Online Impersonation: Experts Tell Us How To Stay Safe

Amid rising cyber crimes in India, the Delhi police released a YouTube video on how to fight online impersonation with the hashtag '#AkeleNahiHainAap', asking people to register a complaint at the nearest police station or call 112 /1091 for immediate help. In another step, Delhi Police also signed a Memorandum of Understanding (MoU) with Truecaller, a caller ID verification tool recently, in order to curb cybercrime.

Fraudsters usually use a fake identity to demand money online from people they know, be it on Facebook or Whatsapp. In 2022, a director at Pune’s Serum Institute of India transferred Rs 1.01 crore to fraudsters who posed as the CEO of the company Adar Poonawal.

BOOM spoke to experts to find out how we can prevent our online profiles from being impersonated and how we can identify if we're being duped. Here's what we found:

What Is Online Impersonation?

Online impersonation can be defined as "pretending to be someone else online". For example, if anyone uses your picture or name to create any form of fake id on social media platforms or anywhere on the internet, and uses it for malicious intentions.

There are many ways in which online impersonation can happen.

1. Through Social Media Accounts: According to cyber.delhipolice.gov.in, Facebook, Twitter, Instagram and LinkedIn are commonly used social media platforms used for impersonation crimes. Fake profiles are often created to cause harassment, stalking, cyberbullying, and most frequently for monetary fraud.

Speaking to BOOM, cyber expert Prashant Sahu said, "Impersonations on social media for monetary frauds are usually being done on Facebook and WhatsApp. The impersonator creates a profile similar to an already existing one, and then asks other friends to pay some amount by pretending that they are in some medical problem or some other difficulty, and need monetary assistance immediately."

2. Through E-mail: Phishing scams or CEO frauds often happen via email, wherein the impersonator sends the email, pretending to be an executive or an employee of a company, seeking private information. The email asks the recipient to take immediate action which involves transferring money to a specific account. According to Ritesh Bhatia, a cyber expert, online impersonation is not merely done for financial fraud, but also for corporate espionage, extracting confidential information, bullying, and seeking revenge, among other objectives.

3. Through Mobile Apps: Among many useful apps, lie several fake and malicious apps, which may redirect customers to illegitimate websites to steal personal and financial information. Cyber Delhi Police advises to visit the official website of the brand or seller and look for the icon or button that reads "Get our app", when in doubt.

4. Through Websites: Scammers or impersonators often create lookalike websites of businesses and services to dupe online users. Shaquib Izhar, a threat intelligence analyst told BOOM that due to the advancement in technology, scammers can create such believable websites that make it difficult for even an experienced person to differentiate a fake website from a real one.

Recently, according to a report in The Indian Express, The Delhi police arrested a web designer last Friday, who duped customers by creating fake websites mostly of Patanjali Yogpeeth. This is an example of online impersonation, where not only is the brand identity impacted, but customers suffer monetary losses.

Online Impersonation Vs Identity Theft

Ritesh Bhatia, a cyber security expert in a conversation with BOOM said, "Most people confuse identity theft with online impersonation. However, the two terms are not interchangeable." When someone wrongfully obtains or steals somebody's personal information like a bank account number, personal account number or any other unique identification to commit fraud, it is said to be an identity theft. "Credit card frauds are very common, they(scammers) often impersonate well-known personalities via identity theft. They get access to PAN, date of birth etc created a fraudulent identity and use it illegally. In such cases, the scammers are impersonating as well as doing identity theft."

Identifying Online Impersonators & Safeguarding Yourself

"The scammers are coming up with novel methods, so understanding the modus operandi will not suffice. It is important to understand that trust, anonymity and privacy are a myth on social media," Ritesh Bhatia told BOOM.

To protect yourself from being impersonated or succumbing to an online impersonation act, here are some of the steps that can be followed, as suggested by cyber.delhipolice.gov.in and cyber experts.

