The consumer champion said tat fraudsters were "infiltrating" genuine customer queries made on Elon Musk’s X platform (formerly known as Twitter) and "impersonating trusted brands with ease".
Which? last summer flagged incidents involving fake easyJet customer service representatives, but said a deeper dive had uncovered fake accounts representing the likes of Jet2.com, easyJet and Tui.
It said scammers were using automated accounts – bots – to trawl customers contacting genuine airline support channels on X before responding to these queries or complaints using fake accounts.
One Which? researcher, who contacted the official Wizz Air handle (@wizzair), received two near-identical replies from fake accounts in a matter of seconds, underlining the level of automation involved.
Which? went on to find bogus X accounts impersonating British Airways, easyJet, Jet2.com, Ryanair, Tui, Virgin Atlantic and Wizz Air, and were often responding quicker than genuine accounts.
Another contributing factor, said Which?, was the propensity for these fake accounts to interrupt existing conversations between users and genuine accounts, making them even harder to spot. Which? added some fake accounts were paying for blue tick verification to make them appear more authoritative.
Other tactics include asking users to direct message them a booking reference or flight number to kick off the bogus customer service response before requesting personal or sensitive data, directing users to phishing links and sites designed to harvest personal data and bank/credit card details, or tricking customers into downloading payment apps to take receipt of false "compensation".
Verification confusion
Which? said reporting accounts to X appeared to have limited success, with most of those reported to the network still active when it published its research, despite the X press office claiming that all the accounts flagged by Which? had been suspended.
The group went on to ask the seven airlines for whom it found fake accounts for comment, including how many fake accounts they had reported so far this year and whether they’d thought about leaving X due to the prevalence of bogus accounts targeting their customers.
Of the four airlines that replied, none gave a direct answer on how many accounts they’d reported, and none would be drawn on whether they would quit X. BA, Ryanair and Virgin Atlantic did not respond.
EasyJet, in its response, highlighted its official account did bear X’s new gold verification badge for official businesses.
Tui, meanwhile, gave a similar response, stating its official @tuiuk account was marked by a blue tick, albeit while failing to note blue ticks – on X – are no longer a marker of official verification as they were prior to Elon Musk’s takeover.
Jet2 urged customers to report any suspicious activity, while Wizz Air advised customers to contact it through the contact details on its website.
British Airways (@British_Airways), easyJet (@easyJet), Jet2 (@jet2tweets) and Virgin Atlantic (@VirginAtlantic) all have gold ticks, while Tui (@tuiuk) and Wizz Air (@wizzair) have blue ticks. Ryanair’s X account is just @askryanair without badging.
