They Built a Fake Version of Your Bank. And Your Customers Almost Fell For It.
A community bank ran a giveaway built around generosity. One impersonation account used the bank’s own logo to reply to 22 real customers with a fraudulent link. Here is what I found when I clicked it — and what it means for every community financial institution running an active social media presence.
The post looked like a win. What it actually was — bank social media impersonation, executed with precision — would not become clear until later.
A community bank had launched a giveaway on Facebook with a premise as warm as anything a community institution could design. To enter, customers had to comment with the name of their favorite local charity. At the end of the promotion, one commenter would be chosen at random. They would win a prize — and the bank would make a donation to the charity they named.
Customers showed up. They tagged food banks. Youth programs. Animal shelters. Organizations they believed in. The comment section filled with the names of causes that mattered to real people in that community. The bank’s page became, for a moment, a public declaration of what their customers cared about.
It was exactly the kind of content that builds lasting trust between a community bank and the people it serves.
And someone was watching it.
How Social Media Impersonation Works Against a Bank: One Account, Twenty-Two Customers
BANK MONITOR flagged the activity the same day it began. What we found in that comment section was not random noise. It was a coordinated, deliberate attack built specifically around the engagement that giveaway had generated.
One Facebook account had been created to look exactly like the bank. The bank’s own logo was used as the profile picture. The account name was nearly identical to the bank’s real page — one extra letter, one additional symbol, the kind of difference you miss entirely when you are not looking for it.
That account had replied directly to 22 real customer comments.
Each reply was a personal response to someone who had just publicly named their favorite local charity. And each reply directed that customer to click a link to complete their giveaway entry.
Think about what that looked like from the customer’s side. They had just done something generous and public. Seconds later, their bank replied to them directly. Not a stranger. Not a suspicious account. Their bank, with the right logo, the right name, telling them their next step was a simple click away.
Of course you click that link.
So I Clicked It.
What I found on the other end was not a generic phishing page thrown together overnight. Someone had studied that bank.
Same colors. Same logo. They had pulled the image directly from the bank’s Facebook cover photo and placed it on the page. The layout mirrored what a legitimate bank giveaway rules page looks like — the kind customers have seen before, the kind that carries an inherent sense of officialness and trust.
At the bottom, fields were waiting. Name. Contact information. Whatever a customer would willingly hand over because they had every reason to believe they were exactly where their bank told them to be.
I knew what I was looking for and it still looked real.
Your customers would not have known what to look for.
This Was Not Opportunistic. This Was a Plan.
That is the detail I need every community bank leader reading this to absorb fully.
Whoever built this did not stumble onto that page. They waited for exactly the right post — one with high engagement, personal investment, and a mechanic that gave customers a reason to expect a follow-up reply. They registered a domain close enough to the bank’s real website to survive a quick glance. They pulled the branding, built the replica, created the impersonation account, and deployed it the moment real customers started filling that comment section with the names of causes they loved.
This is called typosquatting. It is a deliberate, organized form of attack that specifically targets institutions with active, trusted social media presences. The more your community engages with your page, the more valuable that trust becomes to someone who wants to exploit it.
Your compliance team reviewed the post before it went live. Your marketing team crafted the message. Neither of them could have stopped this. This threat did not come from inside your institution. It arrived from outside, wearing your name, aimed directly at your most engaged customers.
The Question You Cannot Answer Without a System
We do not know with certainty that no customers clicked that link before we found it. What we know is that BANK MONITOR identified it the same day. The account was documented and removed. The bank’s leadership was notified with a clean, timestamped record of exactly what happened and when.
But here is the question worth sitting with: if no one had been watching that comment section, how long would that account have kept replying to customers? A full day? Three days? The entire run of the giveaway promotion?
You cannot calculate the damage from something you never knew existed.
Most community banks running active social media programs today could not tell you when that account appeared. They could not tell you when the first reply was posted. They could not tell you how many customers saw it before anyone thought to check.
Not because they are careless. Because they have no system designed to catch it.
What Real-Time Monitoring Actually Looks Like
BANK MONITOR does not operate on a schedule. There is no morning check. There is no end-of-day review. It is continuous — which means that when an impersonation account begins working its way through a comment section, it is identified the same day, not discovered the following Monday when the giveaway has been running for a week.
Every account. Every comment. Every link. Captured, documented, and reported to the bank’s leadership with a complete record of what appeared, when it appeared, and how it was handled.
