Impersonation fraud is the crime of adopting someone else’s identity, or posing as a business or government official, to steal money, property, or sensitive information. Reported losses hit $2.95 billion in 2024, making it the second-costliest fraud category tracked by the Federal Trade Commission.1Federal Trade Commission. New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024 Federal statutes carry prison terms as long as 30 years for the most serious offenses, and a 2024 FTC rule now lets regulators seek civil penalties and direct refunds for victims of government and business impersonation scams.
What Makes It a Crime
Prosecutors must prove three things to turn an impersonation into a criminal fraud charge. The person knowingly took on a false identity, whether by using someone else’s name, credentials, or a fabricated persona. The false identity was used with the intent to obtain money, property, or another tangible benefit. And the misrepresentation was material to the victim’s decision to hand over money or information.
Materiality draws the line between fraud and harmless pretending. A misrepresentation is material if a reasonable person would consider it important when deciding whether to go through with a transaction, or if the defendant knew the victim would rely on it.2Supreme Court of the United States. Kousisis v. United States, Opinion of the Court Someone impersonating a celebrity at a party as a joke doesn’t clear that bar. Someone impersonating a bank officer to authorize a wire transfer does.
How Impersonation Scams Work
Business Email Compromise
Business email compromise is the single most expensive impersonation technique in use. Criminals spoof or hijack corporate email accounts to pose as executives, vendors, or attorneys, then direct employees to wire funds to accounts the criminals control. The FBI’s Internet Crime Complaint Center has tracked over $55 billion in exposed losses from these schemes between 2013 and 2023.3Internet Crime Complaint Center. Business Email Compromise: The $55 Billion Scam The attacks exploit trust and urgency rather than technical vulnerabilities. An email that looks like it came from the CEO requesting an emergency payment to close an acquisition often gets processed before anyone calls to verify.
Voice Phishing and Caller ID Spoofing
Voice phishing uses phone calls to impersonate government agencies, banks, or family members. Spoofing technology alters the caller ID display to show a legitimate number, so the call appears to come from the IRS, a local police department, or your own bank. The caller pressures you to act immediately, claiming you owe back taxes, your account has been compromised, or a relative is in jail. That urgency is the tell. Legitimate agencies send written notices before calling about debts, and banks will never ask for your full password over the phone.
Deepfake Impersonation
Artificial intelligence can now generate realistic audio and video of real people, and criminals use these deepfakes to impersonate executives in video calls, fabricate endorsements from public figures, and mimic family members in emergency scams. Deepfake-related fraud losses in the United States have reached hundreds of millions of dollars, with corporate attacks and fake investment endorsements accounting for the bulk of the damage. The technology keeps getting cheaper, and this category is growing faster than almost any other fraud type.
Synthetic Identity Fraud
Rather than stealing one person’s identity wholesale, synthetic identity fraud blends real and fabricated personal information to create an entirely new persona. A criminal might combine a real Social Security number with a fake name and date of birth to open credit accounts, build a credit history over months, and then max out every account before disappearing. The Federal Reserve defines this as using a combination of personally identifiable information to fabricate a person or entity for financial gain.4FedPayments Improvement. Synthetic Identity Fraud Definition Because the identity doesn’t belong to any single real person, victims often don’t discover the fraud until a creditor tracks the Social Security number back to them.
Federal Penalties
Federal prosecutors often stack multiple charges against a single impersonation scheme. The penalties below can be combined when one fraud violates more than one statute.
Identity Document Fraud
18 U.S.C. § 1028 is the primary federal identity fraud statute. It covers producing, transferring, or possessing false identification documents and using another person’s identifying information without authorization.5Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information Penalties scale with the seriousness of the offense:
- Up to 5 years for basic production, transfer, or use of false identification documents or another person’s identifying information.
- Up to 15 years for producing or transferring false government IDs, birth certificates, or driver’s licenses, or for obtaining $1,000 or more in value through identity fraud within a single year.
- Up to 20 years for identity fraud tied to drug trafficking, a violent crime, or committed after a prior conviction under the same statute.
- Up to 30 years for identity fraud committed to facilitate domestic or international terrorism.
