Frontier Airlines customers are being targeted by a phishing campaign that uses real flight information and confirmation numbers to make fraudulent emails appear legitimate. The messages ask recipients to provide credit-card details either to receive a refund or to resolve an alleged payment problem.
Frontier has reported the campaign as active, but the airline has not identified how the attackers obtained the reservation information. Reports from passengers indicate that the emails have included details matching both completed trips and flights that had not yet taken place.
Emails present two different payment stories
One version tells the recipient that a ticketing error created duplicate taxes and fees or failed to apply a promotional credit. It then promises a full refund after the traveler confirms the card used for the booking. The message offers a technical-sounding explanation for why the airline supposedly needs the card again.
“Because the settlement batch for this reservation has already closed, our payment system needs the original payment method confirmed so the refund can be routed back to your card.”
The explanation is fraudulent, according to the report describing the campaign. A closed settlement batch would ordinarily mean that a merchant processes a refund rather than reverses the original transaction. The email instead directs the recipient toward a page intended to collect payment information.
A second version claims that payment for an upcoming reservation did not go through. It similarly asks the passenger to enter card information to complete the purchase. Passenger discussions described emails containing accurate flight details and confirmation numbers, including bookings for trips that had already been completed.
- Messages have offered refunds or claimed that a reservation remains unpaid.
- Some emails contained confirmation numbers that matched actual Frontier bookings.
- Passengers have reported entering card numbers, including trying more than one card before a page accepted the information.
Accurate reservation data raises questions
Several passengers in a Frontier GoWild! Pass Holders discussion said they received the messages. One person reported that the supposed refund was about five times the amount paid for the trip. Another said the person received both versions: a refund message tied to a completed flight and a payment warning connected to an upcoming reservation.
A separate discussion on Reddit described the payment-problem email as containing real flight information and a valid confirmation number. Some passengers said they responded with their card numbers. A rejection message on the fraudulent page does not necessarily mean that the site failed to collect information entered into it.
The campaign comes after Frontier disclosed a separate database incident affecting 11,482 people in July. The relationship, if any, between that incident and the current phishing emails has not been established. The available reports identify the reservation details being used but do not explain how the attackers obtained them.
