Phishing Scammers Repeatedly Target Past Victims Using Stolen Esta Application Data

Scammers are repeatedly targeting people who previously fell victim to fake US Esta travel authorisation websites, reusing personal details harvested in the original scam to launch fresh rounds of phishing texts and calls, according to Guardian reporting.

The Esta, or Electronic System for Travel Authorisation, is required for visa-exempt travellers heading to the United States. Fraudulent websites mimicking the official Esta application process have circulated online, often appearing prominently in search results and prompting users to hand over personal and financial information under the impression they are completing a legitimate government process.

A Pattern of Repeat Contact

Among those affected is the British actor Lisa Riley, who applied for an Esta online ahead of a planned trip to the US last year after finding what she believed was the official site through a Google search. Her experience reflects a broader pattern described in the report: victims who hand over details to a fraudulent Esta site do not experience a single incident of fraud, but become the target of ongoing contact.

According to the reporting, scammers appear to retain and reuse the personal information gathered from these fake sites, allowing them to contact victims again weeks or months later with further phishing texts and calls, often referencing details from the original interaction to appear credible.

Ongoing Risk for Past Victims

The findings highlight a particular risk for anyone who has previously used an unofficial Esta website: that the exposure of their data is not a one-off event but can lead to a prolonged period of follow-up scam attempts. The report underscores the importance of applying for travel authorisation only through official government channels and of remaining alert to unsolicited contact referencing a past Esta application, even long after it was submitted.