Network and Perimeter Hacking · Topic 4 of 9
Impersonation, Identity Theft and Social Engineering Defense
How attackers impersonate people on social networks, the main identity theft types, and the training and technical controls that stop social engineering.
- 4 min
- Public profile data feeds reconnaissance and believable lures.
- Verify unexpected requests through another channel.
- Synthetic identity theft mixes real and fake data. Child identity theft can go unnoticed for years.
What it is
Social networking sites hold the details attackers need to make a lie believable: job titles, colleagues, hobbies, travel and photos. Impersonation uses that material to pose as a person the victim trusts.
Identity theft is the use of another person's identifying data to commit fraud. The page ends with the controls that blunt both, which are mostly awareness, policy and verification.
How it works
Impersonation on social networking sites
Attackers gather names, employers, email formats, birthdays and relationships from public profiles. They use that for several tricks.
| Trick | Description |
|---|---|
| Cloned profile | A copy of a real person's account, with a new friend request sent to their contacts |
| Fake recruiter or executive | A profile posing as an authority to obtain documents, credentials or payments |
| Targeted lure | A message that uses real details to look genuine, leading to a malicious link or attachment |
| Reconnaissance for a later attack | Mapping the company structure to choose phishing targets |
| Malicious apps and quizzes | Third party apps that ask for broad permissions and harvest data |
Common signs of a fake profile are a very recent account, few posts, a stock photo, many connections from one industry and requests that rush the user. Users should check requests through another channel, review privacy settings, limit what is public and avoid posting work details, badge photos or travel plans.
Identity theft
Identity theft starts with data gathered through phishing, data breaches, stolen mail, dumpster diving, skimming or malware. The thief then opens accounts or makes purchases in the victim's name.
| Type | Meaning |
|---|---|
| True name (existing account) fraud | Misuse of a victim's real details or existing accounts |
| Synthetic identity theft | A new identity built from real and invented data, for instance a real identification number with a made up name |
| Account takeover | Taking control of an existing account, often with stolen credentials |
| Medical identity theft | Using someone's insurance or health record to obtain care or drugs |
| Tax identity theft | Filing a fraudulent return with a stolen identification number |
| Child identity theft | Using a minor's number, which can go unnoticed for years |
| Identity cloning | Living as another person, which is rarer |
Warning signs for a victim include unknown charges, bills for accounts never opened, credit report entries, denied credit and mail that stops arriving. Protective steps are to check credit reports, place a fraud alert or credit freeze, use multi factor authentication, shred sensitive paper and report quickly.
Social engineering countermeasures
No single tool stops social engineering, so layers matter.
| Layer | Examples |
|---|---|
| People | Regular awareness training, simulated phishing, a clear way to report suspicious messages |
| Process | Callback verification for sensitive requests, two person approval for payments, help desk identity checks |
| Physical | Badges, visitor escorts, mantraps, shredding, clean desk and screen privacy filters |
| Technical | Email filtering, SPF, DKIM and DMARC, link scanning, multi factor authentication, web filtering, endpoint protection |
| Policy | Acceptable use, data classification, social media guidance and an incident response plan |
Multi factor authentication limits the value of a stolen password, although users can still be tricked into approving a prompt, which is why number matching and phishing resistant factors such as FIDO2 keys help.
A worked example
A staff member receives a connection request from a former colleague, whose profile was copied. After a few messages the "colleague" shares a link to a document that asks for the company login. A report to the security team, blocking of the fake profile and a reset of the entered password follow. Training on verifying a contact through a second channel would have stopped the first step.
How the exam asks about this
- "An attacker builds a second account with a real person's name and photo and contacts their friends. What is this?" -> Cloned profile impersonation on a social networking site.
- "A new identity is made from a real identification number and a false name. Which identity theft type?" -> Synthetic identity theft.
- "Which control best defeats a convincing request to change payment details?" -> Out of band (callback) verification with two person approval.
What to remember for the exam
- Public profile data feeds reconnaissance and believable lures.
- Verify unexpected requests through another channel.
- Synthetic identity theft mixes real and fake data. Child identity theft can go unnoticed for years.
- Layered defense: training, process, physical, technical and policy controls.
- Reporting channels and simulated phishing are part of awareness programs.
Technology alone is not the answer to a social engineering question. If options include training or verification procedures, they often beat a purely technical control.
Common mistakes
Trusting a profile because it has mutual friends. Cloned accounts copy real contacts.
Treating multi factor authentication as a complete fix. Users can be tricked into approving prompts.
Forgetting the physical layer. Shredding, badges and visitor control defeat dumpster diving and tailgating.
Check yourself
Why do attackers study social network profiles?
They give names, roles and relationships that make impersonation and targeted lures believable.
What is synthetic identity theft?
Creating a new identity from a mix of real and invented data.
Which two measures best counter a fake payment request?
Callback verification through a known channel and approval by two people.
Topic 4 of 9 in Network and Perimeter Hacking
Test yourself on Network and Perimeter Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.