What is angler phishing? Fake customer support scams explained

Angler phishing is a social-media scam where an attacker pretends to be a brand’s customer support team.

The attacker watches public posts from people asking a company for help. Then a fake support account replies, often faster than the real brand. The reply may ask the customer to move into direct messages, click a “support” link, verify account details, share a one-time code, pay a fee, or provide personal information.

The scam works because the victim is already looking for help. A fake account does not need to invent the problem. The customer’s public complaint creates the pretext.

How angler phishing works

A typical angler phishing attack follows this pattern:

A customer posts publicly: “I cannot access my account,” “My package never arrived,” or “Can someone from support help?”
The attacker finds the post by monitoring brand names, hashtags, or support keywords.
A fake account replies with a handle, logo, and profile that look close to the real brand.
The fake agent moves the conversation to direct messages or an external link.
The victim is asked for credentials, verification codes, payment details, identity documents, or remote-access steps.
The attacker uses that information for account takeover, fraud, identity theft, or malware delivery.

This is phishing, but the channel and timing are different. Instead of sending a cold email, the attacker waits for someone to publicly signal a support need.

Why social media makes the attack easier

Social media gives attackers three advantages.

First, complaints are public. A scammer can see who is frustrated, what brand is involved, and what problem needs solving.

Second, speed feels like service. When a fake account replies quickly, the victim may treat that speed as legitimacy.

Third, profile copying is cheap. An attacker can reuse a brand logo, copy recent posts, and choose a handle that looks close to the official one.

The risk is not theoretical. The FTC reported that in 2025, nearly 30% of people who reported losing money to a scam said it started on social media, with reported losses of $2.1 billion. The FTC also notes that scammers can create fake profiles, hack accounts, and use what people post to target them.

Microsoft’s phishing guidance also warns that phishing is not limited to email. Attackers use emails, texts, direct messages on social media, and other message channels to get people to reveal personal information.

Angler phishing examples

Fake bank support

A customer posts that a bank transfer is delayed. A fake account with the bank’s logo replies:

“We can help. Please DM your username and the six-digit code we just sent so we can verify your account.”

The code is not for support. It is a login or password-reset code. If the customer shares it, the attacker can take over the account.

Fake delivery support

A customer complains that a package never arrived. A fake support profile replies with a link to “reschedule delivery.”

The page asks for a small redelivery fee and card details. The real goal is payment-card theft.

Fake SaaS support

An employee tags a software company because SSO is failing. A fake support account sends a link to a “status portal” or “temporary login page.”

The page captures work credentials. If the employee uses the same credentials across systems, the impact can move beyond that single SaaS account.

Fake telecom support

A customer asks a mobile provider why service stopped working. A fake account offers to “reactivate the SIM” and asks for personal data, account PINs, or one-time codes.

That can support SIM-swap fraud or account takeover.

How to verify a support account before replying

Before you answer a support account that contacts you first, slow down and verify it.

Check these signals:

The exact handle. Look for extra letters, swapped characters, underscores, hyphens, or regional suffixes.
Verification status, where the platform provides meaningful account verification.
Links from the company’s official website to its real social profiles.
Whether the real brand account lists that support handle.
Follower count and account age, but do not rely on those alone.
Recent posts and replies. Fake accounts often have shallow history or copied content.
The requested action. Real support should not need your full password, MFA code, seed phrase, or full card number.

When in doubt, leave the thread. Go to the company’s website by typing the address yourself, using a bookmark, or opening the official mobile app. Start support from there.

What customers should never share in social support

Do not share:

Passwords.
One-time passcodes.
Backup codes.
Full payment-card numbers.
Full Social Security or national ID numbers.
Crypto wallet seed phrases.
Remote-access codes.
Photos of identity documents in a social-media DM unless you initiated the request through the official support flow and can verify the channel.

Some legitimate support teams may ask for limited account details, order numbers, or the last few characters of an identifier. They should not ask you to bypass normal security controls.

What brands can do to reduce angler phishing

Brands cannot eliminate social-media impersonation completely, but they can reduce the window of trust that attackers exploit.

Useful controls:

List official support accounts on your website and in your main social profiles.
Respond quickly to public complaints and move users into a verified support flow.
Use consistent handles across platforms where possible.
Monitor for lookalike handles, copied profile images, and fake support replies.
Report impersonation accounts quickly through platform abuse processes.
Avoid asking customers for sensitive data in public replies or informal direct messages.
Train support teams to tell customers exactly what they will never ask for.
Use email authentication for support emails and customer notifications.

