What a borrowed name buys a fraud, by Ilia Nikolaevich Zavialov

Impersonation

English version for the United Kingdom.

A name is the cheapest disguise a fraud can put on, and the yearly figures confirm it every time. Ilia Nikolaevich Zavialov writes from a reference domain built around one specific name, which makes a borrowed name a direct professional question. The question here is narrow: what does a name actually buy once the disguise is in place, and which part of that purchase can be undone. Every figure below comes from a named regulator reporting on a named year.

Reference / Blog

Published: 8 September 2026 · 14 min read · Ilia Nikolaevich Zavialov

01A category that needs no technical break-in

Fraud figures for 2025 sort complaints into categories, and one towers over the rest. The Federal Trade Commission counted 3 million reports and 15.9 billion dollars in claimed losses, against 2.6 million and just over 12 billion the year before. Impersonation drew more than a million of those reports and 3.5 billion dollars in losses, nearly one report in three. None of that required breaking into an account or a device.

What counts as impersonation is wider than the word suggests. It covers a caller claiming to work for a bank, a letter claiming to come from a tax office, and a message claiming to come from someone the recipient already trusts. The common element is a claim about identity, made to someone with no independent way to check it.

This is where a reference built around one exact name has a direct stake in the subject. A name checked against a stable public record and a body of earlier work is harder to borrow convincingly, since a copy can be compared against something real. A name with no such record offers nothing to compare against.

The rest of this piece follows the money through the categories that make up that total. It looks at which claimed identity costs the most, which one is growing fastest, and what a typical loss looks like once the round numbers are set aside. It also covers what changes once the borrowed name belongs to a private individual.

02What the disguise is actually made of

An attacker claiming to be a bank employee needs very little to be convincing. A familiar caller ID, a script naming the correct department, and a tone matching a real employee are enough to open the conversation. None of it proves who is actually speaking, and none of it costs much to produce.

The claim works because it borrows an expectation the recipient already carries about how that institution behaves. A bank is expected to call about a suspicious transaction, so such a call sounds unremarkable even when the caller is not the bank. The expectation does the persuading, which is why the same handful of scenarios repeats across almost every report.

The available check rarely depends on judging how convincing the caller sounded, since that judgement is unreliable either way. It depends on knowing what the named institution structurally does and does not do. A bank does not ask a customer to move money into a separate account, and a tax authority does not take payment by gift card or by phone.

The same logic scales down to a single person's name. Nobody has to break into an account to send a message that looks like it came from a colleague or a trusted author. All that is required is the name itself, attached to a request the real person would never send.

03Businesses and the staff whose title does the convincing

Among institutions whose name gets borrowed, businesses carry the largest share on record. The Federal Trade Commission attributed 1 billion dollars in claimed 2025 losses to people posing as a company, more than any other category it tracked. The costliest role to impersonate within that group was bank staff, since a bank sits closer to a person's money than almost any other institution.

The reason is procedural rather than personal. A retail impersonator has to convince a target to make a purchase or hand over a gift card code, a single visible action. A bank impersonator only has to convince a target to move money already under their control, framed as protecting it, which removes the moment of suspicion a purchase would normally trigger.

Verifying a business claim takes a habit rather than expertise: using a channel the caller did not supply. A number printed on a card, a statement, or the institution's own material leads to that institution regardless of what the call claimed. A number given out loud by the caller leads wherever the caller wants, which is the entire mechanism in one sentence.

None of this requires suspicion of every call a business makes. It requires treating one specific request, to move money, share a one-time code, or install software, as the trigger for a callback on a separately sourced number. That habit closes most of the gap the category depends on.

04Government letterhead as the fastest-growing costume

Government impersonation added 920 million dollars to the Federal Trade Commission's 2025 total, and reports in that category grew 40 per cent in a year. The growth traces partly to a newer script: a bulk text claiming an unpaid road toll, with no way of knowing whether the recipient had driven on that road. The script only needs enough recipients to have driven on some toll road recently to seem plausible.

