A customer complains about their airline. Shortly afterwards, someone claiming to be customer service offers help. What appears to be a quick solution can be a targeted fraud attempt. Security researchers at Check Point have investigated a scheme in which criminals use public customer complaints to obtain personal data and credit card information.
When a complaint receives the wrong response
Delayed flights, lost luggage and outstanding refunds are common reasons for complaints about airlines. Some travellers contact the provider directly; others express their frustration on social media.
Fraudsters use these public posts as their starting point.
According to IT security company Check Point, criminals monitor complaints on platforms such as Facebook, Instagram and X. They then respond using fake support profiles resembling the airlines' official accounts.
The original post already tells the fraudsters about the customer's problem, allowing them to respond specifically. They often offer to resolve the issue quickly or arrange a refund.
The conversation then moves to private communication channels such as WhatsApp.
From a service request to data theft
The investigation describes several variations of this scheme. In one documented case, a customer was promised compensation of US$1,200. In other cases, links led to fake forms requesting personal information and credit card details.
The perpetrators exploit a particular aspect of the situation: the customer really does have an unresolved problem and expects a response from the company.
Unlike conventional phishing messages, the initial contact therefore begins with a specific, publicly documented customer issue.
According to Check Point, thousands of fake support accounts were identified, with hundreds of new profiles reportedly appearing every day.
Why complaints are particularly attractive
Public complaints often contain a surprising amount of information. They can reveal which company is involved, which service is being disputed and what solution the customer hopes to obtain.
This information allows fraudsters to tailor messages to the individual case.
Customer expectations add to the risk. Someone already waiting for a refund, or who has repeatedly tried to make contact without success, may pay particular attention to a concrete offer of help.
The supposed support profile does not even need to be especially sophisticated. A suitable profile picture, a similar account name and a response at the right time can create a credible impression.
A challenge for customer communication
The case extends beyond airlines. Similar situations are conceivable wherever customers report problems publicly and companies offer support through social networks.
Two different communication environments meet: publicly visible initial contact and the internal handling of a customer case.
While other users can see a public response, subsequent communication often takes place through private messages, email or other service channels.
For companies, this creates an additional challenge in assigning customer issues and making official communication channels recognisable.
Handovers between service channels also matter. A case may begin on social media, then be recorded by customer service and ultimately handled by a specialist department.
A centrally managed service process allows these processing steps to be assigned to a case and documented. Whether contact really originates from the company must, however, be independently verifiable.
A genuine service case becomes the basis for fraud
The scheme documented by Check Point illustrates a particular form of social engineering. Rather than sending messages at random, the perpetrators respond to genuine complaints and use the information already available to deceive customers.
The case also highlights the growing complexity of customer communication across channels. Public complaints, personal contact and internal case handling create different touchpoints that need to remain understandable to both the customer and the company.