Frontier Airlines booking/refund phishing emails route to lookalike domain flyfrontiercrs.com
MalwareTips warned on 2 November 2026 that Frontier Airlines-themed phishing emails about bookings and refunds lead to the lookalike domain flyfrontiercrs.com. It cites Frontier's own advisory of an active campaign.
- First reported
- Reports
- 1
Source: malwaretips.com · published
What happened
MalwareTips published a warning on 2 November 2026 about phishing emails that impersonate Frontier Airlines. According to the report, the messages raise an unresolved payment, a reservation confirmation or a refund, and the reported route runs through the lookalike domain flyfrontiercrs.com. Reports describe the emails as containing real reservation details, with a sender displayed as noreply@reviewpro.com. MalwareTips says Frontier's official phishing advisory confirms an active campaign. The airline, which rejects emailed requests to reconfirm reservations or supply payment information for refunds, is the party being impersonated, not the operator of a fraudulent booking service.
How the scam works
The report stresses that accurate booking details do not show that a message is genuine. It says these observations are reported warning signs, and that they do not establish how the information was obtained, who controlled any mailbox or that Frontier suffered a new breach. The displayed sender address may also be forged or misused, and the report does not say who controls it. The message may correctly identify a trip while falsely claiming that the passenger must provide payment details, so the two claims should be judged separately.
The reported aim is to obtain card and personal information. The button in the email takes the reader away from the airline to a different website. Adding letters to an airline's name creates a separate domain, not part of the genuine site, and a copied logo or menu can hide that. A refund story can make the same request seem beneficial, and follow-up messages or calls may claim that a payment failed or the booking is at risk.
MalwareTips advises not to submit card details through an unexpected travel email, to open the airline's own website or app yourself to check the booking, to keep payment recovery separate from checking whether the flight is still booked, and to contact your card issuer promptly if card details reached the page. It notes that opening the email alone does not establish card exposure.
Source
MalwareTips, “Frontier Airlines Email Scam Exposed: Fake Booking And Refund Requests”, 2 November 2026, citing Frontier's phishing advisory.
Red flags
- An email in Frontier's name about an unresolved payment, reservation confirmation or refund.
- A link to flyfrontiercrs.com, a lookalike that is not part of the airline's real website.
- Real-looking reservation details used to make the message feel authentic.
- A request for card or personal details to restore a booking or return money.
- Follow-up messages saying a payment failed or the reservation is at risk.
If you were targeted
- 1Do not use the payment or refund link in the email or enter card details on flyfrontiercrs.com.
- 2Open Frontier's website or app yourself to check whether your booking really has a problem.
- 3Remember that Frontier rejects emailed requests to reconfirm bookings or supply payment details.
- 4If card details reached the page, call your card issuer promptly and watch your statement.
- 5Never share a one-time banking code or approve a transaction because a caller says it is a reversal.