A sophisticated email phishing campaign is catching out even seasoned travelers because the fraudulent messages contain legitimate, sensitive data: passengers' exact booking information.
Customers across the United States are receiving emails promising refunds or demanding urgent flight verification. Because the notifications accurately quote their passenger names, upcoming or completed flight routes, dates, and six-character reservation codes (PNRs), recipients assume the communication must be genuine. In reality, clicking through leads to spoofed checkout forms designed to harvest payment card credentials.
Frontier Airlines has launched a dedicated phishing advisory page confirming it is "aware of an active email phishing campaign targeting our customers," as reported by travel outlet Simple Flying and industry analyst View From The Wing. Frontier affirmed that its flight operations remain unaffected and that external cybersecurity experts have been engaged to investigate how customer itinerary details were exposed.
How the Frontier Refund Phishing Scheme Works
The phishing campaign exploits two primary variations depending on whether the target's flight is past or upcoming:
- The "Duplicate Charge / Closed Settlement Batch" Hook (Past Flights):
The email claims the customer was overcharged due to a duplicate ticketing glitch or tax miscalculation and is owed a full or partial refund. To explain why the money cannot be returned automatically, the message uses technical merchant phrasing, claiming the "settlement batch for this reservation has already closed". The passenger is directed to click a link and provide a card number to receive the funds.
- The "Payment Verification / Imminent Cancellation" Hook (Upcoming Flights):
For trips scheduled in the future, the message claims the booking payment failed or requires re-validation, threatening that the reservation will be canceled within 24 hours if credit card details are not re-entered immediately.
The lure works because the traveler sees their genuine confirmation code and itinerary. Cybersecurity analyses published by View From The Wing noted that some leaked samples pointed to compromised third-party customer service integrations. Furthermore, several targeted travelers reported that the fake forms dynamically validated card details—rejecting incorrect cards until the user entered the card originally used to book the flight.
How the Fraudulent Email Works
On forums such as Reddit’s r/frontierairlines and r/aviation, cybersecurity professionals and flyers noted that the campaign bypassed standard spam filters with ease:
- Sender Addresses: The emails often originate from compromised third-party business software domains (such as noreply@reviewpro.com) rather than an official @flyfrontier.com address.
- Lookalike Destinations: The links redirect to spoofed portals such as flyfrontiercrs.com or flyfrontiercms.com, which mirror the official Frontier design system.
- Keystroke Logging Risk: Cybersecurity analysts warn that these phishing sites often deploy real-time script listeners. If you typed card details into the field, the fraudsters likely recorded your data—even if you closed the browser tab before clicking "Submit."
Critical Warning Signs
- Demands for card numbers to issue a refund: Airlines process refunds directly back to the original method of payment. They never ask you to submit a credit card number to receive money.
- Plausible-sounding jargon: Phrases such as "settlement batch closed" or "ticket re-synchronization" are manufactured pretexts to justify collecting payment details.
- Mismatched domain URLs: Even if the branding looks identical, inspect the domain in the address bar. Any URL that does not end strictly in flyfrontier.com is illegitimate.
- Sudden urgency: Threats of immediate seat forfeiture or short refund expiration windows are designed to cause panic and rush decisions.
How to Protect Your Data and Account
- Do not use email links: If you receive an alert regarding a flight change, refund, or billing error, navigate independently by typing flyfrontier.com into your browser or opening the official Frontier mobile app.
- Remember the official policy: Frontier states explicitly that it will never email customers asking them to confirm credit card numbers, supply payment information to receive a refund, or click a button to revalidate an upcoming itinerary.
- Audit your booking directly: Because a confirmation code and last name can allow someone to manage an itinerary, log into the official portal to ensure your contact details, seats, and flight status remain unchanged.
What to Do If You Entered Payment Information
- Freeze and cancel the card immediately: Contact your bank or credit card provider to block the card, request a new card number, and monitor your statements for unauthorized charges. Inform your bank even if you closed the tab without clicking "Submit."
- Update your passwords: Change your Frontier FRONTIER Miles account password and update credentials on any other platform where that password was reused.
- Verify suspicious links: Run any doubtful web addresses through ScamAdviser’s domain search tool to review domain age and server data.
- Report the incident: Forward phishing messages to Frontier customer security, report the incident to the Federal Trade Commission at ReportFraud.ftc.gov, and file a alert via ScamAdviser's Report a Scam portal.
Adam Collins is a cybersecurity researcher at ScamAdviser who operates under a pseudonym for privacy and security. With over four years on the digital frontlines, he specialises in translating complex threats into actionable advice. His mission: exposing red flags so you can navigate the web with confidence.
See Full Bio
