Scammers Pose as Airline Support on Social Media to Steal Payment Data, Check Point Warns
Check Point says scammers are impersonating airline customer support on social media, intercepting complaints and moving passengers into private chats or fake forms to steal payment data.
The fraud targets people who have had poor experiences flying and who often vent on X, Facebook, Instagram or other platforms. They tag the airline and demand help, or at least an explanation. Check Point said the airline’s social media department is not the only group watching those complaints; hackers monitor them too and prepare to join the conversation.
Every day, hundreds of new social media accounts are created, Check Point found. Some are built to spoof the airlines themselves, while others are designed to look like accounts used by airline customer support or a similar department. When a customer leaves a post or comment, the criminals publicly apologize for the inconvenience and offer assistance in a different, private channel. That channel may be the platform’s direct messages, WhatsApp or another platform entirely.
The outcome varies. In some cases, the criminals try to persuade victims to share personal and payment information and later attempt a wire transfer. In others, they prepare a fake form for victims to fill out, potentially creating a database for later use. Check Point did not say how many passengers have been affected or which airlines have been targeted.
Check Point said it does not know exactly when the campaign started, but it found some impersonation accounts dating back to before 2024. Most were created in 2024 or later. “This suggests that the activity has accelerated over the past two years. The campaign remains highly active, with hundreds of new accounts appearing daily and new scam techniques continuing to emerge,” the researchers said.
The tactic is not new. TechRadar reported that fake customer support scams were rampant on X in 2021 during the crypto ICO craze. At that time, criminals took advantage of people who had lost access to their wallets or had made transactions to nonexistent wallet addresses, using similar methods to insert themselves into support conversations.
Check Point’s research describes a fraud that relies on public frustration and the speed of social media responses. The fake accounts are created in large numbers, and the criminals adapt their approach by moving targets away from public view. The campaign remains active, with new accounts and techniques appearing daily, according to the researchers.