These are patterns of behaviour, not personality types or diagnoses of people. Scenarios are hypothetical learning examples, not real incidents. Research and source-review limits are preserved from the dated Hebrew original.
What happens
An unsolicited approach from what looks like a familiar organisation, such as a bank or company, asks for verification or action. The caller controls the channel and the pace.
Warning sign
Urgency, and requests for a verification code, login details or installation of remote-control software.
Safer action
Stop and hang up. Reconnect through a channel you choose: a number from the bank's website, not the call.
Hypothetical illustration: the call that sounded exactly like the bank
The phone rings. The bank's name appears, or a familiar-looking number. A polite representative knows your name, ID number and perhaps the amount of your last transaction. There is a problem with the account, they say, and it must be dealt with now. They are not asking for money, only to "verify" something. They are patient, explain and guide you. By the end of the call, a code has been shared, an app installed or a "temporary" payment made.
Nothing was broken into. The door opened from inside because someone changed faces.
How the pattern works
The Chameleon uses three moves: borrowing an identity, such as a name, role, number or ID, real or forged; controlling the channel, choosing the phone, message or website and therefore what you see; and setting the pace, through urgency, continuity or calculated patience. They share one feature: verification happens in a channel the other party chose.
From an investigator's perspective
When examining impersonation, ask who initiated contact and who chose the channel. Even a familiar caller ID is not verification. Hanging up and calling a number you found yourself moves the check outside the caller's control [11].
Possible explanations for the behaviour
This is a possible interpretation, not a diagnosis of a person. Where there is no evidence of thought or intent, these remain hypotheses.
The impersonator plays a role: banker, official, officer or technician. Staying in character requires credible answers even when challenged. Distinguish this from Youngs and Canter's framework: their paper concerns the story offenders tell themselves about their role in an offence, and does not prove how a particular impersonator thinks or acts [1].
What research shows
- Recurring scam principles: Stajano and Wilson identified persuasion principles in scams against individuals, including apparent authority and time pressure [6].
- Judgement errors: the OFT report examined how scams exploit emotion and decision-making shortcuts. It does not reduce susceptibility to scams to a lack of intelligence [9].
- In Israel: the Bank of Israel warns about impersonation and says not to share login details or verification codes during a call you did not initiate. Call the bank or card company using a number you found independently [11].
- In the US: according to the FTC source cited in the Hebrew version, imposter scams were the most-reported fraud category in 2025, with $3.5 billion in reported losses [13]. These are reports to the agency, not a measurement of every case.
What the research cannot tell us
This is not a tool for identifying an impersonator by appearance or personality. The sources concern persuasion mechanisms, cases and reports, not every impersonation. Experienced people can make mistakes too; that does not mean everyone is equally vulnerable.
What to do
- An unsolicited approach asking for action is a reason to stop. Hang up and return through a channel you choose, such as a number from the bank's website, not the call.
- Do not give an unsolicited caller login details or a verification code, or install remote-control software at their request [11].
- Urgency is a reason to check, not a reason to act.
Related case: "Your account has been hacked" - bank impersonation
Related explainer: the fraudster makes you open the door yourself