Brand Impersonation.

What is brand impersonation?

Brand impersonation is when someone pretends to be a company, or people who work for it, to trick others. The fake can be a website, an account, a message or a phone call. The aim is to make the target trust the sender and act.

How do attackers impersonate a business?

The FTC describes business impersonator scams this way. Scammers contact you by call, email, text or social media and pose as a legitimate business. They may say there is a problem with your account or that you won a prize. They direct you to call a number or click a link. If you call, the FTC says they will tell you to send payment or give personal information.

MITRE ATT&CK lists this behavior as Impersonation, technique T1684.001. MITRE says adversaries impersonate trusted individuals or organizations to manipulate targets into taking harmful actions. Common targets of this trick include executives, colleagues and vendors. MITRE links the technique to financial theft and information disclosure. ATT&CK is MITRE’s public catalog of attacker behavior.

What do fake websites have to do with it?

MITRE technique T1583.001, Domains, says adversaries may buy domain names for use in targeting operations. A domain name is the human-readable address of a website. MITRE says attackers can create domains similar to legitimate ones by using lookalike characters or different top-level domains, such as the ending after the last dot. It also lists typosquatting, which is registering misspelled versions of real domains.

What are the warning signs?

The FTC lists these red flags:

• A request to pay by gift card, cryptocurrency or wire transfer.
• A request for your Social Security number or access to your computer.
• An unexpected message that asks you to click a link or call a number.

CISA says reputable institutions have dedicated staff who produce, verify and proofread customer messages. It names poor grammar and generic greetings as red flags.

How can it be reduced?

The FTC says not to click links or call numbers in unexpected messages, even if they seem to come from a business you know. CISA advises contacting an organization directly, using contact details you have confirmed yourself. MITRE lists user training as a mitigation, so people can confirm incoming requests through an independent channel such as a phone call. MITRE also lists a threat intelligence program, which gives awareness of active impersonation campaigns and common lures. For fake domains, MITRE says defenders can monitor domain registration data and look for domains built like their own organization’s name under different top-level domains. It also says organizations may register similar domains themselves as a deterrent, though most of this activity happens outside their control.

The FTC asks people to report scams at reportfraud.ftc.gov.

Is brand impersonation the same as phishing?

No. CISA describes phishing as a form of social engineering in which attackers use email or malicious websites to ask for personal information while posing as a trustworthy organization. Brand impersonation is the wider idea of pretending to be a company. Phishing is one common way to do it. Typosquatting and spear-phishing are related terms with their own pages in this glossary.

Is brand impersonation the same as typosquatting?

No. Typosquatting is one way to build a fake website address. Impersonation can also use fake accounts, calls and messages that need no lookalike domain at all.

Brandefense offers phishing and domain abuse monitoring, which watches for lookalike domains.