For brands, DMARC is one layer in a broader impersonation program. It helps stop direct spoofing of your email domain, especially for customer notifications and support messages. It does not stop a fake social-media profile, a lookalike domain, or a compromised customer inbox.

If your brand sends support or account emails from a custom domain, check your setup with the DMARCTrust domain checker. For ongoing visibility, see email authentication monitoring.

How DMARC relates to angler phishing

Angler phishing usually starts on social media, so DMARC is not the primary control.

DMARC helps when attackers send email that directly spoofs your domain. For example, if a scammer sends a fake support email claiming to come from [email protected], DMARC enforcement can help receiving mail systems reject that message when it fails authentication and alignment.

DMARC does not stop:

Fake support profiles on X, Facebook, Instagram, TikTok, LinkedIn, or forums.
Lookalike domains that attackers register separately.
Links to fake login pages.
Direct messages from compromised social accounts.
Text-message scams.
Pharming or DNS redirection.
Baiting attacks that rely on a tempting offer or physical media.

So use DMARC precisely: it protects your domain from direct email spoofing. It is not a complete anti-phishing program by itself.

Baiting attack vs angler phishing

A baiting attack uses an enticing item or offer to make the victim act.

The bait might be physical, such as a USB drive left in a parking lot. It might be digital, such as a free download, fake giveaway, cracked software, or “exclusive” file that leads to malware or credential theft.

U.S. Army Cyber Command’s cybersecurity basics guidance describes baiting as a social-engineering tactic that tempts victims with an item or offer, including portable media or online offers that lead to malicious sites or malware.

The difference:

Angler phishing starts from a support need. The victim is asking for help.
A baiting attack starts from temptation. The victim wants the offered item, discount, file, or reward.

They can overlap. A fake support account might offer a refund link that is really a bait. But the cleaner distinction is the lure: support problem versus tempting offer.

Phishing vs pharming

Phishing vs pharming is about how the victim reaches the fake destination.

In phishing, the attacker usually sends a deceptive message that asks the victim to click a link, open an attachment, reply with information, or visit a fake page.

In pharming, the attacker manipulates DNS or local system behavior so the victim is redirected to a fake site even when they may have typed the correct address. Microsoft’s pharming explanation describes pharming as an attack that works at the DNS level by redirecting a legitimate web address to a fake site.

The practical difference:

Phishing relies heavily on message deception.
Pharming relies heavily on redirection.
Angler phishing relies on fake support interaction in a public social-media context.

All three can end at the same place: a fake page that steals credentials or payment details.

Pharming vs phishing in plain English

If you click a fake “support” link from a social-media DM, that is phishing behavior. If your DNS settings or router are compromised and your browser goes to a fake site after you type the real address, that is pharming behavior.

Pharming is harder for ordinary users to detect because the suspicious step may not be an obvious message. Good defenses include patched devices, trusted DNS resolvers, router security, anti-malware tools, HTTPS checks, and caution when a familiar site suddenly looks wrong or asks for unusual information.

FAQ

What is angler phishing?

Angler phishing is a phishing scam where attackers impersonate customer support accounts on social media and target people who publicly ask brands for help.

Why is it called angler phishing?

The name refers to the lure. The attacker uses a support reply, fake profile, or helpful-looking link to pull the victim into a private conversation or fake page.

Is angler phishing only on X or Twitter?

No. It can happen on any public platform where customers ask brands for help, including Facebook, Instagram, TikTok, LinkedIn, Reddit, forums, review sites, and messaging platforms.

What is a baiting attack?

A baiting attack is social engineering that uses an enticing item or offer, such as a USB drive, free download, fake giveaway, or discount, to get the victim to reveal information, install malware, or visit a malicious site.

What is the difference between phishing and pharming?

Phishing usually tricks you with a message. Pharming redirects you to a fake site through DNS, router, malware, or local system manipulation. Both can be used to steal credentials or payment details.

Does DMARC stop angler phishing?

Not directly. DMARC helps stop direct spoofing of your email domain. Angler phishing usually uses fake social-media accounts, fake links, or lookalike domains, so brands also need social monitoring, support-channel verification, takedowns, MFA, and customer education.