Last year, British actress Lisa Riley sought to travel to the United States and applied for an Electronic System for Travel Authorization (Esta) online to avoid the need for a visa. After discovering a website through a Google search, she input her passport, banking, and personal information, then awaited confirmation, which is typically received within an hour.
When the expected confirmation did not arrive, she reached out via email to the address associated with her payment. The response she received was unexpected, featuring a link to a site filled with random characters and words.
It was at this moment that Riley realized she had fallen victim to a scam. Unfortunately, this experience marked the beginning of a series of ongoing issues. She has since been inundated with scam text messages and phone calls, receiving multiple communications each week.
Riley was targeted by fraudsters who create websites that closely resemble the official site operated by U.S. Customs and Border Protection (CBP). These criminals deceive unsuspecting users, collect fees, and exploit victims’ personal information for future scams.
Although Riley lost only £16—the fee for the Esta—she reports a significant surge in scam communications over the 17 months following the incident.
“I receive calls once a week, sometimes even twice a week,” she states. “The texts come even more frequently.” Often, the callers claim to be from her bank and inquire about a money transfer.
According to research conducted by Nationwide Building Society, around 15% of individuals have inadvertently shared personal information with individuals posing as legitimate entities, leaving them vulnerable to further fraudulent activities.
Annya Burskys, head of fraud operations at Nationwide, noted that “criminals often retarget individuals after an initial scam. They exploit the personal information they acquire, either selling it to other scammers or using it to make follow-up impersonation calls, texts, and emails seem more credible.”
The fraudulent Esta website that deceived Riley closely mimicked the official one, appearing prominently in search engine results. “The webpage was virtually identical, providing no indication of potential danger until I realized what had happened,” she recalls.
Criminals are increasingly utilizing artificial intelligence to replicate authentic government websites and often incorporate keywords like “Esta” in their domain names to enhance their perceived legitimacy.
A spokesperson for U.S. CBP highlighted that some fraudulent sites may pressure applicants for immediate action, a common strategy to prompt hasty decisions. They emphasized the importance of using only the official Esta website, which features a .gov domain, or the authorized mobile app.
“Applicants should safeguard their Esta confirmation numbers and payment information, keep records of their applications, and monitor their financial statements for unauthorized charges,” the spokesperson advised.
“Any suspected fraud should be documented and reported promptly to the relevant financial institutions and local authorities.” In the UK, this involves notifying the bank and reporting the fraud.
Burskys cautions that those who have inadvertently shared personal information are at risk of future scams and should be vigilant for unexpected communications. “Do not feel rushed to respond. A legitimate call or message from your bank will never request that you transfer money, share security codes, or dictate what to say to your bank or loved ones,” she explains.
“Take time to confirm the identity of the person you are communicating with and reach out to your bank directly using trusted contact details from your bank card or by visiting the official website if you have any doubts.”
