Fake airline support numbers spread via trusted sites and AI answers
Check Point Exposure Management researchers say scammers are mass-producing fake customer support PDFs that impersonate more than 20 travel brands and getting the phone numbers into search results, social media and AI-generated answers. The files sit on trusted websites, including university and government domains, and none of the confirmed samples were flagged by antivirus engines.
- Check Point found fraudulent support PDFs impersonating more than 20 travel brands.
- The files were hosted on trusted university, government and commercial sites via public upload forms.
- Fake numbers appeared in Instagram and Facebook posts and in Meta AI-generated summaries.
- None of the confirmed files were detected by the 61 to 64 antivirus engines used, since the PDFs contain no malicious code.
- Travelers should use only support numbers from official websites, apps or booking confirmations.
A campaign aimed at the search for help
According to Check Point, travelers facing a canceled flight, a missed connection or a delayed refund often turn to search engines, social media or AI tools to find a support number. The researchers say threat actors are exploiting that moment of urgency.
The new findings follow an earlier Check Point investigation, titled Scammers Are Watching Airline Complaints and Posing as Customer Support, which described scammers monitoring airline complaints on social media and posing as support staff. The latest campaign targets an earlier step: the search for help itself. Check Point says threat actors are mass-producing fraudulent support PDFs and posts, hosting them on trusted websites and amplifying the same phone numbers across social media and AI-generated answers. The impersonated brands include major airlines, travel agencies and transportation companies.
How trusted websites become part of the scam
The researchers observed university webforms, job application portals, government document-submission systems and other public forms that accept files and expose them through public URLs. Once a fraudulent PDF is uploaded, it can be served from the organization's trusted domain and indexed by search engines.
Check Point identified public upload paths linked to Drupal webforms, WordPress form plugins, Optimizely and custom government portals. Because PDFs are an expected file type on many of these forms, the documents can pass standard file validation. Examples in the report include fraudulent PDFs indexed on the website of the Moldovan Consulate General in Chicago and one served from a Utah state government portal.
The numbers also reached Instagram advertisements and Facebook pages. They appeared in Facebook search summaries labeled "Summarized by Meta AI", and searches related to Booking.com customer service returned AI-generated answers containing fraudulent contact numbers. Check Point says the campaign appears designed to influence Answer Engine Optimization (AEO) and Generative Engine Optimization (GEO) as well as traditional search, using question-based titles, repeated phone numbers, keyword-heavy copy and authoritative domains.
Five stages, and why scanners miss it
The researchers mapped the operation into five stages:
- Manufacture: keyword-heavy "how to contact [brand]" guides are generated in bulk from shared templates, with brand names and numbers swapped.
- Seed: PDFs and posts are spread through third-party sites and platforms that accept public content.
- Index: search engines, AI answer engines and platform summaries ingest the content, benefiting from the host domain's authority.
- Capture: a traveler with an urgent problem finds the number and calls.
- Monetize: the caller may be pressured to pay fraudulent fees or disclose booking and payment information, possibly via gift cards, wire transfers, peer-to-peer payments or cryptocurrency.
Check Point rechecked confirmed campaign files with between 61 and 64 antivirus engines per scan, and none were detected. The PDFs contain no exploit code, malicious macros, embedded payloads or suspicious executable behavior. The threat lies in the information they present and the trust signals they exploit.
The operation also shows signs of increasing automation, according to the researchers, who saw shared templates, files generated seconds apart and incrementing counters. Across seven weeks, the workflow moved from Google Docs exports to scripted generation and a custom automation application.
What brands, organizations and travelers can do
Check Point advises travel brands to continuously monitor search results, social platforms, file repositories and AI-generated answers for fraudulent support information tied to their names, and to make verified support channels easy to find on official websites, apps and booking communications.
Organizations that accept public uploads should consider authentication and moderation controls, keep uploaded files out of crawlable directories, review temporary upload paths and regularly audit publicly accessible storage.
Travelers should get support numbers only from the brand's official website, mobile app or booking confirmation. Requests for payment details, fees to release a refund, gift cards, cryptocurrency, remote-access software or urgent transfers should be treated as warning signs. Check Point says the campaign was still active at the time of the investigation and that it continues to monitor it.
