearly a quarter lost money in the past year.
However, by familiarizing yourself with the kinds of impersonation scams out there, you will be better prepared to protect yourself from fraud. Here are the ones you should know and the universal red flags that should give you pause.
1. The bank impersonator
This is the scenario from the introduction, where a bank impersonator uses a fabricated fraud alert to gain access to accounts.
Who they pretend to be: Your bank, usually the fraud department or online banking team.
What they're after: Login credentials, one-time passcodes, or a direct transfer out of your account.
Red flags: Phone calls claiming to be from the fraud department or other trusted source asking for information.
What to do about it: If you receive a fraud alert or call from your bank, hang up and call their direct line on their official website to verify.
Remember, Frost will never ask for a one-time passcode, PIN, or password by phone, text or email, and will never send links during unsolicited phone calls.
3. The tech support impersonator
Who they pretend to be: Microsoft, Apple, Norton, McAfee, or your internet provider's “security team.”
What they're after: Remote access to your computer, including access to internal systems, customer data, credentials, MFA tokens, and email.
The setup usually starts in one of two ways. A pop-up appears on your screen with an alarming audio alert: “Virus detected. Your computer has been locked. Call Microsoft Support immediately at the number below.” Or your phone rings, and the caller claims to be from Microsoft, Apple, or your ISP, warning that your device is broadcasting malware or that your account has been compromised.
If you engage, the “technician” walks you through installing remote-access software — AnyDesk, TeamViewer, LogMeIn, or a tool with an unfamiliar name. From the moment you grant access, they can see your screen, type as you, and reach anything your device is logged into.
A newer variant worth knowing: the scammer poses as your own IT or security team. They'll cite a real-sounding number, reference a recent system update or security incident, and ask you to install a “diagnostic tool” or read back an MFA code to verify your identity. The framing is designed to feel like exactly the kind of call you'd expect from internal IT during an active incident.
Red flags: Urgent language such as “your account will be locked,” phone calls posing as IT or security, unexpected calls, text messages or emails asking you to click links or download attachments.
What to do about it: A good rule is to always hang up and verify, no matter who is on the other line. End the call and reach out to a known, trusted number for your IT team.
2. Business email compromise (BEC)
Who they pretend to be: A CEO, CFO, senior leader, known vendor or outside attorney.
What they're after: A wire transfer, a change to vendor banking details or sensitive employee data (W-2s, payroll files). The scam plays like this: An employee receives an urgent, confidential email from a superior that asks them to perform a wire transfer outside the normal approval channels. From 2013 to 2023, the FBI tracked over 300,000 incidents of BEC with total losses exceeding $55 billion.
Red flags: Urgency, confidentiality, and a payment request outside normal channels.
What to do about it: For internal awareness, any email from an executive that combines urgency, confidentiality, and a payment request deserves a phone call to verify, regardless of how routine the amount seems.
In the event of an impersonator scam, the single most effective thing you can do is slow down. Almost half of all scams are completed within 24 hours of first contact, and the recovery window after funds leave a victim's account is short — often measured in hours, sometimes minutes. A ten-minute pause to verify, ask one more question, or make one phone call defeats most of what scammers count on.
Lastly, don’t assume you’re immune to the risks of impersonation scams or that you can’t be targeted. Stay alert and always verify.
[1] https://consumer.ftc.gov/consumer-alerts/2026/05/new-trends-reports-imposter-scams
[2] https://gasa.org/knowledge-base/blog/global-scams-on-the-rise-over-half-of-adults-worldwide-report-scam-encounters
[3] https://www.ic3.gov/PSA/2024/PSA240911
Back to hub
3
2
1