That documentation matters beyond the immediate threat. It is what you show your board when they ask what happened. It is what you show an examiner who wants evidence that your institution had a process and that the process worked. It is what legal counsel needs if a customer ever comes forward with a complaint.
A staff member keeping an eye on things cannot produce that record. Only a purpose-built monitoring system, running continuously, backed by human expertise, can produce that record. Learn more about how BANK MONITOR was built and the team behind it.
“The exposure most banks worry about is what they post. The exposure they should be worried about is what they cannot see — an impersonation account working its way through a comment section, replying to your most trusting customers, while everyone assumes the page is fine.”
The Institutions Most at Risk Are the Ones Doing Everything Right
Not the banks with troubled histories. Not the ones with difficult markets.
The ones running creative, community-centered programming. The ones whose customers show up and engage. The ones whose pages feel like a genuine extension of who they are.
The more visible and trusted your presence, the more valuable your page becomes to someone who wants to borrow that trust for something your customers would never agree to.
Good content creates engagement. Engagement creates opportunity — for your community, and for the people who have learned to exploit it.
Your team runs a thoughtful giveaway. Customers are commenting with their favorite local charities. Engagement is strong. It is exactly the kind of content your social media strategy is built around.
While that post is doing what you designed it to do, one account — wearing your logo, carrying your name — begins working through the comments. Twenty-two of your customers receive a personal reply directing them to a link. The page on the other end looks like yours.
When did your institution plan to catch it?
Frequently Asked Questions
What is typosquatting and how does it target community banks?
Typosquatting is the practice of registering a domain name nearly identical to a legitimate organization’s real website — typically one letter off, a hyphen added or removed, or a slight misspelling. Attackers use these domains to build convincing replica pages designed to collect personal information or financial data from visitors who believe they are interacting with the real institution. Community banks are attractive targets because their social media pages carry high levels of community trust, and that trust can be exploited to drive traffic to a fraudulent site.
What is social media impersonation and how does it work?
Social media impersonation occurs when a bad actor creates an account designed to look like a legitimate organization’s official page — using the same logo, a nearly identical name, and similar branding. In the case described in this post, one account impersonated a community bank on Facebook, then used that false identity to reply directly to real customers in a giveaway comment section, directing each of them to a fraudulent link. Because the account appeared to be the bank itself, customers had no reason to be suspicious.
Is a community bank responsible for fraudulent activity carried out by impersonation accounts on its social media posts?
While Section 230 of the Communications Decency Act generally limits platform liability for third-party content, financial institutions are held to a different standard by their regulators. FFIEC guidance requires banks to actively monitor their social media presence and respond to risks that emerge on their public-facing pages. An impersonation account targeting your customers inside your own comment section represents both a reputational risk and a potential risk management deficiency in the eyes of an examiner. The question is not only whether your bank posted it. The question is whether your bank had a process to catch it.
What does BANK MONITOR document when it identifies an impersonation attack?
When BANK MONITOR identifies an impersonation attack, every element is captured and documented in real time: the account involved, the content posted, the links included, and the timestamps for when each interaction appeared and when it was removed. The bank’s leadership receives a clean, detailed report that can be presented to a board, an examiner, or legal counsel. That documentation is often as important as the removal itself. See how the full BANK MONITOR service works.
How common are impersonation and typosquatting attacks targeting community financial institutions?
More common than most community bank leaders realize, and growing in sophistication. These attacks specifically target institutions with active, engaged social media programs because high engagement means a larger audience of trusting customers. A well-designed giveaway generating strong community participation is, from an attacker’s perspective, an opportunity. The level of planning in the case described here — a custom impersonation account, coordinated replies to real customers, and a branded replica page — reflects a deliberate, targeted operation, not a random attempt.
Read the full series from the beginning: Part One: Something Happened on Your Bank’s Social Media Page Last Night. Do You Know What It Was?
Understand Your Social Media Exposure Before the Next Attack Finds You
A free assessment with BANK MONITOR gives you a clear picture of what your current monitoring approach would catch — and what it would miss. No pressure. No obligation.
The New Social Media Risk SeriesPart One: Something Happened on Your Bank’s Social Media Page Last Night. Do You Know What It Was?
Part Two: One Comment. One Crisis. The Real Cost of Social Media Neglect.
Part Three: They Built a Fake Version of Your Bank. And Your Customers Almost Fell For It. (You are here)