Frontier Airlines passengers are receiving phishing emails that contain their real flight confirmation numbers and booking details, prompting them to enter credit card information for supposed refunds or to complete unpaid bookings. Frontier confirmed an active phishing campaign targeting its customers.
The scam emails claim ticketing errors caused duplicate taxes and fees or that payment didn't process. One version promises refunds after the customer confirms their original payment card. Another warns that payment hasn't gone through for upcoming reservations. The emails provide plausible-sounding explanations, such as claiming a closed settlement batch requires the original payment method for refund processing.
Passengers in Frontier GoWild Pass Holders forums and Reddit discussions report receiving emails with real confirmation numbers matching actual bookings, both for completed and upcoming trips. Several customers report entering credit card numbers into the fraudulent sites. One passenger tried multiple cards before the site accepted the original card used for booking. Another customer received a refund offer claiming to be five times their actual payment amount.
The source of the reservation data remains unclear. Frontier experienced a July data breach affecting 11,482 people. In October, Frontier disclosed a security incident involving its customer care database. Security researcher VenariX analyzed leaked samples and found booking codes, flight numbers, dates, and evidence of overly broad access permissions on Microsoft customer service portals.
Norwegian Cruise Line customers reported a similar campaign in October, with messages containing real booking information and demanding payment verification. Norwegian issued its own warning.
Frontier stated it will not email asking customers to reconfirm reservations, re-enter card details, or supply payment information to receive refunds. Customers who entered card information should contact their card issuer immediately, lock the card, report the exposure, and arrange a replacement. Customers should change passwords through Frontier's legitimate site and verify their reservation details remain correct.