The growing threat of impersonation scams 

In today’s digital world, fraudsters are constantly finding new ways to trick people into sharing sensitive information or transferring money. Impersonation is a type of fraud we increasingly see and hear about from our clients. In these scams someone pretends to be a trusted contact – for example, a colleague from your IT department, your bank, or even your payment solutions provider. Their goal is to convince you to process a refund, share login details, or disclose confidential data. These scams can happen to anyone, regardless of their role or experience. That’s why it’s essential to stay vigilant and know how to spot the warning signs. 

Scammers use urgency and familiarity to manipulate victims 

The scenario often starts with a phone call, an email, or even an urgent message. The person on the other end sounds professional, uses familiar language, and even refers to real procedures or processes. They might claim there’s an urgent issue, an incorrect transaction, or a pending refund that needs immediate attention. Their tone is persuasive, sometimes even pressuring you to act quickly without double-checking. But here’s the catch! No legitimate organization will ever rush you into sharing sensitive information or making financial transactions without proper verification. 

Key red flags to watch for

So, how can you protect yourself and your organization? First, always verify the identity of the person contacting you. Never use contact details given in the suspicious message itself.  If the request feels unusual or too urgent, it could be fraud. 

Never share sensitive data on unexpected requests

Another red flag is when the caller asks for information they should already have. For example, no legitimate internal contact, such as IT, would unexpectedly request your bank account details. Similarly, test transactions should never exceed €1. Any request above this amount should raise an alert. Legitimate organizations will never ask you to transfer money, process a refund, or share login credentials out of the blue. If IT or a technical service calls with an unfamiliar request, especially one involving transactions, always verify their identity or consult your manager before proceeding.  

Trust your instincts if something feels off 

If you’re unsure, take a step back and ask yourself if the request makes sense. If something feels off, take a step back and verify the request before taking any action.  

It’s also important to remember that fraudsters don’t just target individuals, they exploit trust within teams. They might pretend to be a manager, a colleague from another department, or even an external partner. Always cross-check unusual requests, especially if they involve sensitive data or money. A quick message to the supposed sender through a verified channel or via your manager can save you, and your company, from significant losses. 

How hacked emails lead to payment fraud 

Fraudsters are not limited to phishing and malware; they also exploit seemingly harmless processes. In a recent case, a client received an invoice via email as a PDF. Unknown to them, their email account had been hacked, allowing the scammer to alter the IBAN number on the invoice. This is a stark reminder: always verify payment details directly through a trusted channel, such as a secure portal (e.g.: PEPPOL) or a phone call to a known number, before processing any transaction. Vigilance at every step is critical to countering these evolving threats.  

Reporting suspicions helps protect everyone in the organization 

Finally, if you notice anything unusual, whether it’s an unexpected email, a modified invoice, or a suspicious call, report it immediately to your management or the designated contact person in your organization. Even if it turns out to be a false alarm, timely reporting allows teams to identify emerging scam tactics and prevent broader risks. At Axepta BNP Paribas Benelux, for example, specialized teams monitor and prevent fraudulent activity, but their success relies on everyone’s awareness and prompt action. Stay alert, verify details, and speak up, it’s how we collectively safeguard our operations.