Fake airline customer-support numbers spread via Instagram ads, PDFs and AI answers, Check Point says

What happened

Check Point Exposure Management researchers reported on 21 October 2026 a campaign that impersonates more than 20 travel brands, including major airlines, travel agencies and transport companies, by mass-producing fake 'how to contact [brand]' customer-support and refund documents. Check Point says the PDFs are uploaded through public forms on trusted university, government and commercial websites so they rank in searches, and the same phone numbers are amplified in Instagram advertisements, Facebook pages and AI-generated answers, including Meta AI summaries. Its full report says the pair +1-866-567-1510 and +44-161-568-0019 appeared in a hosted PDF, an Instagram advertisement, a post on a Lenovo creator platform (presented as Hainan Airlines support) and a Utah state portal PDF; the host websites were abused, not involved. The report also lists numbers seen across documents naming brands such as Swiss, Air Canada, Lufthansa, ANA, United, JetBlue, Viking and Air Transat, including +1-888-548-7012, +44-808-196-8680, +1-888-274-1875, +44-800-652-9725 and +1-888-449-8085. Check Point says the numbers behave as a rotating pool of call-centre lines consistent with callback fraud, where travellers dealing with cancellations or refunds may be pressured to pay fake fees or hand over booking and payment details, possibly via gift cards, wire transfers, peer-to-peer payments or cryptocurrency. None of the airlines named operate these numbers. Check Point advises getting support numbers only from the brand's official website, app or booking confirmation.

How the scam works

Check Point maps the operation in five stages. In the manufacture stage, keyword-heavy 'how to contact [brand]' guides are generated in bulk from shared templates, with only the brand name and phone numbers changed. In the seed stage they are uploaded through public forms and upload paths, including Drupal webforms, WordPress form plugins, Optimizely and custom government portals, on sites that expose the files to search engines. Search engines and AI answer engines then index the content, which benefits from the host's authority. A traveller dealing with a cancellation, missed flight or delayed refund searches for help, finds the number and calls, and may then be pressured to pay fees or hand over booking and payment details.

Check Point says none of the confirmed files were detected by the 61 to 64 antivirus engines used in each scan, because the PDFs contain no malicious code: the danger is the phone number itself. Over seven weeks, production moved from Google Docs exports to scripted generation and a custom automation app, and the campaign was still active at the time of the research.

Source

Check Point, "How Fraudulent Airline Support Numbers Exploit Search Results and AI-Generated Answers" (published 21 October 2026).