Angler PhishingWaiting for Your Next Fraud Victim

Angler Phishing: Conning Your Customers at Your Expense

Here’s a very simple illustration: Bethany is a second-grader, crushing on her classmate Tony. She writes your classic “Do you love me? Check yes or no” note and gives it to Tony’s best friend Josh to pass along. 

Josh doesn’t give the message back to Tony, though. Instead, he secretly checks “no” and returns the note to Bethany. He tells her that while Tony doesn’t like her, he does. The next thing you know, the two of them are holding hands at the lunch table, and neither Tony nor Bethany know what really happened.

Why am I talking about this? Well, I bring up this story because, grade-school soap operas aside, this is the basic idea behind angler phishing.

Customers’ social media comments are intercepted by fraudsters before they get to you. If the customer takes the bait, the crook can install malware, commit ID theft, or carry out other fraud while acting like it was you all along. And, neither you nor the client will know what’s going on until it’s too late.

In this post, we take a closer look at angler phishing, explaining how it happens, why it works, and how to protect your customers and your business.

What Is Angler Phishing?

Angler Phishing

[noun]/aNGɡ • lər • fiSH • iNG/

Angler phishing is a social engineering attack where scammers impersonate a company’s customer support on social media and intercept customers.

Angler phishing gets its name from angler fish, a sneaky little bottom-feeder you’d typically find in the deep ocean. An angler fish has a tiny glowing lure in front of its mouth. That lure attracts smaller fish which get gobbled if they swim too close. It’s essentially a bait-and-switch (if you’ll pardon the pun).

Angler phishers operate in a similar manner. They create fake customer service accounts on social media to lure in consumers, who mistake them for your company’s actual support team. In this case, “swimming too close” could mean the customer clicks a malicious link or shares personal information. Once the phishing victim is hooked, the scammer can exploit the trust users have in your brand.

In both cases, the danger hides behind the appearance of help. Savvy fraudsters can mimic your site so convincingly that unwary customers believe they’re talking to you. Any comments or complaints are met with positive reassurance by the scammer. The happier the customer is, the more likely they will continue engaging, and the more information the scammer can suck up. 

How Does Angler Phishing Work?

Almost all angler phishing attempts are based on two common elements: customer frustration and social media. There have always been unsatisfied customers, but social media has helped foster the modern expectation of immediacy: we want our frustrations answered right now.

That’s not realistic, of course. Even the most responsive companies can’t answer every complaint as soon as it comes in; most take at least a couple of hours to address social media entries. That gap is where the angler phishers live, offering immediate assistance by impersonating your service team. The typical setup works like this:

In most cases, users don’t stop to think they could be dealing with a scammer. It could be days before the scam is uncovered, but by then, it’s too late.

How is Angler Phishing Different From Other Phishing Scams?

There were nearly 200,000 phishing complaints reported to the FBI in 2024. So what differentiates angler phishing from other similar scams? To understand that, it helps to compare phishing methods side-by-side:

Phishing Type	Channel	Target	Method
Angler Phishing	Social Media	Customers with complaints	Intercept posts, point users to phony “support” links
Email Phishing	Email	Anyone	Send emails with malicious links, en masse.
Spear Phishing	Email	High-level executives	Send tailored emails to pre-selected targets
Whaling	Email/Text	Specific executives	Exploit a “relationship” with a single target
Smishing	SMS/Text	Mobile users	Send malicious text messages
Vishing	Phone / voice calls	General public	Make calls while disguised as an authority

Angler phishing is unique in that it doesn’t depend on the victim making a dumb move. The consumer is generally not on their guard, because they initiated the communication. From their perspective, it’s a perfectly normal and legitimate transaction, working as it should. And, the fact that they’re already engaging with your brand makes them even more likely to overlook any discrepancies or odd requests. 

How Much of a Threat is Angler Phishing?

Here’s another unfortunate fact: if your customer falls victim to an angler phishing attack, they’re probably going to blame you.

It’s human nature. This is especially true if the scam results in account takeovers, customer-data compromise, or financial fraud. That can severely undermine their trust in your real support channels. 

Comprehensive statistics that specifically isolate angler phishing (versus general phishing) are sparse. But, I can tell you that social media platforms are among scammers' prime targets. And, in Q4 of 2024, nearly 23% of phishing attacks worldwide targeted social media platforms.

