Financial services are more digital than ever, and so is the way customers interact with them. People can discover a new financial service, create an account, make payments, manage their money and get support without ever stepping into a physical location.
That digital customer base is huge. According to Statista, more than three billion people globally were estimated to use digital payments in 2025. Fintech itself also covers a wide range of services, including digital banking, payments, wealthtech and cryptocurrency.
But as more of the customer experience happens online, there are also more opportunities for scammers to impersonate the businesses customers think they’re dealing with.
They don’t necessarily need access to the real fintech’s systems. A fake ad, website, app, social media account or support channel can be enough to create what looks like a real interaction with the brand.
In some cases, it goes much further than one fake website or account. Australia’s Joint Policing Cybercrime Coordination Centre (JPC3) has warned that criminal networks are using AI to build entire fake investment ecosystems, including investment platforms, reviews, performance data, landing pages, advertisements and media coverage.
When all of these elements work together, a customer can be taken through an experience that looks surprisingly similar to dealing with a legitimate financial service. And that means the customer journey itself can become part of the attack surface.
When the scam becomes a customer journey
A fake ad or website might only be one part of the interaction. In some scams, victims are taken through multiple stages that can make the service they are dealing with appear much more legitimate.
ASIC has documented an example involving suspected investment scammers advertising share and stock trading tips on social media. After clicking an ad and registering their interest, consumers were added to a WhatsApp investment group where they were offered crypto investments with promises of high returns.
They were then encouraged to sign up and invest through a fake trading platform. As they invested, the value shown on the platform appeared to increase, giving the impression that their investment was performing well.
The scam continued when they tried to withdraw their money. Consumers were asked to pay additional withdrawal fees before the scammers eventually cut contact without returning the money.
So, what began as a social media ad became a much longer interaction involving a messaging group, investment advice, a trading platform, apparent returns and a withdrawal process. Each stage helped support the next and made the overall experience appear more convincing.
Where can impersonation appear in the fintech customer journey?
The ASIC example focuses on investment scams, but the same idea can apply more broadly across fintech. There are several points in a normal digital customer journey where someone may expect to interact with a financial brand, and those interactions can also be imitated.
Not every scam will follow this entire journey. Some may only target one stage, while others can move across several different channels and interactions. The important point is that the opportunity for impersonation doesn’t only exist at login or payment. It can appear anywhere a customer expects to interact with the brand.
And in many cases, these threats can exist completely outside the fintech’s own website, app or network. That makes the external customer experience an important part of the wider attack surface.
The threat can extend beyond the fintech itself
A fintech doesn’t necessarily need to be compromised for its brand or customers to be targeted. Scammers can recreate or misuse parts of the customer experience elsewhere online, using the familiarity of a financial brand to make an interaction appear legitimate.
Afterpay-related scams are one example of how this can happen. The brand can be used across different parts of a fraudulent interaction, depending on what the scammer is trying to achieve.
payment message
verification page
theft
A customer may receive what appears to be an Afterpay payment notification or account alert, only to be directed to a fraudulent page designed to capture their login or personal information.
online store
at checkout
more legitimate
In another scenario, a fraudulent online store may display Afterpay branding or claim that Afterpay is accepted as a payment option. The presence of a familiar financial brand can make an unfamiliar merchant appear more trustworthy to the customer.
marketplace post
accepted”
the Afterpay brand
The same principle can apply to marketplace scams, where a seller claims to accept Afterpay as a way of making the transaction appear safer or more legitimate.
In each case, the fraudulent activity can take place entirely outside the legitimate fintech’s environment. Afterpay’s own platform doesn’t necessarily need to be compromised. Instead, its brand and the interactions customers associate with it become part of the scam.
And what is discovered first may only be one part of the activity. A fake login page could be connected to the message used to distribute it, other lookalike domains or accounts, or infrastructure supporting similar threats.
Looking at those connections can help determine whether what initially appears to be one fraudulent asset is part of something larger. Shared infrastructure, registration patterns, content, contact information and other indicators can provide more context around the wider campaign.
Protecting the customer journey beyond your own platforms
For fintechs, protecting the customer journey means having visibility beyond the websites, apps and systems they directly control.
A fake domain, impersonating social account or fraudulent app may sit somewhere else online, but it can still affect how customers experience and trust the legitimate brand. And as we’ve seen, identifying one of these assets doesn’t necessarily reveal the full extent of the activity.
This is where Unphish takes a broader approach to external threat detection and disruption. Threats can be detected and investigated to understand what sits behind them, while Campaign Clustering & Intelligence helps identify connections between related domains, accounts and other infrastructure that may form part of the same campaign.
Once a threat has been validated, Unphish supports evidence-backed enforcement and takedown, with continued monitoring helping identify related or recurring activity.
The aim isn’t only to remove the individual fake website or account that appears first. It’s to build a clearer picture of the activity targeting the brand and disrupt the infrastructure supporting it.
For fintechs operating in an increasingly digital financial environment, the customer journey doesn’t end at the edge of their own platform. Neither should the visibility used to protect it.
Learn more about how Unphish helps fintech organisations detect and disrupt external digital threats.