Translated automatically by AI from the Italian original.
Rome – Eye-catching notifications, flash offers for sold-out concert tickets or cultural events at rock-bottom prices. In the age of social media, online fraud increasingly travels via sponsored posts, stories and private messages spread by profiles that mimic the visual identity and name of well-known, authorised ticketing platforms.
Behind the promise of snapping up the last available ticket, however, lurks the threat of phishing: a tried-and-tested mechanism based on “clone” sites created solely to steal login credentials, personal codes and credit card details.
How the “clone” site scam works
The bait almost always starts with a social interaction: the user sees a post or story published by a page that looks official, complete with company logo, high-resolution images of the event and enthusiastic reviews.
By clicking on the provided link, the user is redirected to a fake web platform, identical to the original. When they enter their login details or make a payment, their financial information does not buy any ticket but is handed straight to the scammers.
Tips for verifying the authenticity of channels
To protect yourself from digital fraud and browse safely, cybersecurity experts and law enforcement recommend following a few simple but essential practical rules:
- Do not click on suspicious links: Avoid accessing payment portals directly from links in social media posts or messages received from unverified users.
- Start from the official site: To verify the authenticity of a social channel, go to the ticketing provider’s official website by typing the URL directly into your browser and check the hyperlinks to its official profiles on the homepage or in the contacts section.
- Do not trust the name or images alone: A profile is not automatically genuine just because it displays a well-known brand logo or promotes images and posters of the desired event.
- Examine the URL carefully: Read the web address (URL) of the page thoroughly. A single different letter, a misplaced hyphen or an unusual second-level domain can distinguish a fake page from the genuine portal.
