Airline Passengers Are Getting Scam Emails With Real Confirmation Numbers—Some Frontier Customers Are Entering Credit Card Details

Frontier Airlines passengers are reporting emails from scammers using their real flight details and confirmation numbers, promising refunds or claiming their bookings haven’t been paid for – and telling them to enter their credit card information to complete purchases or confirm return of funds. Frontier reported an active phishing campaign targeting its customers. That doesn’t tell us where the reservation information came from. A reader sent me a refund email that claims a ticketing error caused duplicate taxes and fees and failed to apply a promotional credit. It promises a full refund after the customer confirms the original payment card. The message even supplies an explanation for why an airline that already charged you supposedly needs your card again: Because the settlement batch for this reservation has already closed, our payment system needs the original payment method confirmed so the refund can be routed back to your card. A closed settlement batch ordinarily means the merchant needs to process a refund rather than void the original transaction. In other words, it’s a made up reason meant to sound plausible. These Emails Are Using Real Reservation Details In a Frontier GoWild! Pass Holders discussion, numerous passengers say they received these emails. Several report that the confirmation numbers matched actual bookings. That includes trips already taken and travel still upcoming. One customer says the supposed refund was about five times what they’d paid. Another reports receiving both versions: a refund offer for a completed trip and a warning that payment hadn’t gone through for an upcoming reservation. A separate Reddit discussion reports the payment problem version, with an email that contained real flight information and confirmation number. Passengers report responding with their credit card numbers. One passenger says they tried several other cards before the site accepted the card originally used to book the flight. And of course a rejection message doesn’t mean the site didn’t collect the card number. Frontier Has Disclosed A Database Incident I wrote in July about a breach affecting 11,482 people. Separately, a security researcher reported that a confirmation number and last name could expose sensitive passenger information through Frontier’s systems. There’s also an October 2 notice from Frontier about a security incident involving its customer care database covering information submitted through its customer care form. They changed the database configuration and are ‘improving monitoring’. Security firm VenariX analyzed leaked samples associated with a group claiming Frontier among its victims. They found booking codes, flight numbers and dates, and evidence pointing to overly broad access permissions on Microsoft customer service portals. This Approach Has Been Used Against Hotel And Cruise Customers I’ve covered hotel scams where the sender knows the guest’s reservation details and uses them to demand payment or card verification. Knowing the hotel, dates and guest’s name makes the message much more persuasive. Norwegian Cruise Line customers reported a similar campaign in October, with messages containing real booking information and demanding payment verification. Norwegian issued its own warning. What To Do If You Received One Frontier won’t email asking you to reconfirm a reservation, re-enter card details, or supply payment information to receive a refund. Check the trip through Frontier directly. Open the app or type the airline’s website address yourself. Use contact information obtained there if something looks wrong. If you entered a card, contact its issuer. Lock it while you report the exposure and arrange a replacement. Include every card you tried, even ones the page said it rejected. Don’t assume leaving before clicking Submit protected the information. Web forms can collect what you type before submission. If you supplied a password, change it through the legitimate site. Change it elsewhere if you reused it. Check the reservation. Make sure the itinerary and contact information remain correct. Frontier’s published instructions say a confirmation code and last name can provide access to changes and cancellations, so changing your frequent flyer password may not close that separate route into a booking. Always check the sender information on an email. That can be spoofed but most scammers don’t go to that level of effort. Topics on this page