The FTC rule, and both of its limbs matter. 16 CFR 461.2 makes it "a violation of this part, and an unfair or deceptive act or practice to: (a) materially and falsely pose as, directly or by implication, a government entity or officer thereof... or (b) materially misrepresent, directly or by implication, affiliation with, including endorsement or sponsorship by, a government entity or officer thereof". Both limbs end with the same qualifier, that the conduct be "in or affecting commerce as commerce is defined in the Federal Trade Commission Act", which is the hook that makes it the FTC's to enforce. Limb (b) is the one that catches the operations that never actually claim to be the agency: a website that presents itself as an official portal, a mailing that implies a government endorsement, a service that suggests it is authorized to act for an agency when it is not.
The rule's definitions section is short and worth reading alongside it. Section 461.1 defines "Government" to include "federal, state, local, and tribal governments as well as agencies and departments thereof", so a fake county sheriff's office or a fake state court is inside the rule. It defines "Officer" to include "executives, officials, employees, and agents", so impersonating a clerk counts as much as impersonating a commissioner. And it defines "Materially" as "likely to affect a person's choice of, or conduct regarding, goods or services", which is the standard the claim has to meet.
One boundary is worth stating, because the rule is often described as broader than it is. As codified, the part contains three sections, covering definitions, government, and businesses. Impersonating a private individual is not among them.
The criminal statute is narrower than the rule and older. 18 U.S.C. 912, headed "Officer or employee of the United States", reaches "whoever falsely assumes or pretends to be an officer or employee acting under the authority of the United States or any department, agency or officer thereof, and acts as such, or in such pretended character demands or obtains any money, paper, document, or thing of value", with a penalty of a fine or up to three years' imprisonment. There are two ways to violate it: pretending and then acting the part, or pretending and using the pretense to demand or obtain something of value. Note the limit: it protects the authority of the United States, so impersonating a state or local official is a matter for state law, even though the FTC rule reaches both.
Some agencies have their own regime, and the Social Security Administration's shows why that matters. Section 1140 of the Social Security Act, at 42 U.S.C. 1320b-10, prohibits giving a false impression of association with, or authorization or endorsement by, the Social Security Administration, through any communication: SSA's Office of the Inspector General lists telephone solicitations, social media, websites, email, postal mail, text messages, and television, radio and YouTube broadcasts. It separately prohibits reproducing and selling SSA publications and forms without authorization, and charging a fee to help someone obtain something SSA provides free unless a clear and prominent notice says the service is available free from SSA.
Two features of that regime are unusual enough to be worth carrying. Penalties are assessed per communication, so each piece of mail, each violative sale and, in SSA OIG's own words, "each viewing of a YouTube or other Internet video is considered a separate violation". And the disclaimer does not help: any determination of whether a communication violates section 1140 "is made without regard to any inclusion of a disclaimer of affiliation with the United States Government or any particular agency or instrumentality thereof." The small print at the bottom of a lookalike website saying "we are not affiliated with SSA" is not a defense.
The one defensive rule that actually holds, and the two that do not. It is tempting to reach for "a government agency will never call you" or "an official letter means it is genuine". Neither survives. The IRS states on its own site that it or the private collection agencies it uses "may call you to address account matters" and that "in some cases, we use automated phone messages", and it has warned about counterfeit IRS letters arriving by post. What is reliable is the demand and the rail. The FTC's formulation is that scammers "insist you can only pay these ways because it's hard to track that money, and just as hard to get it back", and its instruction is not to wire money or use gift cards, cryptocurrency or a payment app to pay someone who says they are with the government. A demand for immediate payment, a threat of arrest, and an irreversible payment method are the signals that do not go out of date when the delivery method changes.
Scale, dated and attributed. In the FBI's 2025 Internet Crime Report, Government Impersonation drew 32,424 complaints and $797,943,193 in reported losses, of which 8,628 complaints and $413,206,251 came from complainants aged 60 and over. The FBI also treats it, alongside tech support fraud, as one of the two categories of call center fraud, and reports that the two together produced more than 80,000 complaints and losses exceeding $2.9 billion in 2025.