Business identity theft: the real risk is the “almost official” message
A fraudster does not try to look “obviously fake”: they try to be just credible enough to trigger a payment, access, a signature or a bank-details change. Here: a clear checklist + a 30-second method to avoid costly mistakes.
What you risk in 10 seconds:
- Diverted bank transfer (fake bank details / fake beneficiary)
- Compromised account (fake portal / fake support → credentials)
- Trapped commitment/contract (signature, clauses, deposits)
Important: a signature, a PDF, a logo or a “well-written” email prove nothing. The key check is: official channel + verifiable proof if the exchange claims to be official.
The most common signs of business identity theft
B2B impersonation wins through routine: rushed accounting, bypassed processes, an “exceptional” change.
- “Almost official” email (similar domain, hyphen, variant) : Example: support@company-secure.com instead of @company.com. Fraudsters play with one character or an extension.
- New contact outside the normal process : A “new manager”, “new accounting department” or “new support” that refuses the usual channels is suspicious.
- Sensitive change: bank details, beneficiary, portal, procedure : Any payment or procedure change must be verified through another channel (known phone number, official portal).
- Pressure: urgency, confidentiality, threat : “Do not forward this to anyone”, “final reminder”, “deadline today”: this is the fuel of impersonation scams.
- Links and attachments : Payment link, fake portal, fake login, “invoice/contract” PDF. The content often exists to make you click.
- Weak proof: signature, logo, “professional” documents : A visual identity can be copied. What helps: official channel + verifiable proof (public page + PDF).
Simple rule: any sensitive change (bank details, payment link, portal, procedure, contact person) = mandatory confirmation through another channel.
The cautious 30-second method
Goal: prevent the impersonation from driving your process.
- Do not pay, grant access or sign under pressure.
- Check the domain (end of the domain) and the channel: compare with your usual contacts.
- Confirm through an independent channel: known number, official portal, already validated contact.
- If the exchange claims to be official: require a publicly accessible verifiable proof.
Concrete example: accounting@company-france.com.secure-pay.com may look credible, but the real domain is secure-pay.com. What matters is the end of the domain.
Useful shortcut
If someone asks you to ignore the usual habits (“it is urgent”, “exceptional”), you switch to mandatory verification mode.
Check a proof nowCommon scams linked to business identity theft
The variants are numerous, but the mechanism remains: credibility + urgency + action.
- Fake supplier + bank-details change : Classic B2B scam: “our bank has changed”, “new IBAN” → diverted bank transfer.
- Fake support / fake portal : You are pushed to enter credentials on a clone (Microsoft/Google/pro tool) to recover your account.
- Fake invoice / fake quote : Credible PDF + payment link: the goal is a quick payment, sometimes repeated small amounts.
- “CEO / management” impersonation : Email/voice/video “from the executive” to trigger an urgent payment or access.
These scenarios often use invoices or links: also see payment / invoice scam and fake website.
What to do if you think you are being targeted?
- Stop: no sensitive action until it is confirmed : Payment, access, bank details, signature: everything moves to “mandatory verification” as soon as there is doubt.
- Confirm through an independent channel : Do not reply to the email you received. Call a known number, or find the contact through the official site.
- Check the history : Is this a contact already known? Same tone, same procedures, same details? Impersonation breaks consistency.
- Keep evidence : Email, headers, PDF, URL, page screenshots: if there is an incident, the file must be reconstructable.
If it comes from an email, start by checking the email and, if needed, creating an email proof.
FAQ
- Does a well-written email prove it is official? No. Impersonators write very well. The check is: domain + official channel.
- Are a logo / signature / “professional” invoice enough? No. Everything can be copied. Check the beneficiary and the source.
- What is the best reflex? Refuse urgency and confirm through an independent channel.
- Does Kicklinks prevent impersonation? No. Kicklinks helps check whether there is a verifiable proof publicly accessible.
Useful links
Related guides: payment / invoice · fake document · fake website
Validate nothing without an official channel
Impersonation is “almost official”. The defense is simple: confirm through an independent channel, then act only after that.
