Fake Sky Facebook support page caught a customer out

A Sky customer posted a complaint in a Facebook group called 'SkyUK Complaints', believing it to be run by the company. He then received a WhatsApp call from someone claiming to be from Sky customer services, who referred to the contents of a post that was still unpublished and shouldn't have been visible to anyone else. The caller said they couldn't help unless he filled in a 'compensation form', even though he hadn't asked for compensation and didn't want it.

He downloaded the form but didn't submit it. It asked for far more personal detail than seemed necessary, and looked more suited to a holiday compensation claim than anything to do with Sky. Partway through the call his phone became unresponsive, which made him suspicious enough to end the call, restart the phone, change his password and contact his bank as a precaution. He reported the Facebook group and the WhatsApp number to Meta. By the time he raised this with Which?, the original page had disappeared, but Which? found another group with a near-identical name doing the same thing: directing people away from Sky's own channels and into WhatsApp conversations. Meta initially declined to remove it, then reversed that decision a few days later.

This is not a story about Sky being hacked. There is nothing to suggest Sky's own systems or data were involved. It is a story about how convincing a fake 'official' page can look, and how quickly a conversation can be steered towards handing over information.

What this actually means for you

Anyone can set up a Facebook page with a company's name in the title. Facebook doesn't verify that a page calling itself 'SkyUK Complaints' has anything to do with Sky. If you post a complaint there, whoever runs the page can see it, including details you might not want shared publicly. A follow-up call that quotes your own words back to you feels like proof the caller is genuine. It isn't. It only proves they read your post.

The pressure to fill in a 'compensation form' before anyone will 'help' is a classic way of getting someone to hand over personal information under the guise of resolving a problem. The fact that the form looked unrelated to Sky, more like something from a travel claim, is a useful tell: genuine customer service forms match the company and the issue you've actually raised.

What to do

• Only contact Sky, or any company, through contact details on their own official website. Don't use a phone number, WhatsApp link or email address given to you by a Facebook page, however official it looks.
• Be wary of any page offering 'customer support' or 'complaints handling' for a big company, especially if it tries to move the conversation to WhatsApp. Genuine companies rarely insist on this.
• Don't fill in forms asking for extensive personal information unless you've independently verified who's asking and why. If a form doesn't match the issue you raised, stop.
• If you think someone may have gained access to your phone, restart it, change your passwords, and contact your bank as a precaution, as the Sky customer in this case did.
• Report suspicious or fake company pages to the platform using its in-app reporting tools. It worked here, even though it took a few days and an initial refusal from Meta.
• If you're worried your phone has actually been compromised, the National Cyber Security Centre has guidance on what to check and what to do next.

What this does not fix

Reporting a fake page doesn't undo the fact that whoever ran it may still have your phone number and whatever you wrote in your original post. It's worth staying alert to unsolicited calls or messages that reference those details, especially if they ask for payment or further personal information.

A VPN has no part to play in this particular scam. It doesn't stop someone setting up a fake Facebook page, and it won't verify whether a page or caller is who they claim to be. What helps here is checking the source before you engage, not the connection you're using. If you're ever unsure whether a message, form or link is genuine, Veystrix's free tools can help you check it before you act, rather than after.