Aggravated Identity Theft
When someone uses another person’s identifying information during a federal felony, 18 U.S.C. § 1028A adds a mandatory two-year prison sentence on top of whatever punishment the underlying crime carries.6Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft If the underlying felony involves terrorism, that mandatory add-on jumps to five years. Courts cannot reduce the sentence for the original crime to compensate, and the identity theft sentence cannot run at the same time as the other sentence.
Impersonating a Federal Official
Pretending to be a federal employee or officer and acting in that fake capacity is a standalone crime under 18 U.S.C. § 912, carrying up to three years in prison.7Office of the Law Revision Counsel. 18 USC 912 – Officer or Employee of the United States This is the statute prosecutors use against scammers who call victims claiming to be IRS agents, FBI investigators, or Social Security Administration officials.
Wire Fraud
Most impersonation scams involve some form of electronic communication, which brings wire fraud into play. 18 U.S.C. § 1343 covers anyone who uses wire, radio, or television communications across state or international lines to execute a scheme to defraud, carrying penalties of up to 20 years in prison.8Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television If the scheme affects a financial institution, the maximum jumps to 30 years and a $1 million fine.
Bank Fraud
When impersonation fraud targets a bank or financial institution directly, prosecutors can bring charges under 18 U.S.C. § 1344, which carries up to 30 years in prison and a $1 million fine.9Office of the Law Revision Counsel. 18 USC 1344 – Bank Fraud
The 2024 FTC Impersonation Rule
In April 2024, the FTC’s Trade Regulation Rule on Impersonation of Government and Businesses took effect at 16 CFR Part 461.10Federal Register. Trade Regulation Rule on Impersonation of Government and Businesses Before the rule, the FTC could sue impersonation scammers but had limited ability to recover money for victims or impose civil penalties. The rule declares that posing as a government entity or business, or falsely claiming affiliation with one, is an unfair or deceptive trade practice when done in a way that would influence someone’s decisions. It also lets the FTC pursue civil penalties against violators and seek direct refunds for consumers through federal court. Government impersonation scam losses rose to $789 million in 2024, up $171 million from the prior year.1Federal Trade Commission. New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024
State Laws
Every state has some version of a false personation or identity theft statute. These laws typically make it illegal to use another person’s name, documents, or credentials to sign contracts, open accounts, incur debt, or obtain services. The labels differ: some states call it criminal impersonation, others use false personation, and some fold it into broader identity theft codes. The core elements are the same.
Penalties vary widely. A first offense involving small dollar amounts might be a misdemeanor with county jail time measured in months. Schemes involving larger losses, multiple victims, or vulnerable populations often escalate to felony charges with multi-year prison sentences. Many states also allow courts to order restitution directly to victims as part of sentencing. Check with your local district attorney’s office or state attorney general to see which statute applies in your jurisdiction.
The First 48 Hours After You’re Targeted
Speed matters more than thoroughness. Several of the protections below have strict deadlines, and missing them can shift financial liability onto you.
Freeze Your Credit Reports
Contact Equifax, Experian, and TransUnion and request a security freeze. Federal law requires each agency to place the freeze within one business day of a phone or online request, and within three business days for mail requests.11Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts The freeze is free, stays in place until you remove it, and blocks anyone from opening new credit accounts in your name. You can lift it temporarily when you need to apply for credit yourself.
Notify Your Bank Fast
Under federal Regulation E, your liability for unauthorized electronic transfers depends entirely on how fast you act:
- Report within 2 business days and your maximum liability is $50.
- Report after 2 business days but within 60 days of your statement, and the maximum liability rises to $500.
- Report after 60 days past your statement date, and you could be liable for the full amount of unauthorized transfers that occurred after that 60-day window.
Those deadlines run from the date you learned of the unauthorized access or from the date your statement was sent, depending on your situation.12Consumer Financial Protection Bureau. Regulation E – 1005.6 Liability of Consumer for Unauthorized Transfers The difference between reporting on day one and day sixty-one can be thousands of dollars. If extenuating circumstances prevented you from reporting sooner, the institution must give you a reasonable extension, but don’t rely on that.
Flag Tax Fraud With the IRS
If someone used your Social Security number to file a fraudulent return or for employment, submit IRS Form 14039, the Identity Theft Affidavit. The IRS prefers online submission, but you can also mail the form to its Fresno office or fax it to 855-807-5720.13Internal Revenue Service. Form 14039, Identity Theft Affidavit If the fraud is blocking you from filing electronically, attach the completed form to the back of a paper return.
