4. Malicious Actors & Misuse2 - Post-deployment

Impersonation/identity theft

Impersonation/identity theft - Theft of an individual, group or organisation’s identity by a third-party in order to defraud, mock or otherwise harm them.

Source: MIT AI Risk Repositorymit943

ENTITY

1 - Human

INTENT

1 - Intentional

TIMING

2 - Post-deployment

Risk ID

mit943

Domain lineage

4. Malicious Actors & Misuse

223 mapped risks

4.3 > Fraud, scams, and targeted manipulation

Mitigation strategy

1. Mandate Multi-Factor Authentication (MFA) and Robust Credential Management Implement and enforce the use of multi-factor authentication across all critical systems and accounts. Furthermore, require complex, unique passwords or passphrases to substantially elevate the security barrier against credential compromise and unauthorized access for impersonation purposes. 2. Establish and Enforce Out-of-Band Verification and Identity Proofing Protocols Institute formal procedures that require validation of any sensitive request (e.g., financial transfer, credential change) via an independent, pre-established communication channel, particularly when the request originates from a seemingly trusted source (e.g., executive, business partner) through a primary channel (e.g., email, unexpected phone or video call). 3. Deploy Advanced, Real-Time Anomaly Detection and Behavioral Monitoring Systems Utilize machine learning and artificial intelligence for continuous transaction monitoring, behavioral biometrics, and activity analysis to rapidly identify and flag anomalous patterns that are indicative of an ongoing identity compromise or account takeover (ATO) attempt.