How Do Twitter Account Impersonation and Fake Giveaway Links in Replies Work?

29 October 2026

Fake giveaway links in Twitter replies work by impersonating a legitimate account, usually a well-known crypto figure or project, and replying to that account’s tweets with a link that promises free tokens. The link leads to a phishing site designed to steal your wallet credentials or drain your funds after you connect your wallet. The scam relies on the reply appearing in the same thread as the real account’s tweet, making it look like an official announcement or endorsement.

How the impersonation works

The attacker creates a Twitter account that closely mimics the target. They copy the profile picture, display name, and bio of the real account. The handle is often slightly altered - for example, adding an extra character, using a lookalike letter (like a Cyrillic “а” instead of Latin “a”), or inserting an underscore where none exists. This is a form of typosquatting adapted to Twitter handles. The scammer then replies to a recent tweet from the real account, often within minutes of the original post. Because the reply appears in the same thread, Twitter users scrolling through replies may see the fake account and mistake it for the real one, especially if they are not checking the handle carefully.

The fake giveaway link

The reply contains a link, typically shortened with a service like bit.ly or t.co, or disguised as a legitimate URL. The text of the reply might say something like “I’m giving away 10,000 ETH to my followers - claim yours here” or “Limited time airdrop - connect your wallet to verify.” The link leads to a phishing site that looks like the real project’s website. The site may ask you to connect your wallet, sign a transaction, or enter your seed phrase. Common phishing actions include:

• Wallet connection request: The site asks you to connect your wallet via WalletConnect or MetaMask. Once connected, it may prompt you to sign a permit signature or setApprovalForAll, giving the attacker unlimited access to your tokens.
• Seed phrase entry: The site shows a fake wallet interface that asks for your seed phrase to “verify ownership.” Entering it gives the attacker full control of your wallet.
• Fake minting or claim button: Clicking it triggers a transaction that drains your ETH or tokens, or signs a malicious smart contract interaction.

How to Check a URL in a Twitter Reply

Before clicking any link in a Twitter reply, take these steps:

1. Inspect the account handle: Hover over or click the account name to see the full handle. Compare it character by character to the real account’s handle. Look for swapped letters, extra characters, or Unicode lookalikes. For example, if the real handle is @VitalikButerin, a fake might be @VitalikButerin with a Cyrillic “е” instead of Latin “e.”
2. Check the account’s join date and activity: Fake accounts are often recently created and have few tweets or followers. Click the profile to see when they joined and what they’ve posted. If the account is days old and only replies to the target, it’s a scam.
3. Verify the link before clicking: Copy the link text (do not click it) and paste it into a URL checker or a plain text editor to see the full destination. Look for misspellings, unusual domain extensions (like .xyz or .top), or domains that differ from the official one by one letter.
4. Use a phishing detection tool: Browser extensions like MetaMask’s phishing detector or a dedicated URL scanner can flag known phishing sites. If your wallet shows a warning, do not proceed.
5. Search for the giveaway independently: Open a new tab and search for the project’s official website or Twitter account. If the giveaway is real, it will be announced on the official channel. No legitimate project gives away tokens through unsolicited replies.

Why this scam works

Twitter replies are public and often unmoderated in real time. The scammer’s reply appears in the same visual space as legitimate replies, and many users skim rather than scrutinize each account. The promise of free money exploits urgency and greed. Even experienced users can be tricked if they are not paying attention to the handle.

What to Do If You Clicked the Link

If you clicked the link and connected your wallet or entered any information:

• If you signed a transaction: Immediately revoke the approval using a token approval checker like Etherscan’s “Token Approval” tool or a service like Revoke.cash. This removes the attacker’s permission to move your tokens.
• If you entered your seed phrase: Your wallet is compromised. Transfer any remaining funds to a new wallet generated on a clean device immediately. Do not reuse the old wallet.
• If you only visited the site without connecting: You are likely safe, but clear your browser cache and run a malware scan as a precaution.

How to report impersonation

Report the fake account to Twitter using the “Report” function. Select “It’s pretending to be me or someone else” and provide the real account’s URL. Twitter may suspend the impersonating account, but the attacker will often create another one within hours. Staying vigilant and checking URLs manually is your best defense.

Back to phishing