Impersonation appears under the Defense Evasion tactic in the MITRE F3 Framework. It is one of the most direct social engineering techniques in the F3 matrix: the attacker claims to be someone the target trusts.
Sub-techniques
| Sub-technique | Who the attacker pretends to be | Primary target |
|---|---|---|
| Account Holder Impersonation | The bank's own customer | Bank staff, contact centre agents |
| Official Impersonation | Bank representative, law enforcement, government agent | Customers, account holders |
How does Account Holder Impersonation work?
Fraud actors use stolen personal information (name, date of birth, partial account number) to answer security questions and pass knowledge-based authentication (KBA) checks. Combined with phone number spoofing of the victim's own number, the attacker appears to be calling from a recognised customer's phone.
The goal: convince bank staff to grant access, reset credentials, change account details, or authorise a transaction.
How does Official Impersonation work?
Here the roles reverse. The attacker calls the customer, posing as a bank fraud investigator, law enforcement officer, or government official. The authority and urgency of the claimed role pressure the victim into disclosing credentials, approving transactions, or transferring funds.
Vishing is the primary channel. Caller ID spoofing of official numbers (phone number spoofing) makes the call appear genuine.
Key takeaways
- Impersonation in MITRE F3 has two sub-techniques: Account Holder and Official impersonation.
- Account Holder Impersonation targets bank staff; Official Impersonation targets customers.
- Stolen personal data (often from phishing or data breaches) enables convincing knowledge-based authentication bypass.
- Authority, urgency, and caller ID spoofing are the primary levers in Official Impersonation.
- Both contact centre staff and customers need targeted training to recognise and resist impersonation attacks.
What is MITRE Fight Fraud Framework™ (F3)?
The MITRE Fight Fraud Framework (F3) is a curated knowledge base of tactics, techniques, and sub-techniques used by fraud actors in cyber-based financial fraud incidents. Developed by MITRE's Center for Threat-Informed Defense in collaboration with FS-ISAC, JPMorganChase, and Lloyds Banking Group, it provides a common language for fraud-fusion teams to describe, detect, and prevent financial fraud. F3 is modeled after MITRE ATT&CK® and focuses on banking institutions as its initial scope.
