Why and How Impersonation Scams Thrive

At a recent lab meeting, a student of mine shared they had just received an impersonated scam email. Stitt, a senior in college and co-author, showed everyone an auto-renewal subscription saying they had paid $321.55 toward Norton 360 Security. As a senior in college, that amount was a red flag. Although they knew this to be a scam, it was nerve-wracking and concerning to receive the message.

Impersonation scams are some of the most prevalent scams reported by the Federal Trade Commission's (FTC’s) Consumer Sentinel Network with more than $1.1 billion reported losses in 2023 alone. The FTC found that more than half the fraud reports from 2023 were people impersonating businesses or government agencies, with 330,000 and 160,000 reports, respectively. Thus, impersonations are increasingly more difficult to decipher and resist by consumers.

These types of scams have changed over time and target different audiences. Phone call scams have decreased, and text, email, and app scams have been on the rise. Impersonation scams are occurring more often via text and email, making them seem similar to usual business or government emails and easier for consumers to access fake links or phone numbers.

Impersonation scams vary greatly. The top five FTC impersonation scams from 2023 were as follows: account security alerts, subscription renewals, giveaways or money to claim, identity issues with the law, and package delivery problems. All of these scams find ways to lead individuals to fake bank accounts, transfers of money or cryptocurrency, buying of gift cards, or sharing of bank information inciting fraudulent charges. People of all ages are susceptible to these scams with the impersonators targeting specific age groups with more believable pitches for that group (e.g., impersonating Social Security to target older people, delivery services for younger people).

Why do they work? Impersonation scams leverage authority and credibility to increase compliance with the ask. The approach seeks to motivate the consumer to comply with requests from institutions (e.g., Social Security, IRS, law enforcement, immigration) and well-known companies (e.g., Microsoft) that may be viewed as credible.

The bottom line is to beware of suspicious business or government emails, texts, or phone calls. Never click a link or call a number without verifying the source. If you think the message to be true, always contact the company through their official website, not by navigating through the email/text. Don’t believe that you need to give bank information, buy gift cards, or use a Bitcoin ATM, and don’t rush. A scammer will want you to send money as quickly as possible. Always take your time to figure out what the situation is and whether the sender is real and ideally talk to a confidant or family member as this engages deliberative reasoning and helps the consumer disengage from the scam.

This post was created in collaboration with Scam Lab member Suzie “Dawn” Stitt.