Need to know
- Australian airlines and other companies are being impersonated by multiple accounts on popular social media platform X
- The profiles are responding to users trying to get customer support
- Consumers are being lured onto private messaging services, where they can be sent dangerous links or have their information stolen
If you're someone who likes to vent about frustrating customer service or even just pose queries to businesses on X (formerly known as Twitter), watch out.
A scam that sees impostors posing as seemingly helpful company representatives in order to steal money or sensitive personal information is targeting consumers on the platform and has big brands and even X itself concerned.
A platform people turn to for help
Australians use X to contact businesses.
Despite suffering something of a fall from grace in recent years, X remains one of the most popular social media sites in Australia.
It's also a forum where big companies and government agencies continue to offer assistance to Australians on a daily basis.
Prolific user Jon Dee, who is also a former NSW Australian of the Year, has been on the platform for over 15 years and says tagging a company's profile in a post used to be "the best way" to get customer support.
However, when he attempted to reach out to Qantas last year to enquire about missing luggage, the response he received was quick, but not as helpful as it first seemed.
"It wasn't Qantas itself that got back to me first. It looked like it was, but on looking at it closer, I realised it was a scam account. It was asking for information like name and phone number details," says Dee.
Helpful replies phishing for sensitive information
Jon had found himself the target of a scam that has consumer organisations, big businesses and even X itself concerned.
A search on X reveals various accounts impersonating major businesses, but airlines seem to be a particular target.
Trawling through the platform, we found multiple accounts impersonating major Australian carriers, namely Qantas, Virgin Australia and Rex.
These profiles often had names, photos, handles (the words or numbers following the @ symbol) and descriptions that closely resembled those of the company's official X account.
These profiles often had names, photos, handles and descriptions that closely resembled those of the company's official X account
They were also active and replying to users who were sending posts mentioning the airlines and looking for help with issues such as compensation for delayed flights or missing luggage.
In the seemingly supportive responses, these accounts asked aggrieved travellers to contact them via X's direct message function or to provide a WhatsApp phone number or email address.
To add to the confusion, these replies were similar to those that legitimate airline accounts will often post in response to unhappy customers.
Accounts impersonating major Australian arlines are targeting unhappy customers on X. Image: X
Following a scammer's requests to share contact details or message them directly can result in being sent links to phishing websites, where you're asked to fill in bank account, bank card or other sensitive information.
In some instances of this scam seen overseas, scammers may claim that providing these sensitive details will deliver you compensation for interrupted travel.
Either way, the information they're asking for can be used to steal money or impersonate you and gain access to your online accounts.
What about other social media platforms?
Pages and profiles pretending to be major businesses or government agencies have been an issue on other popular social media platforms too.
For example, the Australian Tax Office (ATO) has urged people to steer clear of fake ATO accounts on Instagram, while Qantas says it works with Facebook to shut down profiles impersonating it on the platform.
However, our search for fake airline profiles only turned up results on X and not any other popular platforms.
This scam is also common on X overseas.
In a separate matter, Qantas is currently paying compensation to consumers after it admitted to selling tickets to flights it had cancelled. Scammers have been calling people, falsely claiming to help them get payments.
The ACCC says to hang up on anyone offering to help you with a Qantas payment or refund.
AI-powered bots key to global scam effectiveness
Major carriers such as Emirates are warning customers to beware of scam accounts. Image: X
Last month, CHOICE's UK sister organisation, Which?, sounded the alarm that every major airline operating in the country had accounts impersonating it on X.
Just as we've witnessed in Australia, these accounts interact with unhappy customers, and even sometimes hijack the threads of their conversations with the airline's legitimate representatives.
Major international carrier Emirates has warned its customers to beware of fake accounts and it appears X itself is not immune – the company recently noted it was observing a "new trend" of accounts impersonating its own support page.
Many of these accounts are believed to be bots – profiles powered by a piece of computer code which tells them to respond to certain words, such as the name of a company, when people publish a post mentioning them.
This automated process means that, as in Jon's case, a fake account can sometimes respond more quickly to an X user's query than an authentic account, which may be human-operated.
