Scammed once on a fake ESTA site, then targeted every week since

According to Guardian News and Media, a single scam rarely ends when the money is taken. The details taken in that first moment get reused, resold and replayed against the same person for months afterwards.

The actor Lisa Riley found this out after applying for an Esta, the US travel authorisation, ahead of a trip last year. She found a site through a Google search, filled in her passport, bank and personal details, and paid a fee. The confirmation never came. When she emailed the address listed on the site, she got back a message with a link to a page showing a jumble of words and letters. That was the moment she realised the site was fake.

One scam becomes many

Riley lost £16, the cost of a genuine Esta at the time. The real damage came after. Seventeen months on, she still receives scam calls and texts, often several times a week, many posing as her bank with questions about a money transfer. The pattern she describes, where one breach of personal data generates a long tail of follow-up attempts, is not unique to her case.

Nationwide building society has looked at this at scale. Its research suggests 15% of people have handed personal information to something that later turned out not to be genuine, leaving them open to further fraud. Annya Burskys, head of fraud operations at Nationwide, says criminals take that information and either sell it to other scammers or use it to make later bank impersonation calls, texts and emails sound more convincing.

The fake Esta site worked because it looked right and ranked well. Riley describes it as identical to the genuine page, with nothing to raise suspicion until the confirmation failed to arrive. Criminals use AI to recreate legitimate government sites and often include words like “Esta” in the domain name to borrow credibility from the real service. US Customs and Border Protection says some of these sites push applicants to act quickly, a pressure tactic designed to stop people checking before they pay.

Why this is a pattern worth watching

What this case shows is that the first scam and the second, third and fourth are not separate incidents. They are one data breach replayed through different channels over time. A single stolen record keeps generating fraud long after the original transaction is forgotten. That is the kind of recurring pattern Flggd tracks: not just the first scam, but the resale and reuse that follows it.

CBP's advice is to use only the official Esta website, which carries a .gov address, or the official mobile app, and to protect the Esta confirmation number and payment details the same way a password would be protected.