UK Consumer Survey Scam Campaign Impersonates Major Retail Brands
By Samantha Clarke, Archa Archa, Hiwot Mendahun and the Mimecast Threat Research Team ·
Key Points
Over 42k multi-brand phishing campaign targeting UK consumers with scams impersonating Boots and Superdrug across the last 90 days
Promise of free gifts or rewards in exchange for completing fake customer satisfaction surveys
Collection of extensive personal information and payment card details for fraudulent £2.95 "delivery fee"
Phishing infrastructure hosted on AWS S3 buckets, leveraging compromised domains for landing pages
Clones of legitimate brand websites increase victim trust and credential submission rates
Campaign Overview
The Mimecast Threat Research team has identified a cluster of phishing campaigns targeting UK consumers with scams that impersonate well-known retail brands and service providers. The campaigns use social engineering tactics that promise free gifts, exclusive rewards, or urgent account actions to lure recipients into surrendering personal information and payment details.
Unlike traditional phishing campaigns that rely heavily on credential theft, these operations combine multiple data collection stages—first harvesting personal details through fake surveys, then capturing payment information under the guise of nominal shipping or processing fees. The £2.95 "delivery fee" represents a carefully calculated amount: low enough to avoid triggering immediate suspicion, yet significant enough to validate stolen payment card details for future fraudulent use.
Attack Flow and Technical Infrastructure
The campaigns follow a consistent multi-stage attack pattern:
Initial Contact: Recipients receive emails with urgent or enticing subject lines referencing account updates, delivery issues, or exclusive rewards
Landing Page Delivery: URLs direct victims to phishing pages initially hosted on AWS S3 buckets before redirecting to compromised or attacker-controlled domains
Brand Impersonation: Landing pages feature near-pixel-perfect clones of legitimate brand websites, including authentic logos, styling, and layout
Survey Engagement: Victims complete fake customer satisfaction surveys requesting opinions on products or services
Reward Selection: Upon survey completion, victims choose from several "free" reward options (typically skincare products, gift cards, or promotional items)
Personal Data Collection: First form requests full name, physical address, phone number, and email address
Payment Data Harvesting: Second form collects complete payment card details (card number, expiration date, CVV) for the £2.95 "delivery fee"
Legitimate Site Redirect: After data submission, victims are redirected to the authentic brand website, creating the illusion of a legitimate transaction
Share this
Case Study: Boots UK Survey Scam
Recipients of the Boots phishing campaign receive one of two primary email themes designed to establish legitimacy and entice.
Post-Survey Gift Notification: Emails claim the recipient recently completed a customer satisfaction survey and has been selected to receive a complimentary gift as a thank you for their participation.
Post-Purchase Survey Request: Emails reference a recent purchase at Boots and invite the recipient to complete a brief customer satisfaction survey, promising a gift upon completion.
Both approaches exploit normal retail customer engagement patterns. Consumers are accustomed to receiving post-purchase feedback requests and loyalty program communications from retailers, making these lures particularly effective. The promise of a free gift creates an incentive for engagement while the reference to recent activity (whether fabricated or informed by data breach information) lends credibility to the message.
Analysis of the Boots impersonation campaign reveals sophisticated technical implementation. The phishing page, initially delivered from AWS S3 bucket storage, redirects to a compromised domain.
The landing page presents as a 1.4 MB clone of the legitimate Boots.com homepage, containing 19,549 lines of HTML that replicate the authentic site's visual appearance.
The primary malicious element is a modal overlay disguised as a OneTrust cookie consent banner. A legitimate privacy dialog familiar to UK internet users. The modal displays: "You have been selected to participate in our customer satisfaction survey. We really appreciate your feedback, and as a thank you, we have a special gift for you: a set of 5 of our best-selling skincare products from our sponsor, Skinny Tan."
This approach exploits user familiarity with privacy banners while creating urgency around exclusive rewards. The "Start survey" button—styled identically to a legitimate Boots consent acceptance button—submits a POST request to the PHP script that begins the credential harvesting sequence.
The user is taken through a few questions mimicking a survey then taken to a page where they are to choose from a selection of free gifts.
Once a gift is selected, they are taken through a form collecting personal information such as name, email/physical address and date of birth.
On the final page the user is then asked for a small payment of £2.95 for the delivery of the gift. Once the payment has gone through the user is redirected to the legitimate Boots website.
Campaign Variations and Geographic Expansion
While the primary focus targets UK consumers, evidence suggests threat actors are expanding operations and targeting victims internationally:
TV Licensing Campaigns exploit UK-specific regulatory requirements for television ownership, creating urgency around billing updates and payment detail verification. The lure aligns with genuine TV Licensing renewal periods, increasing victim susceptibility.
EVRi Delivery Scams leverage post-pandemic expectations around frequent package deliveries and missed delivery notifications. These campaigns request personal information and payment details to "reschedule" non-existent deliveries.
International Expansion includes campaigns impersonating Costco (targeting multiple countries) and Shoppers Drug Mart (targeting Canada), suggesting either geographic expansion by the same threat actor or toolkit reuse by affiliate operations.
Indicators of Compromise (IOCs)
Boots UK Campaign
Example Subject Lines:
Boots: Gift Inside – Share Your Thoughts! NO:748893
Tell Us What You Think & Enjoy Boots Rewards!
Your Opinion Matters – Take the Boots Survey Today! NO:314121
Boots Rewards: Claim Your Gift & Promotion Today! NO:225678
Boots™ Take Our Survey and Get a Thank-You Gift! NO:210751
Train staff to verify unexpected task assignments through separate communication channels before clicking links
Emphasize authentication verification: Users should always check the URL bar before entering credentials—legitimate Microsoft login pages will use login.microsoftonline.com or login.microsoft.com domains, not powerappsportals.com variations
Organizations should recognize that survey scam campaigns exploit fundamental human psychology around reciprocity and limited-time offers. As these campaigns become more sophisticated in their brand impersonation and technical implementation, detection strategies must evolve beyond traditional indicators to include behavioral analysis and contextual evaluation of survey and reward offers arriving via email.
Keep your edge in threat intelligence
Join thousands of security professionals using our curated alerts, expert analysis, and campaign IOCs to defend against emerging cyber threats.
