A Check Point Exposure Management investigation uncovered a coordinated social engineering campaign in which scammers monitor public complaints, impersonate customer support accounts, and approach customers seeking help. Researchers engaged directly with the scammers and followed the attack from the first social media interaction through WhatsApp conversations and payment flows.
The findings highlight a growing challenge for external attack surface management, as exposure can develop across public channels where brands interact with their customers.
Key Takeaways:
The investigation uncovered several characteristics of the campaign:
Threat actors actively monitor public complaints. Fake support accounts respond to dissatisfied customers on verified brand posts, often mimicking the language of legitimate customer service teams.
Thousands of impersonation accounts were identified. Researchers found accounts across X, Facebook, and Instagram posing as airlines, vacation brands, customer support teams, and representatives.
Scammers shift conversations to private channels. Customers are asked for phone numbers, booking details, and other information before the conversation moves to WhatsApp.
Victims are offered refunds or compensation. Researchers documented three scam variations that gathered personal and payment information while convincing victims their compensation had been approved.
The campaign remains active and evolving. While some impersonation accounts predate 2024, most were created in 2024 or later, with hundreds of new accounts appearing daily alongside new scam techniques.
How the Scam Works:
The attack begins with a genuine customer complaint posted publicly on social media. Researchers observed threat actors replying directly to frustrated customers beneath verified airline posts. The accounts apologize for the inconvenience, offer assistance, and encourage the customer to continue the conversation privately.
Some accounts use official brand logos, cover images, and descriptions. Others use names associated with customer support, claims departments, or help desks.
Once a customer responds, scammers request information such as a phone number and booking details before moving the conversation to WhatsApp.
From Customer Support to Financial Fraud
Researchers engaged directly with several accounts and uncovered three variations of the scam.
In one case, a threat actor requested a full name, email address, booking details, complaint information, and the cost of the customer's trip. The researchers were told their claim had been approved.
The investigation later uncovered an unfinished $500 transfer associated with the information provided. Continuing the transaction required credit card information and additional personal details.
A second scam promised $1,200 in compensation before directing researchers toward an international payment application. A third used a Google Form titled "COMPENSATION/REFUND APPLICATION" to request personal and card information.
Although researchers could not confirm when the campaign began, some impersonation accounts date back to before 2024, while most were created in 2024 or later. This suggests that the activity has accelerated over the past two years. The campaign remains highly active, with hundreds of new accounts appearing daily and new scam techniques continuing to emerge. The three techniques documented in this investigation likely represent only a sample of the tactics currently in use.
How AI Can Make These Attacks Easier to Scale
Researchers did not confirm AI use in the accounts they investigated, but the campaign illustrates how generative AI could make this type of social engineering easier to scale.
These tactics rely on persuasive communication and quick responses. Generative AI can help threat actors draft customer service-style messages, tailor replies to specific complaints, communicate in multiple languages, and sustain convincing support personas across many conversations.
Public complaints already provide useful context about the customer and their issue. AI can help turn that information into personalized responses quickly, allowing scammers to target more customers across more brands. For security professionals, this increases the need for continuous visibility into fraudulent accounts, brand impersonation, and other forms of external exposure.
What Can Security Professionals Do?
Organizations can reduce the opportunity for these campaigns by monitoring how their brands are represented across social platforms and establishing clear processes for responding when impersonation appears.
The report recommends several actions for organizations:
Identify and remove impersonating accounts. Monitor social platforms for fraudulent accounts and report them quickly to reduce their opportunity to reach customers.
Educate customers and employees. Explain how official support teams communicate, what information they request, and how customers can verify legitimate accounts.
Move sensitive interactions to secure channels. Customer conversations involving booking information, phone numbers, payment information, or other sensitive data should be directed to official support channels or secure portals.
Coordinate with social media platforms. Report impersonation campaigns and recurring fraudulent activity to support faster removal and increased monitoring.
Alert payment providers. Sharing information about fraudulent accounts and transactions can help payment services identify and disrupt abuse of their platforms
Helpful Consumer tips:
Verify before you trust. Contact companies only through official websites, verified social media accounts, or known phone numbers.
Be cautious on social media. Scammers often impersonate brands or customer support accounts to trick people into sharing information.
Watch for unusual requests. Legitimate companies will not ask for passwords, one-time passcodes, gift cards, wire transfers, or cryptocurrency payments.
𝐒𝐭𝐚𝐲 𝐢𝐧𝐟𝐨𝐫𝐦𝐞𝐝 𝐰𝐢𝐭𝐡 𝐨𝐮𝐫 𝐥𝐚𝐭𝐞𝐬𝐭 𝐮𝐩𝐝𝐚𝐭𝐞𝐬 𝐛𝐲 𝐣𝐨𝐢𝐧𝐢𝐧𝐠 𝐭𝐡𝐞 WhatsApp Channel now! 👈📲
𝑭𝒐𝒍𝒍𝒐𝒘 𝑶𝒖𝒓 𝑺𝒐𝒄𝒊𝒂𝒍 𝑴𝒆𝒅𝒊𝒂 𝑷𝒂𝒈𝒆𝐬 👉 Facebook, LinkedIn, Twitter, Instagram
