Demo workspaceSample data for Kestrel Pay, a fictional bank. Nothing here is a live customer feed.
Exit demoStart your workspace

Signal workspace

Lookalike account runs a "cashback activation" flow off-platform.

Account copies the official profile and bio, then moves anyone who engages onto a private number that asks for the full card number and the code on the back.

Case queue
Kestrel Pay Rewards@kestrelpay.rewardsImpersonationescalated

Observed content

Cashback activation is now open for verified members only. Message the rewards desk on WhatsApp with your card number and the three digits on the back, and the team will release your balance within the hour. Activation closes at midnight and unclaimed balances are forfeited.
184K views9.4K likes612 sharesOpen source

Why we flagged it

Profile reproduces the official avatar and bio, claims to act for the brand, and solicits full card credentials through an unofficial channel.

94

severity

Relevance
98%
First seen
11 min ago
Check version
sentinel-threat-v1

Signs of harm

credential-requestmoney-solicitationofficial-insigniahigh-reach

Evidence

Each capture is hashed on write. The digest is what makes the record checkable later.

3 retained
  • Screenshotcrawl4ai-screenshot419 KB · 12 Mar 2026, 14:10 UTC

    sha25641b980708fe336d6668a26af89ff0e64f9bf068b75c88894864f75de0af48a21

  • Screenshotcrawl4ai-screenshot597 KB · 12 Mar 2026, 14:11 UTC

    sha2564697d065adc339f237c25a4b195cc913aa8c7a5fc9920b2ca1e26fa4784e8bb3

  • Vision analysisvision-analysis3 KB · 12 Mar 2026, 14:12 UTC

    sha256b034edf54b722af713f5b41b1453b13aa39c1b65e76fbc1da951ec8dbe0e7c98

Case brief

sentinel-dossier-v1

approved

Short summary

A TikTok account operating as @kestrelpay.rewards reproduces the official avatar and bio and directs viewers to a private messaging number where it requests full card numbers and CVV codes. The account reached about 184,000 views in eleven minutes and is still live.

Proof used

  • Profile screenshot showing the copied avatar and bio, captured one minute after detection.
  • Video frame screenshot showing the on-screen instruction to message the rewards desk.
  • Vision analysis returning a logo match against the registered avatar.

Where to report it

TikTok impersonation report, submitted through the brand portal by an officer. A human should verify the account is still live at the point of submission.

What to do next

Report the account, and publish a short advisory on the verified profile stating that Kestrel Pay never requests card details over messaging.

Sentinely provides evidence and recommendations only. The recipient decides and executes any report, enforcement, or legal action.

Decision trail

Append-only. Every status change records who and why.

  1. detectedRelevance gate passed at 0.98. Classified as impersonation-account.Collector · System · 11 min
  2. detecteddocumentedThree captures stored. Profile and video frame both show the copied avatar.Priya Raghunathan · Analyst · 7 min
  3. documentedconfirmedCard-credential request verified in the caption, the pinned comment, and two replies from the same account. The avatar is a pixel match for the official profile.Priya Raghunathan · Analyst · 5 min
  4. confirmedescalatedDossier approved and filed with the platform trust team, with all three captures attached. Support notified so inbound questions get one consistent answer.Daniel Osei · Officer · 3 min