A cancelled flight or a refund that never arrives is the moment most travellers search for a customer support number. Researchers at Check Point Software say scammers are now waiting at exactly that point, by planting fake airline and travel helplines where search engines and AI assistants will pick them up.
Contents
Quick facts
- What: fake airline and travel support numbers planted in PDFs on trusted sites.
- Scale: more than 20 travel brands impersonated.
- Reach: the numbers surface in search results, Instagram ads and Meta AI summaries.
- Detection: none of 61 to 64 antivirus engines flagged the files.
- Rule of thumb: take a support number only from the airline's own app, website or booking email.
In a commentary shared this week, Check Point Exposure Management analysts Ben Neeman and Ruty Davidson describe a campaign that impersonates more than 20 travel brands, including airlines, travel agencies and transport companies. The fake numbers are spread through PDF documents hosted on trusted websites, then repeated across social media and AI-generated answers.
How fake support numbers end up on trusted sites
The researchers found the PDFs on public-sector and institutional websites, including university and government sites, as well as commercial platforms. The entry point is ordinary: public upload forms such as job application portals, university webforms and government document-submission systems that accept a file and then expose it at a public web address.
Once uploaded, a fake "how to contact" guide is served from the organisation's own domain and can be indexed by search engines. Check Point identified upload paths linked to Drupal webforms, WordPress form plugins, Optimizely and custom government portals. Because a PDF is an expected file type for these forms, the documents pass normal file checks.
From search results to AI answers
The same numbers turned up in Instagram advertisements and Facebook pages. One pair of numbers appeared across a hosted PDF, an Instagram ad, a Lenovo creator post and a Utah state portal PDF, according to the researchers.
They also appeared inside Facebook search summaries labelled "Summarized by Meta AI". Searches related to Booking.com customer service returned AI-generated answers that included fraudulent contact numbers.
Check Point says the documents appear built to rank in AI answer engines as well as traditional search: question-style titles, the same phone numbers repeated many times, keyword-heavy text and placement on domains that search systems already trust. We have covered how often scammers borrow trusted names before, in Check Point's Q3 2026 brand phishing ranking.
The five steps of the scam
The researchers mapped the campaign into five stages:
- Manufacture: keyword-heavy contact guides are generated in bulk from shared templates, with brand names and phone numbers swapped between documents.
- Seed: the PDFs and posts are placed on third-party sites and platforms that accept public content and let crawlers read it.
- Index: search engines, AI answer engines and platform summaries take in the content, helped by the hosting site's authority.
- Capture: a traveller dealing with a cancellation, missed flight or delayed refund searches for help, finds the number and calls.
- Monetise: the caller is pressured to pay a fee or hand over booking and payment details, with payment requested by gift card, wire transfer, peer-to-peer apps or cryptocurrency.
Why antivirus does not catch it
Check Point rescanned the confirmed campaign files with between 61 and 64 antivirus engines per scan, and none of them flagged a single file. The PDFs carry no exploit code, macros or hidden payloads. The danger is the phone number printed on the page and the trusted address it sits on, which is not something a file scanner is designed to judge.
The researchers also saw the operation becoming more automated over seven weeks, moving from Google Docs exports to scripted generation and then a custom automation application, with files produced seconds apart from shared templates. The campaign was still active at the time of the investigation.
What travellers should do
Check Point's advice for travellers is straightforward:
- Get a support number only from the airline's or travel company's official website, its mobile app, or your booking confirmation email.
- Do not trust a number just because it appears in a search result, a social media post or an AI-generated summary.
- Treat any request for a fee to release a refund, gift cards, cryptocurrency, remote-access software or an urgent transfer as a warning sign, and hang up.
For travel brands, the researchers recommend monitoring search results, social platforms, file repositories and AI answers for fake support details under their names, and making verified support channels easy to find. Organisations that accept public uploads are advised to add authentication and moderation, keep uploaded files out of crawlable folders and audit public storage regularly.
Check Point has published the full investigation with technical indicators. The company recently began offering its firewall on a subscription, which we covered in Check Point Now Rents Its AI Firewall on a 3-Year Plan.