Correct Your Social Security Record
When someone uses your Social Security number for employment, their earnings can land on your record and affect your future benefits. The Social Security Administration can correct your earnings record even after the normal time limit has passed when the error results from fraud or from earnings being posted to the wrong person.14eCFR. 20 CFR 404.822 – Correction of the Record of Your Earnings After the Time Limit Ends Contact the SSA directly and bring documentation showing which earnings are not yours.
Gather Evidence Before You File
Investigators need specifics, and the quality of your report affects whether anyone acts on it. Save the full headers from any fraudulent emails, not just the visible “From” address. Email headers contain routing data, IP addresses, and authentication results that reveal whether the sender’s domain was spoofed. Most email clients expose headers through a “Show Original” or “View Source” option. The critical fields are the “Received” chain, the originating IP address, and any SPF or DKIM authentication results.
Take screenshots of every interaction: text messages, social media conversations, fake websites, logos, and branding. If money was transferred, gather bank statements, wire receipts, and transaction confirmation numbers showing amounts, dates, and destination accounts. Write down the names and titles the scammer used, including any badge numbers, department names, or case numbers they cited. These details go into the reporting forms and help investigators match your complaint against others from the same ring.
Where to File
FBI Internet Crime Complaint Center
The FBI’s IC3 portal at ic3.gov is the primary federal intake point for internet-facilitated fraud. The complaint form asks you to enter the scammer’s contact information, specify your financial losses, and describe what happened in a narrative incident summary.15Internet Crime Complaint Center. Complaint Form After you submit, the system generates a unique complaint ID and a downloadable receipt. Save both. The receipt is your formal record of the report, and you’ll need the complaint ID if investigators follow up.
FTC at IdentityTheft.gov
For identity theft specifically, IdentityTheft.gov walks you through a guided process that generates a personalized recovery plan and an FTC Identity Theft Report. That report functions as an identity theft affidavit for disputes with creditors and credit bureaus. If the fraud involved a government or business impersonation scam but didn’t result in identity theft, file a general fraud complaint at ReportFraud.ftc.gov instead.
Local Police
File with your local police department as well. Some creditors and credit bureaus require a police report number before they’ll process disputes or remove fraudulent accounts. Bring your IC3 receipt, FTC report, and all supporting evidence.
Getting Money Back
Criminal prosecution isn’t the only path to recovery. Federal law requires judges to order restitution when sentencing defendants convicted of fraud that caused identifiable victims to suffer financial harm.16Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes If the fraudster can’t return what was stolen, the court orders payment equal to the value of the property at the time of loss or at sentencing, whichever is greater. Courts can decline restitution only when the number of victims is so large it becomes impractical, or when calculating losses would unreasonably delay sentencing.
You can also file a civil lawsuit independent of any criminal case. Common claims include fraud, conversion, and invasion of privacy through appropriation of your name or likeness. Civil suits can recover compensatory damages for actual financial losses and, in egregious cases, punitive damages. The statute of limitations for federal civil claims arising under congressional acts is generally four years from when the claim accrues, though state deadlines vary.17Office of the Law Revision Counsel. 28 USC 1658 – Time Limitations on the Commencement of Civil Actions Arising Under Acts of Congress The clock starts running when you discover (or reasonably should have discovered) the fraud, so delaying a conversation with an attorney can cost you the right to file.
If a Public Company Is the Target
If your company is publicly traded and suffers a material impersonation attack, such as a business email compromise that drains an operating account, SEC rules require disclosure. Under Item 1.05 of Form 8-K, public companies must report any material cybersecurity incident within four business days of determining the incident is material.18U.S. Securities and Exchange Commission. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure The disclosure must cover the nature, scope, and timing of the incident along with its actual or likely financial impact. The materiality determination cannot be unreasonably delayed, and the only basis for postponing disclosure is a written determination by the U.S. Attorney General that disclosure would pose a substantial risk to national security. Private companies don’t face the same SEC obligation, but they should still report to law enforcement through IC3 and notify affected customers if personal data was compromised, since many states have breach notification laws with their own deadlines and penalties.