For an organisation managing multiple brands, there isn’t necessarily one threat landscape to monitor. Each brand can have its own customers, products, websites, apps and digital presence, creating different opportunities for attackers to impersonate them.
Attackers don’t necessarily target the parent company or the most prominent name in the portfolio. They can use whichever identity best suits the scam they’re running, whether that’s the brand customers use to make payments, access an account, contact support or download an app.
This becomes particularly interesting in fintech, where a single organisation can operate several distinct customer-facing brands and services. The threats affecting one may look very different to those affecting another, even when they ultimately sit within the same portfolio.
Looking at those brands individually can therefore tell only part of the story. The challenge is understanding what each brand is being targeted with, and where activity across the wider portfolio may be connected.
Different products attract different threats
The type of product being impersonated can shape the type of threat that appears around it. Attackers can adapt the lure to match what customers already expect to do with that particular service, whether that’s logging in, making a payment, contacting support or managing a digital wallet.
This is especially visible across fintech portfolios. A consumer payments app can attract fake login pages and social media scams, while a buy now, pay later service may be imitated through fraudulent checkout pages or malicious mobile apps. Merchant payment products can be targeted through fake login portals and support channels, while cryptocurrency products can attract phishing designed around wallet downloads and account recovery. These differences are reflected in the threat activity identified across the fintech products in our research.
Payments App
Buy Now, Pay Later
Merchant Payments
Crypto Wallet
The parent company might not be the identity attackers use
A well-known parent company isn’t always the name customers interact with day to day. They may be far more familiar with an individual product, app or service within its portfolio, and attackers can take advantage of that recognition.
Block is a good example of how complex this can become. Its portfolio includes customer-facing brands and products such as Cash App, Afterpay, Square, Bitkey and TIDAL. Each has its own identity, audience and digital presence, despite ultimately sitting within the same broader organisation.
The threat activity identified across these brands also reflects that difference. Cash App has been targeted through phishing sites imitating login and payment portals, while Afterpay has faced fraudulent checkout sites and malicious mobile applications. Square impersonation can focus on merchant login portals and fraudulent support channels, while Bitkey creates opportunities for scams targeting wallet recovery processes and sensitive information such as seed phrases.
For a security team, monitoring only the corporate identity would therefore leave a significant part of the picture out. An impersonating website, social account or malicious app may never mention the parent company at all. It can simply imitate the product customers already recognise and trust.
This is why the threat landscape needs to be understood at portfolio level, not just organisation level. The question isn’t only whether someone is impersonating the parent company, but how each customer-facing identity is being used and whether activity affecting different parts of the portfolio is connected.
Threats can overlap across the portfolio
Different brands may attract different types of threats, but that doesn’t mean the activity behind them is always separate.
Within Block’s portfolio, for example, threat activity affecting Square has shown overlap with Cash App due to their shared payments ecosystem. This is where looking across the portfolio becomes particularly useful. What initially appears to be two unrelated threats affecting different brands may turn out to have common elements.
The same domains, hosting infrastructure, social accounts, page content or other indicators can potentially appear across multiple impersonation attempts. Identifying those connections can help reveal whether individual detections are part of a broader campaign rather than isolated incidents.
For a multi-brand organisation, this adds another layer to threat monitoring. It isn’t only about understanding what’s targeting each brand individually, but recognising when activity across the portfolio starts to connect.
That wider view can provide useful context for investigation and help security teams understand the scale and structure of the activity they’re dealing with.
Seeing the portfolio as one threat landscape
For fintechs operating multiple brands and products, threat monitoring needs to reflect the full portfolio. That means looking beyond the parent company name and accounting for the individual products, apps, domains, social identities and customer interactions that attackers could plausibly imitate.
It also means being able to connect what is found. A fake login page targeting one product and an impersonating social account targeting another may initially appear unrelated, but shared infrastructure, content or other indicators can reveal a wider campaign affecting multiple parts of the organisation.
(Unphish can identify connections between threats across different brands, helping reveal shared infrastructure and related activity across a wider campaign.)
This is where Unphish can help. The platform monitors for phishing, scams and impersonation across websites, domains, social media, mobile apps and other external channels, helping organisations build visibility across the different identities within their portfolio. Threats can then be investigated to understand what sits behind them, identify connections and gather the evidence needed for enforcement and takedown.
For a multi-brand organisation, the goal isn’t simply to monitor more names. It’s to understand how threats are affecting the portfolio as a whole, where they overlap and how the activity behind them can be disrupted.