But it appears not every post about an airline will trigger a scam swarm – CHOICE didn't receive any suspicious responses when we sent posts tagging airlines, even though scam accounts were responding to others at the same time.
X has found itself being impersonated by suspicious accounts. Image: X
In any case, associate professor at Melbourne University's school of computing and information systems Toby Murray says generative AI programs such as ChatGPT have made the bot-building process easier.
"[AI] could help me write the code for my bot and then ... my bot can use [it] to help it automatically write its reply messages and make them look less suspicious," he explains.
Murray had his own run-in with a fake customer service account impersonating the CEO of Australia Post in February, after he wrote a post tagging the company.
He says bots are likely targeting companies such as postal services and airlines that regularly respond to complaints and queries on X and encourage stakeholders to message them on the platform.
Bots are likely targeting companies such as postal services and airlines that regularly respond to complaints and queries on X
"It's easier to impersonate someone in that sense, because the organisation in question has a history of engaging that way," he says.
The account that responded to Murray is no longer active and CHOICE didn't find any other accounts pretending to be Australia Post when we searched X.
Generative AI progams like ChatGPT make it easier to create the code powering bot accounts.
For our part, CHOICE is pushing for new laws to make AI companies more open about, and responsible for, the content their platforms create.
"We need robust regulations for AI, including strong transparency and accountability measures for 'foundation models','' says CHOICE consumer data advocate Kate Bower. "These are the large language models underpinning generative platforms like ChatGPT."
Qantas says it reports fake accounts to the relevant social media organisations and works to have them taken down.
Virgin Australia encourages social media users to report suspicious accounts to it and the platform where they appear.
Qantas doesn't plan to stop offering customer support via X, and Virgin Australia hasn't indicated if it plans to change how it engages on the platform.
Rex didn't respond to a request for comment.
X failing to protect users
The current tussle with automated scam accounts comes despite X's owner Elon Musk promising to "defeat spam bots or die trying", just prior to taking over the platform.
Computer experts say Musk hasn't delivered on his promise and the bot problem has become worse due to changes to X's verification system.
Until April last year, it was common to see a blue tick next to the name of a prominent account, such as that of a major company. This was meant to guarantee users that an account was who they said they were.
Users wanting a verification tick now have to pay ... and not all official business accounts, including major Australian airlines, are currently verified
"When you were talking to a specific company, because they were verified, you knew you were dealing with the actual proper company," Jon Dee recalls.
However, users wanting a verification tick now have to pay (as well as meet certain requirements designed to weed out impostor profiles) and not all official business accounts, including major Australian airlines, are currently verified.
Associate professor and sociotechnologist Ritesh Chugh from Central Queensland University says the upheaval has confused X users and made it harder to tell fake accounts from legitimate ones.
Changes to X's verification make it harder to spot fakes.
"I don't think that was a good move," he says of the changes to verification. "Elon Musk came in promising to get rid of bots from Twitter, but I'm noticing people leaving X because of this problem."
Both CHOICE and experts like Chugh believe digital platforms should be legally required to do more to protect users from scams.
"Companies like X have some of the best tech resources in the world, and it's time they put them to use," says CHOICE senior campaigns and policy adviser Alex Söderlund.
Söderlund says a federal government plan to set rules for businesses to protect their customers from scams should also force tech firms like X to do more to help users.
"It's really important these codes result in mandatory minimum standards with enforceable obligations. Big tech companies won't do more without the government making them."
X didn't respond to a request for comment.
How to spot a fake customer support account on social media
Has a business responded to your request for customer support and you want to know if they're the real deal? Use these tips to tell if the account is trustworthy:
- Check how many followers it has: scam accounts have very few or no followers. Legitimate firms that have lots of customers will have thousands.
- Look at when it was created: Impostor accounts get shut down often, so any that are active are likely to be months old at most. A authentic business profile will likely have joined the platform many years ago.
Have you been affected by a scam or seen one you think people should know about? Contact the author.
Stock images: Getty, unless otherwise stated.
