A new case of digital identity theft (legally speaking, misuse of a trademark and fraud) targeting a major and well-known brand, Telecinco.

Why do they impersonate the digital identity of a major brand?

Because they know they will generate traffic, and they take advantage of its naming and branding because they know it will spark interest and elicit a response to their bait, which is perfectly designed using social engineering. If we also add these two factors to a lack of online awareness, we have the perfect formula for a full-blown phishing attack.

What benefit do they gain?

Personal data (and real data equals money on the black market), both yours and that of your contacts.

But if I’m not famous, why do they want my data? What use is it to them?

How does the fraud work?

On Facebook, the social network with the most traffic in Spain (where people watch Telecinco), a post is published by “Telecinco” alongside an image featuring the presenters of the program Sálvame, Jorge Javier Vázquez and Paz Padilla, and the post Do you want to win 8,000 euros? This publication includes a link to enter a “giveaway” for no less than €8,000.

The FORMULA for the social engineering trap is served AND SUCCESSFUL.

• Well-known brand name: Telecinco + Photo of two brand representatives: Jorge Javier Vázquez and Paz Padilla + Common action: GIVEAWAY (simple survey to complete) + Tempting prize: €8,000 = Call to action ACHIEVED

What responsibility does Telecinco have in this? What is their response?

This is the part we like most: they have no responsibility or fault, but they CAN and SHOULD do something, which is DIGITAL VIGILANCE: monitoring their brand to detect when it is being used fraudulently. Not all companies do this, but they should; after all, they later receive hundreds or thousands of inquiries at their customer service department, whether or not they are the result of their own actions. Therefore, it is better to PREVENT than to CURE (RESPOND).

How have they responded?

Through their official networks with a post on Twitter and Facebook, indicating and ALERTING:

“NOTICE: Telecinco has nothing to do with an alleged Facebook contest in which €8,000 is given away. This is a publication made by a false account that has already been reported.”

We encourage you to review posts from other brands that have also suffered similar attacks, such as:

• BBVA
• Endesa
• Correos
• Tax Agency
• Airbnb…
• Another summary of the case