The fake support account
The only adversary here you can identify with certainty before evaluating anything they say.
- What they want
- Credentials, a second factor code passed to them, or a payment moved somewhere they control. Sometimes just enough conversation to work out whether you are worth more effort.
- How they earn
- Accounts, balances, and redirected orders. Volume rather than size, because the approach costs nothing per attempt.
- What it costs them
- A username and the patience to watch public places for people describing problems.
- How you meet them
- You post a question. Somebody helpful contacts you privately within the hour. That sequence is the method, and it is almost the whole method.
- What gives them away
- The channel itself. No market runs support or announcements on a messaging app, a chat group, an email address or a forum account. Anything presenting itself that way is impersonation regardless of how established it looks.
- What stops them
- Knowing the channel does not exist, so there is no judgement to make about which contact seems legitimate.
Why the channel cannot be genuine
It is structural rather than a matter of preference. A messaging platform is a company that identifies its users by phone number or account and can be compelled to produce records. A market operating there would be creating exactly the record its whole architecture exists to avoid, for its most engaged users.
That is why this profile gets a categorical answer while every other one requires judgement. You do not need to assess the account, count its members, or check how long it has existed.
The shapes it takes
| Presents as | What it is |
|---|---|
| Support staff | Contacts you after you describe a problem publicly. The most common by a wide margin. |
| An announcement channel | Reposts genuine signed announcements accurately for months, building a record, until it posts one that is theirs. |
| A mirror bot | Automation posting current addresses, correctly, until it does not. Automation gets trusted more than people do. |
| A helpful member | Answers ordinary questions correctly in public, then offers to sort you out privately. The group builds the trust and the private message spends it. |
| A vendor | Impersonating a seller rather than the platform, aimed at buyers with an order in flight. |
If you are already talking to one
Stop, and take nothing from the conversation. Not an address, not an instruction, not a reassurance. Being in such a group is not dangerous, and acting on it is. If you have already given something up, the ordered response is on what to do after entering credentials, and the order matters because the account is what they can act through right now.
One thing worth noticing afterwards: describing your own activity in specific terms in a public place is what put you in front of them. The membership of such a group is itself a list of people interested in this subject, and posting details is how a general audience becomes a targeted one.