Turning a Critical Eye on Impersonation Scams

By Mike Kiser, security strategist and evangelist at SailPoint

“The criminal is the creative artist; the detective only the critic.”

— G.K. Chesterton

Impersonation Crime as Art

The recent findings by UK Finance that impersonation scams are up 84 per cent compared to the same period last year shows that criminals have seen the opportunity that Covid-19 has presented over the past six months. Convincing the unwary to hand over financial information and payments requires not only research and creativity, but a large volume of potential targets. Covid-19 has created just such a field ripe for harvest by bad actors.

This is largely due to the acceleration of digital life. As many of us have been subject to stay-at-home orders for the past half year or so, we’ve tried to find various activities to keep us busy. Some have taken up new activities such as baking bread or needlework, others have taken on long-planned renovations to our flats or learned how to garden. These new past times share the benefit of being firmly planted in the real world at a time when almost everything else is an online interaction. Work, social groups, religious and charity organizations—these are all activities and relationships that find their expression in an online video chat or other digital form.

This is a massive cultural change that requires acclimation for the general populace. Depositing a check or booking that next holiday was often something done in person, and the shift to not only “remote work” but also “remote life” has left many susceptible to scams involving impersonation. This is particularly true now that a great deal of personal information is available, granting criminals credibility and enhancing the quality of their “creative artistry” as Chesterton describes it in the quote above.

We Must All Be Critics

But Chesterton is right to point out that if the criminal is the artist, there is a critic that has a role to play as well. If this recent wave of exploitation is to be mitigated, however, the critic cannot merely be the detective. The role of reviewer must also be taken on by each individual. After all, scams involving impersonation are a false narrative created for an audience of one. Know the signs of a criminal “performance” (which are useful not only for impersonation scam, but a wide range of malicious activity). It’s helpful to put this in the vein of reviewing a play or other work of art:

(1)  A Surprise Performance

No one goes to a play by accident. They buy tickets in advance and look forward to it for several weeks. They are not surprised when they find themselves in the theatre, and the same should apply for remote interactions. When contacted by a bank, travel agency, or government agency, think about the context. Have you had interactions with them before? Were you expecting them to contact you? If this monologue is unexpected, then be circumspect about the caller and their message.

(2)  Emotional Manipulation

One of the goals of criminals will be to generate an emotional reaction to lower your defenses. Great works of art draw out emotion also, but not in glaringly obvious ways—that’s what makes them great art. Rather, they use a subtle word here, a knowing look there. Be on guard for words that seem calculated to draw a strong emotional response from you, paying special attention to words and phrases that seem inelegant or forced. This includes negative feelings like alarm or fright from not having paid a fine or unknown tickets as well as more positive responses such as “winning” an Amazon gift card or a surprise holiday.

(3)  Immediate Action Demanded

Finally, great works of art move us, but that change is not often immediate. Many scams involve a demand for an immediate response; these scammers have invested time and effort into building a reasonable backstory all with the goal of you taking action while you’re on the phone with them. Given that the person who contacted you is not at your front door, but rather is talking to you remotely, there’s no immediate need to respond. If there are any warning signs concerning the interaction or you feel uncertain, end the conversation and contact the institution directly to ensure that the message is real. Let the story sit with you and examine it in your mind as you would a great play or novel before deciding to respond.

A Shifted World Requires A Shift in Thinking

Criminals are always seeking creative ways to exploit changes in society and those who might be vulnerable as a result. The first half of 2020 has certainly revealed a new theatre for them to perform the art of theft via impersonation. By developing a finely tuned critical eye and knowing the markers of poorly constructed art, we can begin to review these small scale dramatizations and “close the curtain” on this latest round of malicious activity.