What's the difference with identity theft?

The impersonation described here is a means used during one exchange: someone pretends to be another person for as long as it takes to obtain something. Identity theft refers to a lasting harm, where a third party acts in your name with institutions — loans, subscriptions, official procedures. The second sometimes follows the first, but they are two distinct situations.

My name was used to write to my contacts. Is my account hacked?

Not necessarily. An account can be imitated without being compromised: a name, photo, and description can all be copied. Still, check your account's login history, and warn your contacts, so they can tell the fake account from the real one.

Identity impersonation

In plain terms

Someone pretends to be a person or organization you know, for the length of one exchange, in order to obtain from you something you wouldn't grant to a stranger.

Definition

Identity impersonation, in the sense used by this family, is the act of borrowing an existing person's or organization's identity during an exchange, in order to benefit from the trust placed in them.

How it works

Impersonation plays on how we place our trust: in a displayed name, a logo, a number, a tone — that is, in elements that can all be copied. An email's display name is a free-text field, a text message's sender is just a label, the calling number can be spoofed, and a profile photo can be copied in a second. The attacker therefore doesn't need to compromise an account to appear to own it, though a genuinely hacked account makes the impersonation undetectable. It's rarely the final goal: it serves as a layer of trust for something else — a transfer, a credential, an access. That's why it appears upstream of many fiches on this site.

Warning signs

Correct display name but an address or domain different from the expected one
Unusual request from a usual contact, with no explanation for the change
Tone, sign-off, or sending time that clashes with previous exchanges
Reply address different from the sending address
Recently created account reusing the name and photo of someone you know
Request not to use the usual channel to reply

How to verify

Verify through a channel the impersonated person controls and the attacker doesn't: a number you already had, a meeting, an account you access on your own. Verifying through the channel of the request itself amounts to asking the stranger to confirm they really are your contact.

What to do

Treat the displayed name as information, never as proof. Faced with an unusual request from a known contact, verifying through another channel should become a reflex rather than a sign of distrust.

If it already happened

Warn the impersonated person or organization: others around them are usually receiving the same messages. Keep the exchanges and report the account to the relevant platform. If information or funds were shared, contact your bank and file a police report.

Frequently asked questions

What's the difference with identity theft?: The impersonation described here is a means used during one exchange: someone pretends to be another person for as long as it takes to obtain something. Identity theft refers to a lasting harm, where a third party acts in your name with institutions — loans, subscriptions, official procedures. The second sometimes follows the first, but they are two distinct situations.
My name was used to write to my contacts. Is my account hacked?: Not necessarily. An account can be imitated without being compromised: a name, photo, and description can all be copied. Still, check your account's login history, and warn your contacts, so they can tell the fake account from the real one.

Official sources

Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)

This article is part of the Social engineering family. Last updated: 2026-09-02.