Most of the impersonation and payment fraud we investigate does not begin with a breach. It begins with reading. The attacker learns who approves payments, who files the paperwork, which law firm sends it and what a genuine document looks like, and almost all of it comes from material the target published itself.
Convincing lures are researched lures
Generic phishing is a volume business and most organizations now filter it well. The attempts that reach a decision maker are different. They name the right colleague, refer to a real transaction, arrive from a domain that differs from a trusted one by a single character and attach a document that looks exactly like the genuine article, because it usually is the genuine article with one detail changed.
Of the 71 impersonation and payment fraud attempts we investigated for clients between January 2025 and October 2026, 58 used at least one item taken from the target's own public record. In 23 of them, the lure reused a real document obtained from a public registry or the client's website.
Most of this exposure is lawful, deliberate and in some cases compulsory. Companies must file accounts and appoint officers in public. The question is not whether the information exists, but whether you know what it enables and have controls for the parts you cannot remove.
Six things an attacker reads first
1. Registry filings and the documents behind them
A registry summary lists officers and an address. The scanned documents behind it often carry far more: wet signatures, the name of the person who prepared the filing, a covering letter from outside counsel or a registered agent, and correspondence details for the paralegal handling it. Each of those is a template for a forgery and a name to impersonate.
2. Disclosures and officer lists
Listed companies publish annual reports, proxy statements and board changes. Together they describe who reports to whom, who signs, which advisers the company relies on and when leadership is in transition, which is precisely when unusual instructions are least likely to be questioned.
3. People and roles
Professional profiles, conference programs and press releases let anyone reconstruct an organization chart for the roles that matter to fraud: finance, treasury, executive assistants, the company secretary's office and the IT help desk. Two or three named addresses are usually enough to infer the format of every other address in the organization.
4. Job advertisements
Job advertisements describe the software a team uses, the approval processes it runs and the vendors it works with. A request to reset access to a named finance system is more convincing when the attacker knows the system's name.
5. Documents and metadata on your own sites
Annual reports, brochures, forms and presentations frequently carry author names, internal usernames, file paths and the software that produced them. We explain what that metadata contains in What files say about the people who made them.
6. Calendars and travel
Speaker lists, trade show announcements and celebratory posts tell an attacker when an executive will be traveling, busy and hard to reach for confirmation. Timing is the ingredient that turns a plausible instruction into a paid one.
How the pieces combine
No single item is dangerous on its own. The risk lies in the combination. The table shows how the ingredients we find most often map to the lures we see most often.
| Lure | Ingredients taken from public sources | Control that defeats it |
|---|---|---|
| Filing deficiency notice | Signed registry filing, registered agent or counsel name, company secretary's office | Known-channel callback to the agent before any payment or signature |
| Executive payment instruction | Officer list, travel announcement, finance team names, address format | Dual approval and out-of-band verification for new payees |
| Supplier bank detail change | Customer lists on supplier sites, case studies, procurement awards | Verification of any bank change against master data, never by reply |
| Help desk access reset | Job advertisements naming systems, staff profiles, organization chart | Identity checks that do not rely on publicly knowable facts |
What our exposure assessments find
We have run exposure assessments since 2023, first inside protective and threat monitoring programs and, from November 2026, as a standalone service. Across the 48 assessments we completed in 2026, these were the most common findings.
- 94 percent: the email address format could be inferred from public sources.
- 81 percent: at least one signed document was available from a public registry.
- 77 percent: documents on the organization's own websites carried author names or internal usernames in their metadata.
- 58 percent: at least one lookalike domain imitating the organization was already registered.
- 46 percent: an executive's travel had been announced publicly at least a week in advance.
- 31 percent: a search engine had indexed files the organization did not intend to publish, most often draft documents and old event material.
None of these findings required anything other than reading what was already public. That is the point. An attacker does not need access to your systems to plan an attack on your people.
Remove, redact or control
Every finding in an assessment ends up in one of three columns.
- Remove. Documents and metadata on your own sites, stale event pages, unnecessary staff listings and files that should never have been indexed. This is usually the largest column and the quickest to clear.
- Redact or change the practice. Some registries allow redacted signatures or service addresses. Some filings can be made electronically by an agent. Some announcements can be made after the event instead of before it.
- Control. Records that are public by law stay public. For those, the answer is a control that assumes the attacker has read them: callback procedures, dual approval, and training that uses the organization's own exposed documents as examples.
A re-check 90 days later measures what changed. Across 2026 assessments, clients closed or controlled a median of 71 percent of findings by the re-check.
Why we stay passive
An exposure assessment reads what is already public. We do not scan networks, attempt to log in, send test messages to staff or interact with anyone. That keeps the work lawful in every jurisdiction we operate in, keeps it invisible to the people it concerns and keeps it clearly separate from technical security testing, which your penetration testers are better placed to do. Where our findings point to a technical weakness, we hand them to the people responsible for testing it.
The same restraint applies to people. We record roles and what is published about them in a professional capacity. We do not profile employees' private lives, and personal details found incidentally are not retained. Assessments concerning the personal exposure of named principals and their families are handled under protective intelligence, with their consent.
Questions to ask about your own organization
- Who can see the signed documents behind our registry entries, and what do they show?
- Could an outsider name the people who approve payments and change bank details?
- What do the files on our websites say about who made them?
- Which lookalike domains already exist, and who is watching for new ones?
- Do we announce executive travel before or after it happens?
- Would our verification procedures still work if the attacker had read everything above?
The case that prompted many of these questions is told in The signature on file.