UK Finance describes the safe account scam. A call or text claims there has been fraud on the customer's account and says the money must move to a "safe account" to protect it, but the criminal controls the receiving account.
What is impersonation, and when does it become fraud?
By definition, impersonation is pretending to be someone else. Impersonating a friend for a joke is not a crime. It becomes fraudulent impersonation when the disguise is used to gain money or to cause a loss. That is the impersonation fraud meaning in law: a false identity used as the lie in a fraud, one of the types set out in what fraud is.
Fraudsters aim to steal money first. After that come card details, passwords, one time passcodes and the personal data that lets them open new accounts in the victim's name.
How does an impersonation scam work, from first call to cash out?
Table 1. The five stages of an impersonation scam.
| Stage | What the impersonator does | What the customer sees | What the firm can see | Who decides |
|---|---|---|---|---|
| Research | Collects names, account details and leaked data | Nothing yet | Nothing | The criminal |
| Contact and spoofing | Calls or texts from a spoofed or cloned number | The bank's number or a police officer's name | Nothing; the call runs outside its systems | The criminal |
| Pretext and pressure | Offers a threat or an enticement: fraud on the account, a fine, a refund | Urgency and an order to tell no one | A login, sometimes with a remote access app open | The customer, under pressure |
| Payment | Talks the customer through a transfer | Their own app and their own password | A first payment to a new payee, often large | The customer; the bank can hold the payment |
| Cash out | Moves the money on through mule accounts | Silence, then a call from the real bank | Fast onward transfers at the receiving firm | The receiving firm, if it freezes the funds |
The victim believes the call because the caller already knows real details and leaves no time to check them. The bank's login checks pass as well, since the customer, the phone and the password are all real, and that is why impersonation is hard to detect. The call center behind these schemes often sits in a different country from the victim, as the ranking of countries where scam calls come from shows.
Burçak Aydın, the author of this entry, draws on compliance roles at a bank and a payment institution: "In a safe account scam the customer passes every login and device check because it really is their phone and their password; what gives the payment away is the session itself: a first transfer to a new payee, details pasted rather than typed, and long pauses while someone else is talking."
Who do impersonators pretend to be?
The common types of impersonating differ by whose authority the criminal borrows.
How do bank and police impersonation scams work?
This is the safe account call from the opening; some callers pose as police and ask the victim to help with an "undercover operation" at a branch. UK losses to police and bank staff impersonation were 55.5 million pounds in 2025, down 18 percent, across 6,016 cases (UK Finance, Annual Fraud Report 2026, 15 June 2026, page 43).
How do government and company impersonation scams work?
How do impersonators target executives and suppliers?
Executive impersonation, or CEO fraud, demands an urgent transfer in the boss's name.
Third party or vendor impersonation sends an invoice in a supplier's name with new bank details; in real estate fraud, a fake attorney or title company email does the same with a buyer's closing funds. A new supplier's name can be checked against fraud news free before the first payment.
How is a customer impersonated?
Criminals also pose as the customer to the bank, using stolen personal details, which is where impersonation meets identity theft.
A synthetic identity is different: no real customer stands behind it.
How do social media and deepfakes feed impersonation?
Public profiles hand the criminal the names, relationships and details that make the story believable, and a deepfake lets the voice or face match the person the victim expects.
Which industries are targeted most?
Banks, fintechs and payment firms carry the loss, since the money leaves through them. Telecom operators carry the contact. Online businesses, delivery firms, healthcare providers and government offices lend their names to the pretexts.
What does the law say about impersonation fraud?
Impersonation crime is usually charged as fraud or cheating:
- United Kingdom. Under the Fraud Act 2006, section 2, a person who "dishonestly makes a false representation" to make a gain or cause a loss commits fraud by false representation. The maximum sentence is 10 years (section 1).
- United States. Posing as a federal officer or employee, and acting as one or demanding money in that role, carries up to three years under 18 U.S.C. 912. Since 1 April 2024 the FTC's impersonation rule also makes it unfair or deceptive to "materially and falsely pose as" a government body or a business.
- India. Under section 319 of the Bharatiya Nyaya Sanhita 2023, a person cheats by personation "if he cheats by pretending to be some other person", real or imaginary, and faces up to five years (formerly sections 416 and 419 of the Indian Penal Code).
What do regulators expect firms to detect?
The regulatory requirements for detecting impersonation arrive through payment rules. In the UK, the Payment Systems Regulator's reimbursement rules for APP scams cover scams that "might include impersonation or romance scams", so both the sending and the receiving firm have a reason to stop them.
In the US, the FTC counted over 1 million imposter reports and nearly 3.5 billion dollars of reported losses in 2025. On 1 October 2026 it asked whether its rule should also reach platforms whose advertising services help impersonation scams (FTC notice in the Federal Register).
What are the warning signs of impersonation fraud?
Table 2. Warning signs of an impersonation attack.
| Sign | What the customer hears | What the firm's data shows |
|---|---|---|
| Urgency and secrecy | "Act now, and do not tell branch staff" | A rushed payment, often at an unusual hour |
| A first payment to a new payee | "Move it to this safe account" | A payee added and paid in the same session |
| A fine to pay or a refund to claim | "Pay the fine or a warrant is issued" | A reference that names a tax, fine or fee |
| A change of channel | "Download this app so I can help" | A remote access app running during the session |
| Pasted details and long pauses | Someone dictating on the phone | Payee details pasted, long idle gaps before approval |
| A request for codes | "Read me the code we just sent" | An MFA prompt approved, then a login from a new device |
They prove little one at a time. Two or three around a first payment form the pattern a fraud analyst looks for.
Customers who spot them can protect themselves: hang up, call the bank on the number on the card and report the scam to the police or, in the US, to the FTC.
How is impersonation fraud different from phishing, CEO fraud and APP fraud?
Take one illustrative email that seems to come from the chief executive and asks a finance clerk to pay a supplier's new account today.
That one email carries four labels. Impersonation is the disguise, and phishing is the channel. CEO fraud, a form of business email compromise, describes the target: staff who can pay. Authorized push payment (APP) fraud is the payment type, because the clerk sent the money. Make the same request by phone and the channel label changes while the impersonation stays.
Which AML and KYC duties does impersonation fraud touch?
Two firms are involved. The receiving account usually belongs to a money mule, so KYC, customer due diligence (CDD) under FATF Recommendation 10 and ongoing monitoring are the receiving firm's anti money laundering (AML) duties. Its AML team owns that account and any report on it, while the fraud team at the sending firm owns the payment.
The sending firm protects the customer at the moment of payment. Device Fraud and Behaviour Analysis from complead, formerly Sanction Scanner, reads the device and the way the session is used from before login to the payment, so a customer under instruction is visible; a fraud analyst decides whether to hold the transfer. Device and session data are personal data under the GDPR when they can identify someone (UK GDPR, Article 4(1) names "an online identifier"). Prevention controls, and the ways firms combine them, are covered in the guide on how fraud detection works.
What happens when a firm fails to stop it?
In the UK, the firm pays. Since 7 October 2024 a payment firm must reimburse an APP scam victim up to 85,000 pounds, less an optional excess of up to 100 pounds, and must decide within 35 business days (PSR). These costs are split 50:50 between the sending and the receiving firm.
Related terms
When the voice on the phone is the chief executive's, the next entry to read is CEO fraud.
- CEO fraud. Posing as an executive to get staff to pay.
- Phishing. A deceptive message that steals data or access.
- APP fraud. A scam in which the victim authorizes the payment.
- Account takeover fraud. Taking control of a real customer's account.
- Money mule. A person whose account moves criminal proceeds.
