Angler phishing
Angler phishing uses fake customer-support accounts on social media to approach people seeking help and steer them toward credential theft or another fraudulent request.
The reply looks like the help you asked for
Proofpoint documented impostor accounts watching for public customer-support requests and replying with links to fake sign-in pages. The attacker joins a conversation the customer started, without needing control of the brand’s genuine account.
This is a specific form of impersonation, not a label for every social-media scam. The support context matters because the recipient is already expecting a response and may be willing to share details to resolve a problem.
Verify the support route before continuing
A copied logo or a reply beneath your public post does not establish who runs the account. Use the company’s known app or website to find its support options rather than following the new account’s sign-in link. The FTC recommends contacting a business through a number or website you already know is real.
Moving to a private message, phone call, or remote session does not resolve the identity question. The channel-handoff article explains how an unverified conversation can gain credibility simply by changing channels.
When reporting an impostor account, include its handle and the request it made. Keep private account details out of public posts.