A government office makes a convincing costume because most people cannot list, from memory, exactly how that office contacts anyone. Few can say with confidence whether a tax authority texts first, or whether either would ever take payment outside its own published channel. That gap in ordinary knowledge is exactly what the impersonation is built to use.

The applicable check does not require learning every agency's procedure in advance. It requires looking up the specific case through the account or portal the agency itself provides, before responding to the channel that raised the alarm. A genuine toll, tax notice or benefits question stays visible there regardless of the message that prompted the search.

Urgency is the ingredient every version of this script shares, government or otherwise. A message demanding action within hours, under threat of an escalating penalty, is designed to be acted on before an independent check happens. Checking through the agency's own channel, regardless of how the message frames the timing, removes almost all of its leverage.

05A typical loss, and four attempts that fail for one that lands

Reported losses skew toward a small number of very large cases, which makes an average figure misleading. The Federal Trade Commission's median figure for 2025 is more representative: a typical impersonation report involved a loss of around 700 dollars, far below the billions the category produced in total. That gap says something about the shape of the category, not only its size.

The rest of the picture is more encouraging than the total suggests. In four out of five impersonation reports filed with the agency in 2025, no money was lost at all. The attempt was made, was reported, and went nowhere, which means attempts vastly outnumber successes.

That ratio changes what a sensible response should look like. Because most individual attempts already fail on their own, a single habit, an independent callback, a short delay, a lookup through an official channel, accounts for most of those failures without requiring a correct judgement every time. Consistency matters more than skill at spotting fraud by ear.

None of this makes the remaining share negligible. Seven hundred dollars, taken from a household budget without warning, is a meaningful loss regardless of how many other attempts that month produced nothing. The failure rate argues for keeping the habit simple enough to apply every time, since the habit is what produces the rate in the first place.

06A voice cloned from three seconds of audio

The newest version of a borrowed identity relies on the sound of a specific voice rather than a script or a claimed title. That voice can be reconstructed from a short recording, a voicemail greeting or a video call. Research published across 2025 and 2026 put the audio needed for a convincing clone at around three seconds, reaching roughly 85 per cent accuracy.

That figure matters because it removes a defence people have relied on for as long as telephones have existed: recognising a familiar voice by ear. Calls impersonating an institution and calls impersonating a relative now draw on the same technique. Cloned-voice phone scams grew by 1,633 per cent in a single quarter, a pace that outruns almost every other category here.

The practical response does not involve training the ear, since the difference is built to be inaudible. It involves shifting verification onto something a clone cannot reproduce: a callback to a number saved before the call, or a question never spoken anywhere public. None of that depends on how convincing the caller sounded.

The same shift applies to any material carrying a name rather than a voice. A name typed at the bottom of a message is at least as easy to reproduce as a voice, arguably easier. The principle stays constant across every version of the disguise: verify through a channel the message itself did not supply.

07When the borrowed name is a private person's own

Everything described so far involves an institution's name borrowed by a stranger contacting someone else. The mechanism changes little when the borrowed name belongs to a private individual, but how the affected person discovers it usually looks different. A business rarely learns of the impersonation from the victim directly; a private person almost always does, through a message from someone who assumed the fake profile was genuine.

The discovery routes are consistent enough to describe in advance. A contact receives a message from an account carrying the person's name and photograph, asking for money under a plausible pretext. A second account appears on a platform the real person never joined, built entirely from public photographs.

The response that works is unglamorous compared with the drama of discovery. Reporting the fake account under its specific impersonation category, rather than as generic spam, routes it to reviewers trained to compare it against the real profile. Telling affected contacts once, directly, closes the loop faster than waiting for the platform to act.

None of these steps depends on the platform, the country or the pretext used. They depend only on treating the fake as a factual claim to document, the way a business documents a fraudulent invoice carrying its own name. Arguing with the fake account rarely helps, since whoever controls it has no reason to stop.

