Scammers reuse personal details harvested from fake Esta websites – and texts and calls can keep arriving for months

When the British actor Lisa Riley was preparing to travel to the US last year, she applied online for an Esta so she would not need a visa. After finding the site through a Google search she filled in her passport, bank and personal details and waited for the confirmation, which normally takes just under an hour.

When it failed to arrive, she emailed an address from the site where she had paid and got back a message unlike any she had seen before, with a link to a website that displayed a jumble of words and letters.