Blue Tree Technology®
SCHEDULE YOUR FREE 15-MINUTE DISCOVERY CALLSupport CenterSupport: 816-994-8282Sales: 816-256-2595

Email, phishing & deliverability

What Is an Impersonation Scam (and How Do We Spot One)?

Published · Last reviewed · Next review due:

An impersonation scam is when someone pretends to be a person or company you trust, such as your IT provider, Microsoft, your bank, a vendor or your own boss, to get you to hand over a password, approve a sign-in, let them onto your computer or send money. These scams work because they borrow trust you already have. The good news is that most of them share the same few warning signs, and one habit stops nearly all of them: verify the request through a number or channel you already know.

Common impersonation scams

  • Fake IT-support calls. Someone calls or messages claiming to be from your IT provider or help desk. They say your account has a problem and ask you to read back a code, install a remote-access tool or visit a website.
  • Fake Microsoft, bank or vendor contacts. A pop-up, email or call claims your Microsoft 365 account is locked, your bank account is frozen or a vendor invoice is overdue, and pushes you to act through a link or phone number they provide.
  • CEO or executive requests. A message that looks like it's from the owner or a manager asks for a quick favor, often buying gift cards, sending a payment or sharing a file, and asks you to keep it quiet.
  • Vendor payment-change requests. A familiar supplier, or someone using a look-alike email address, says their bank details have changed and asks you to send the next payment to a new account.

Red flags to watch for

  • Urgency. “Do this in the next ten minutes or your account will be closed.” Pressure is meant to stop you from checking.
  • Secrecy. “Don't mention this to anyone yet.” Real requests can stand up to a second opinion.
  • Asking for MFA codes or remote access. A code sent to your phone is for you alone. Anyone asking you to read it back, or to let them onto your computer when you didn't ask for help, is a warning sign.
  • Payment changes. New bank details, a new payment method or gift cards instead of an invoice should always be verified before money moves.
  • Something slightly off. A sender address that's one letter different, a reply-to that doesn't match, an unusual time of day or a tone that doesn't sound like the person.

How to verify a request

Don't use the phone number, link or reply address in the message. Contact the person or company through a number or channel you already know, such as the number in your contacts, on a previous invoice or on the company's official website. For payment changes, call a known contact at the vendor before updating anything, and have a second person approve it. Our article on verifying wire and payment instructions walks through this step by step.

How Blue Tree Technology® will contact you

Blue Tree Technology® will never ask for your password or MFA code. Legitimate support starts with a ticket or a call you place to our known number, 816-994-8282. If someone claiming to be us asks for a code or wants to connect to your computer and you didn't open a request, hang up and call us at that number. That's also why tickets matter: our article on why your IT provider asks for a ticket instead of a call explains how a written request shows who is really asking.

What to do if you clicked or paid

  • If you entered a password or shared a code, change the password from a device you trust and contact your IT provider right away so they can check for sign-ins and mailbox rules.
  • If you let someone onto your computer, disconnect it from the network and call your IT provider before using it again.
  • If you sent money or gift cards, call your bank immediately and ask about recalling the payment. Speed matters. Keep the messages and receipts.
  • Report it either way. Telling your team and your provider helps stop the same scam from reaching the next person. Our article on what happens after someone reports a phishing email explains the next steps.

Don't let embarrassment slow you down. These scams fool careful people every day, and the first hour makes the biggest difference.

Some scams arrive through apps instead of calls. See our warning about fake authenticator apps that ask for payment. And for how a simple out-of-office reply can set up a payment scam, read The Fake Vacation E-mail That Could Drain Your Bank Account.

FAQ

Would my IT provider ever call me first?

Sometimes, for example to follow up on a ticket. If you're unsure, hang up and call back on the provider's known number. A real technician won't mind.

Is it ever OK to share an MFA code?

No. A code sent to your phone or app is for you to type in yourself. No real support person needs you to read it to them.

What if the request really is from our CEO?

Then a quick call to a known number costs a minute. Make verification a normal habit so no one feels awkward asking.

Still have a question?

Ask Little Sprout, the assistant on our website, for general information. To talk through how your team should verify unusual requests, schedule a free 15-minute discovery call.

Back to the Knowledge Hub

More in this topic

Discuss your business technology needs

Review your priorities with Blue Tree Technology®.

Schedule a discovery call