We can extrapolate out a little from there. When you consider that globally, an estimated 3.4 billion phishing emails are sent every single day, you can begin to appreciate the extent of the problem.

A Real-World Example: The PayPal Angler-Phishing Attack  

One of the worst angler-phishing attacks ever documented hit PayPal back in 2016.

The attack started when a group of fraudsters created a number of fake Twitter accounts. The accounts used spoofed names similar to official PayPal support accounts, along with PayPal’s actual logo and design styles to make things more convincing.

Once everything was in place, they watched and waited. When real users publicly tweeted issues with their PayPal account, the bogus tweeters would reply immediately with a link to a so-called “login verification” page.

Users, happy with the fast response, clicked the link and were taken to a page that mimicked PayPal’s actual login page. At that point, entering their user name and password probably didn’t seem suspicious at all. 

Entering those credentials, though, gave attackers full access to the user’s PayPal accounts. From there, they could easily transfer funds or make unauthorized purchases. Plus, they’d have access to any stored payment methods, potentially handing the crooks even more resources. 

While PayPal didn’t release official figures, it’s estimated that thousands of users were impacted, and millions of dollars were lost. And, that’s just the claims that were reported.

This is basically a textbook case of how much damage an angled phishing attack can do. It also demonstrates the importance of security monitoring for any organization that leverages social media for customer support.  

The Impact of a Successful Angler Phishing Attack

As we mentioned earlier, victims of this type of online fraud will likely blame you. Even if you didn’t do anything, they’ll reason, you still should’ve stopped it somehow.

That means your reputation will take a hit, as will buyers’ trust in your brand. It could result in lost customers; not just the victim, but others that the victim may talk to. You can expect negative online reviews, too. And that’s just the beginning:

Of course, everything outlined above are just the immediate costs. There are losses that can’t be calculated yet. The full impact of your losses won’t be known for years.

Practical Advice: How Merchants Can Protect Themselves and Their Customers

It’s unpleasant to think about, but the bigger your social media presence, the better you look to angler-phishing perpetrators. The more communications you have passing through social platforms, the less likely you’ll be able to respond to all of them before a crook and intercept them. All of which is to say: you can’t afford to slack off here.

You need to think seriously about creating and implementing a prevention strategy that can address angler phishing at its source.

This should be obvious: do double-checks to make sure all your official accounts are verified, clearly branded, and publicly listed on your website. Then, do searches to see if you can find phony sites (search all platforms as well as the net in general). 

You can’t stop there. Regular monitoring of all social media accounts is required, either manually or using automated monitoring tools. One idea is to have family or employees post “complaints” to make sure they’re getting through to you.

Augmenting your customer service by using social media is actually a pretty good idea, as long as you maintain control. Encourage customers to reach out for support only through official channels; not via random DMs, replies to comments, or even outside reviews. Also, be quite clear that any response from you will be from your official account or website, and that support staff will never ask a customer to log in or insist they provide credit card numbers, passwords or other personal data.

Angler phishing isn’t one of the more popular scams, so the red flags might not be as obvious to everyone. As with most fraud threats, it’s important to provide internal training that informs customer service teams how to detect warning signs. Customer education is a must; use FAQs and other messaging to explain the dangers of responding through unofficial DMs and or mindlessly clicking links without checking them out.

What do you do if — or when — you come across a fake account? Everyone on your team should know before the event ever happens. You need to take the time now to create and implement a clearly defined response plan. Ideally, this would include each step in order: report takedown, notify customers, review any other suspicious activity, reset credentials if needed. Your plan should also include keeping logs of social media communications so you’ll have something to reference when an attack occurs.

Fraud Never Stops 

For merchants, most fraud prevention resources rightly focus on how to protect your customers, or avoid becoming a victim yourself. Not as much emphasis is placed on protecting your brand from becoming a tool in the hands of fraudsters. But, it’s still an important area that you need to pay attention to. 

Angler phishing is a comparatively easy scam to operate, but it can cost you millions. Strict monitoring of social media accounts is the best way to protect your bottom line.

Chargebacks911 is a great resource for other types of online fraud too. Contact us to learn more.

Next Chapter

Phishing: Statistics & Financial Impact

Read More