North Yorkshire Rail Operators Issue Warning About Fraudulent Social Media Accounts

Rail operators Northern and LNER have issued urgent warnings to passengers about fraudulent social media accounts attempting to steal personal information from travelers, particularly during service disruptions.

The scam involves fake accounts messaging passengers who are experiencing travel difficulties, offering to resolve issues or process refunds in exchange for sensitive personal information. Security experts note this represents a growing trend of targeted social engineering attacks focusing on frustrated travelers seeking assistance.

Northern, which operates local rail services throughout North Yorkshire and the North of England, published an alert on its official X (formerly Twitter) account @northernassist, highlighting the increasing prevalence of these deceptive practices.

“We are seeing a number of fake accounts being created and asking for personal details such as telephone numbers, and invitations to WhatsApp or to download apps,” the company warned. Northern emphasized that @northernassist is their only legitimate social media account for customer service inquiries.

The rail operator confirmed it actively reports fraudulent accounts upon discovery and encouraged passengers to do the same. Northern has provided official contact information on their website, northernrailway.co.uk/contact, and directed customers to their cyber security resource page for additional protection tips.

Similarly, LNER, which operates intercity services on the East Coast Main Line connecting Yorkshire with London and Scotland, issued its own warning about the scam. The company advised passengers to verify they are communicating with the legitimate @LNER account, identifiable by the gold verification checkmark, before sharing any personal information.

Rail industry analysts point out that these scams typically surge during periods of service disruption when passengers are most vulnerable and seeking assistance. The fraudsters exploit travelers’ frustration and urgency to resolve their travel problems, creating a perfect environment for social engineering attacks.

Cyber security experts recommend passengers exercise caution when approached by accounts claiming to represent rail companies. They advise verifying the account’s authenticity by checking for official verification markers, examining the account history and follower count, and being wary of accounts with minimal posting history or unusual handles.

The UK rail network has faced multiple disruptions in recent months due to weather events, industrial action, and infrastructure issues, creating ample opportunities for scammers to target affected passengers. The Rail Delivery Group estimates that thousands of travelers may have been contacted by these fraudulent accounts across various operators’ networks.

Both Northern and LNER have emphasized that their legitimate customer service teams will never request sensitive information through direct messages on social media platforms or ask customers to download third-party applications or move conversations to WhatsApp or other messaging services.

This type of scam represents part of a broader trend in cybercrime, where attackers create increasingly sophisticated impersonations of trusted organizations. The UK’s National Cyber Security Centre recorded a 15 percent increase in reported impersonation scams targeting transport users over the past year.

Passengers who believe they have been contacted by a fraudulent account are encouraged to report it directly to the platform and inform the legitimate rail operator. Those who may have shared personal information with suspicious accounts should monitor their accounts for unusual activity and consider updating passwords and security information as a precaution.