An impersonation attack is a social engineering tactic in which an attacker pretends to be a trusted person, company, regulator, customer, or internal team to make a request seem legitimate. The goal is usually to obtain data, money, access, or an action that bypasses normal controls.
These attacks matter because many security failures happen in business processes, not just in software. In fintech, for example, a fake government request or a convincing support inquiry may pressure staff into releasing identity documents, account records, or verification data. The attacker relies on trust, urgency, and authority rather than malware. Defenses include out-of-band verification, strict approval workflows, least-privilege access, and audit logs that capture who approved the release and why. Strong training helps, but process design is what stops a convincing impersonation from becoming a data breach.