Restrict who can find you via an online search: Prashant Sahu told BOOM, "On Facebook, there is an option to hide your friends, which can prevent new friends or scammers from seeing your known people, therefore restricting them from impersonating you and contacting your friends or relatives."

Be careful while interacting with new profiles on social media: "Whenever you receive a friend request, check if a person with the same credentials is already in your profile. Analyse the profile to look for signs of impersonation, as a fake profile would not have many posts and could have been created recently. "If you receive a message on WhatsApp from a new mobile number, with your friend/ relative's display picture, verify the message with the previous mobile number first," he added.

Don't depend solely on technology for safety: With scammers employing advanced ways, Ritesh Bhatia suggests, "It is very important to stop becoming increasingly dependent on technology. Don't use technology to safeguard yourself from technology." He emphasised the need to verify and communicate offline, to fight online impersonation. "I always follow the principle of 'Pause, Zero Trust and Verify.'" He added, "Whenever you receive anything online, hold on and think who has it come from and if this could be true. Go with the mindset of zero trust as when you don't trust, you verify. The biggest sign is anybody asking for any sort of information."

Highlighting the importance of verification, Bhatia said, "The most important tool to fight the menace of online impersonation will be 'verification' and not just awareness."

Be cautious while opening links and apps: "Nowadays impersonators are creating fraud websites, which look like genuine websites, posing as franchises, typically for monetary fraud," Prashant Sahu added. Whenever you receive an unexpected SMS, an alert or notification, or unusual requests with links or extreme repercussions from "banks" or other familiar brands, do not respond to them.

Learn from others' experiences: "When I ask people who are duped, they often tell me they are not following any news and aren't aware of the recent scams," Sahu adds on the severe lack of awareness among people about cybercrimes, as it makes the task of the impersonator easier. "One should try to be aware, subscribe to news websites, and follow relevant social media handles," he added.

Have You Been Impersonated Online?

According to Section 66D of the IT Act, 2000, "Whoever, by means of any communication device or computer resource cheats by personation, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to one lakh rupees."

Despite taking all preventive measures, it is quite likely that one might not only come across online impersonation but also fall into its trap. Here's what can be done next.

Take a screenshot of the alleged fake profile or email wherein the URL/email id of the said profile is visible.

Send blocking/deleting requests to the concerned service provider immediately.

In case of social media impersonation, inform your contacts or followers from any email/account not to respond to the fake profile in any case/issue/matter. Ritesh Bhatia explains, "The first priority should be reporting on the platform on which you or somebody else has been impersonated. Next, ask your friends also to report it and alarm them to not do anything that the impersonator might ask."

Inform cyber crime police by dialling 1930 and complain to your nearest Police Station describing the complete incident along with all the relevant details.

In case monetary loss is involved in cybercrime, call 1930 and get your accounts frozen. "Do not search for customer care accounts of the banks online as the impersonators often create fake helpline numbers or websites and dupe the victim again. Instead, call the customer care number written behind your debit/credit card," Prashant Sahu told BOOM.

"Don't delete evidence. However, if the scammer has made you install any apps or remote access apps, it is important to uninstall them. Also, don't switch off your phone, so that if the scammers continue with the crime, you are at least aware of what's happening or if your bank tries to reach you, they are able to do so," Ritesh Bhatia said.

Online Impersonation: Challenges in the AI Era

Ritesh Bhatia, while sharing his views about the need for changes in the policies and laws related to online impersonation said, "We don't have a data protection law as of now. We are in a time where we should now be talking about laws related to AI also, but we're quite far. This is something which we need to continually amend because newer methods are coming, and newer crimes are happening. It is very important that lawmakers keep making amendments from time to time as now a strong database also exists because of cybercrime.gov.in. So, it is important that stringent laws are made soon."

"Artificial intelligence will definitely help scammers. While the capacity of chatbots like chatGPT has been limited in outputs related to phishing, hacking or malicious code but there are ways to bypass this restriction, which might help enhance the skills of the scammer," Shaquib Izhar added.