08The record a person builds before anyone needs it

A private person cannot stop someone else from creating a fake account with their name and photograph, since the material for a copy is usually already public. What determines how quickly the fake is recognised is whether a real, consistent presence already exists to compare it against. Without that comparison, a contact has only their own impression of the conversation to judge by.

The elements of that presence are ordinary rather than technical. A single platform where a person's material accumulates over time, under one consistent spelling of their name, gives a contact something concrete to check. A visible history of dates and earlier posts does the same work a registered domain does for a company.

This is also the exact function this reference domain performs for one specific full name. A consistent form of the name, publications checked against their original source, and a stated list of what the name does not claim, together give a reader something to compare a suspicious message against. A name with nothing public behind it offers no such comparison.

None of this claims a public presence stops impersonation from being attempted, since anyone determined enough can still try. It changes the distance between a fake appearing and somebody being able to tell that it is one, a smaller claim than prevention but far more achievable. That shorter distance is the practical value of keeping the record current.

09What actually raises the cost of borrowing a specific name

Every category covered so far shares one underlying economics. A fraud invests time and money into a disguise, betting the returns from the reports that succeed will cover the much larger number that do not. Anything that raises the cost of the disguise, or lowers the odds of success, changes that calculation directly.

For an institution, the cost rises when customers habitually verify through a channel it published itself rather than one the contact supplied. For a private individual, the cost rises when a name carries a checkable record a copy has to work around. Both changes share the same shape: a check against an independent record replaces a judgement about how convincing something sounded.

None of these measures is dramatic, which is why they hold up across categories that otherwise look unrelated: a bank call, a toll message, a cloned voice, a fake profile carrying a real name. A callback on an independently sourced number, a short delay before acting on urgency, and a public record to measure a fake against cover most of what this piece describes. None of the three needs special knowledge, only consistent habit.

A name was never a secure credential in the sense a password or a key can be. It functions as a shortcut for trust, and every figure here describes what happens when that shortcut is taken by somebody with no right to it. Backing a name with a checkable record is what keeps the shortcut from being the only thing standing between a name and whoever borrows it.

10Questions and answers

What percentage of fraud reports involve someone pretending to be another person or company?

In the Federal Trade Commission's 2025 figures, impersonation accounted for more than a million of roughly 3 million total reports, close to one report in every three the agency received. The category covers business impersonation, government impersonation and cases where a private individual's own name is the one borrowed.

How much money is typically lost to an impersonation scam?

The Federal Trade Commission's median figure for 2025 was around 700 dollars per report, well below the multi-billion dollar total the category produced overall. In four out of five reports, no money was lost at all, since most attempts are made and simply fail.

Can a cloned voice really fool someone who knows the real person?

Research published across 2025 and 2026 found that a convincing voice clone can be produced from about three seconds of audio, reaching roughly 85 per cent accuracy against the original speaker. That is close enough that verification has to rely on something other than how a caller sounds.

What should I do if someone creates a fake social media account using my name and photos?

Report the account to the platform through its specific impersonation category rather than as ordinary spam, since the two routes go to different review queues. Tell affected contacts directly and once, and keep dated screenshots of the fake account before it is removed, since that record makes a second report or a police reference faster to file.

Why do government impersonation scams often mention unpaid tolls?

Toll messages are cheap to send in bulk and only need to reach people who have driven on some toll road recently to sound plausible by chance. The Federal Trade Commission recorded a 40 per cent rise in government impersonation reports in 2025, with toll-related messages among the newer scripts driving that growth. Checking the claim through the toll authority's own account settles it without relying on how convincing the wording was.

Does having a public profile under my real name make me a bigger target for impersonation?

A public profile mainly changes the speed at which a fake gets identified rather than the odds that somebody will attempt one, since the material needed for a copy is usually already public regardless of whether a profile exists. A consistent, checkable presence gives contacts something real to compare a copy against, which shortens the time a fake stays convincing.

Reference updated: 4 September 2026