A canceled flight. A missed connection. A refund that has yet to arrive.
When travelers need urgent help, they often turn to search engines, social media, or AI tools to find a customer support number. Threat actors are increasingly exploiting that moment of urgency.
In our previous investigation, Scammers Are Watching Airline Complaints and Posing as Customer Support, Check Point Exposure Management researchers uncovered scammers monitoring airline complaints on social media and impersonating customer support representatives.
Check Point Exposure Management researchers identified a related campaign that targets an earlier point in the support journey: the search for help itself.
Threat actors are mass-producing fraudulent customer support PDFs and posts, hosting them on trusted websites, and amplifying the same phone numbers across social media and AI-generated answers. The campaign impersonates more than 20 travel brands, including major airlines, travel agencies, and transportation companies.
Figure 1. Example PDF advertising a fraudulent airline customer support number
Key Takeaways
- Fraudulent PDFs are being produced at scale. Researchers found large numbers of PDFs impersonating more than 20 travel brands and advertising fraudulent customer support and refund numbers.
- Trusted domains are hosting the content. Documents appeared on public-sector and institutional websites, including university and government sites, as well as commercial platforms. Public upload forms and user-generated content features appear to provide an entry point.
- Domain authority gives the scam credibility. Established domains can help fraudulent documents surface in travel support searches and appear trustworthy.
- The campaign reaches social media and AI-generated Fraudulent numbers appeared in Instagram and Facebook posts and Meta AI-generated summaries. Search-focused document titles can also help the content reach search and AI systems.
- The numbers are consistent with callback-fraud operations. Callers may be pressured to pay fraudulent fees or provide booking and payment data.
- Traditional file scanning misses the threat. None of the confirmed campaign files examined were detected by the 61 to 64 antivirus engines used in each scan because the PDFs contain no malicious code.
How Trusted Websites Become Part of the Scam
Researchers observed university webforms, job application portals, government document-submission systems, and other public forms that accept files and expose them through public URLs. Once uploaded, a fraudulent PDF can be served from the organization’s trusted domain and indexed by search engines.
Content management system components also play a role. Researchers identified public upload paths associated with Drupal webforms, WordPress form plugins, Optimizely, and custom government portals. Because PDFs are expected file types for many of these forms, the documents can pass standard file validation despite containing fraudulent information.
Figure 2. Fraudulent PDFs indexed on the website of the Moldovan Consulate General in Chicago
Figure 3. Fraudulent PDF served from a Utah state government portal
From Search Results to AI Answers
Researchers found fraudulent numbers promoted through Instagram advertisements and Facebook pages. One pair appeared across a hosted PDF, an Instagram advertisement, a Lenovo creator post, and a Utah state portal PDF.
The numbers also appeared inside Facebook search summaries labeled “Summarized by Meta AI.” Searches related to Booking.com customer service returned AI-generated answers containing fraudulent contact numbers.
Figure 4. Meta AI summary returning a fraudulent Booking.com live agent number
The campaign appears designed to influence Answer Engine Optimization (AEO) and Generative Engine Optimization (GEO), as well as traditional search. Question-based titles, repeated phone numbers, keyword-heavy copy, and placement on authoritative domains may increase the likelihood that fraudulent information is surfaced in AI-generated answers.
How the Attack Works
Researchers mapped the campaign into a five-stage flow:
- Manufacture: Keyword-heavy “how to contact [brand]” guides are generated in bulk from shared templates, with brand names and phone numbers changed across documents.
- Seed: The PDFs and posts are distributed through third-party websites and platforms that accept public content and expose it to crawlers.
- Index: Search engines, AI answer engines, and platform summaries ingest the content, with the fraudulent information benefiting from the authority of the hosting domain.
- Capture: A traveler dealing with a cancellation, a missed flight, a delayed refund, or another urgent issue searches for support, finds the number, and calls.
- Monetize: The caller may be pressured to pay fraudulent fees or disclose booking and payment information. Potential payment methods include gift cards, wire transfers, peer-to-peer payments, and cryptocurrency.
Why Traditional File Scanning Does Not Detect the Threat
Researchers rechecked confirmed campaign files using between 61 and 64 antivirus engines per scan. None of the files were detected. The PDFs contain no exploit code, malicious macros, embedded payloads, or suspicious executable behavior for traditional file-scanning tools to identify. The threat lies in the information they present and the trust signals they exploit.
The operation also shows signs of increasing automation. Researchers observed shared templates, files generated seconds apart, incrementing counters, and several production methods. Across seven weeks, the workflow progressed from Google Docs exports to scripted generation and a custom automation application.
What Organizations and Travelers Can Do
Travel brands should continuously monitor search results, social platforms, file repositories, and AI-generated answers for fraudulent support information associated with their names. They should also make verified support channels easy to find across official websites, apps, and booking communications.
Organizations that accept public uploads should consider appropriate authentication and moderation controls, prevent uploaded files from being exposed in crawlable directories, review temporary upload paths, and regularly audit publicly accessible storage.
Travelers should obtain customer support numbers only from the travel brand’s official website, mobile app, or booking confirmation. Requests for payment details, fees to release a refund, gift cards, cryptocurrency, remote-access software, or urgent transfers should be treated as warning signs.
The campaign remained active at the time of the investigation. Check Point Exposure Management continues to monitor its development. The findings show how trusted domains and visibility in search results or AI-generated answers can be exploited to distribute fraudulent information, even when no malicious code is present.
For the complete investigation, technical findings, indicators, and recommendations, read the full report: Trusted Domains, Fraudulent Numbers: How Travel Support Scams Exploit SEO, PDFs, and AI.
Learn more about Check Point Exposure Management and how it helps organizations identify and reduce exposure across their attack surface.
