When British actor Lisa Riley applied for an ESTA to travel to the United States last year she said she found a website through a Google search, entered passport and bank details and paid for what she expected would be a routine electronic travel authorisation. When the expected confirmation did not arrive within the usual hour she emailed the contact address provided on the site and received a reply that included a link to a page showing a jumble of words and letters.
Riley’s experience reflects a pattern reported by other travellers: fake or lookalike ESTA pages that harvest personal and financial data, then use that information to mount follow-up phishing attempts. Victims say the contacts — including text messages and phone calls — can keep arriving for weeks or months after the initial incident, sometimes on a near-weekly basis.
Scammers often rely on search engines to route unsuspecting users to fraudulent websites that resemble legitimate services. Visitors who pay for an application on these sites may provide a range of sensitive information that can be reused for more tailored social-engineering attacks, including SMS and voice phishing designed to extract further money or data.
The follow-up contacts described by victims vary in form but are consistent in purpose: to exploit the personal details already harvested and to pressure users into providing additional information or payments. In some cases responses from the fraudulent sites are nonsensical or broken, leaving applicants uncertain whether their data has been processed or exposed.
Travel experts and consumer advocates emphasise vigilance when applying for official travel documents online. Travellers are advised to verify they are using the official government portal for ESTA applications, to be wary of search results that lead to unfamiliar commercial pages, and to monitor bank statements for unauthorised transactions. Anyone who suspects they have fallen victim to such a scam should consider contacting their bank about potentially compromised cards and report the incident to the appropriate consumer protection or cybercrime authorities in their country.