-
Scammers are sending Frontier passengers emails with their real names, flight plans, and booking numbers.
-
The emails claim bookings are unconfirmed and send people to fake websites that ask for card details.
-
Frontier confirmed the phishing campaign but has not said how the attackers got the passenger information.
Scammers are targeting Frontier Airlines passengers with highly realistic fake emails. Reports say the messages use true booking details to build trust. Frontier has now confirmed the scam on its website.
This kind of attack is called phishing. Scammers send fake messages to trick people into sharing private details. In this case, the goal is to collect payment card information from passengers. The emails look genuine because they carry real booking facts.
Scammers use real booking details to send fake payment requests
Affected passengers say the emails contained their full names, flight itineraries, and booking confirmation numbers. The messages claim the reservation is still unconfirmed. They blame the problem on payment issues. Each email then directs the reader to an outside website.
The site is designed to look like Frontier’s official booking pages. It asks the passenger to type in payment card details. A passenger who follows these steps would hand the card information straight to the scammers.
The accuracy of the information makes this scam worrying. Some passengers reportedly said the scammers even tracked changes Frontier made to their itineraries. This suggests the attackers had access to updated travel information. Cybercriminals also exploit compromised internet infrastructure for malicious operations. The FBI previously warned that AVrecon malware had hijacked 369,000 routers worldwide to build a proxy botnet.
Reports also name the sender address as a no-reply account linked to ReviewPro. Hotels use ReviewPro to manage guest feedback and surveys. However, the use of ReviewPro’s email system does not prove the company was hacked. It also does not prove the company knew about the campaign.
Frontier has since posted a warning on its official website. The airline says it does not send emails asking customers to reconfirm reservations. It also does not ask them to re-enter credit card information. Frontier does not request payment details to give refunds either.
Researcher found weak spots on Frontier’s website and app in June 2026
The scam has brought back older worries about how Frontier protects passenger data. In June 2026, a security researcher named Bob reportedly found weak spots in Frontier’s website and mobile app. According to reports, these flaws could expose private passenger records. Security researchers study websites and apps to find problems like this.
The researcher showed how a booking confirmation code and a passenger’s last name could reveal too much information. A person would normally see far less when managing a reservation. Reports say the exposed details included contact details, dates of birth, and passport information. Travel itineraries and partial payment information were also reportedly visible. Frontier later fixed some of the reported weak spots. The report does not say that every weak spot was fixed.
Frontier also faced two data breaches in May and June 2026. A data breach happens when outsiders reach private information they should not see. A court order dated October 13, 2026, in the case Bennett v. Frontier Airlines describes the damage. According to the court order, the incidents exposed the personal information of at least 11,482 people. The affected details included names, addresses, Social Security numbers, and driver’s license numbers. Other identifying details were also affected.
The breaches led to a proposed class-action lawsuit. That means one case is filed on behalf of many affected people. However, no clear evidence links these earlier incidents to the information used in the latest scam.
ExfilSquad ransomware group claims it holds 2.4 million Frontier records
That makes three separate security stories linked to the airline, after the researcher’s findings and the two breaches. The newest one involves a ransomware group called ExfilSquad. On July 26, 2026, the group listed Frontier Airlines on its leak site. It claimed to have about 2.4 million records. A leak site is a place where hackers post claims about stolen data.
The group says the data contains personal information and customer support cases. It also lists flight and travel details, baggage records, and customer support communications. The cybersecurity monitoring platform Brandefense documented the listing and repeated the group’s claims. Still, nobody has independently verified that the 2.4 million records are stolen Frontier data. For now, the number remains a claim by the group and nothing more.
Frontier has not publicly explained how the people behind the current scam got the booking information. It also remains unclear whether the emails connect to any earlier incident. Both questions are still open.
Passengers should avoid clicking payment links in unexpected airline emails. A link in a surprise email can lead to a fake page. This advice applies even when the message contains correct booking details. Anyone who needs to check a reservation should visit Frontier’s official website or app directly. This way, the passenger skips the links inside the email.
The campaign shows how real travel information can make scam emails far more convincing. This raises the risk of money fraud for passengers who trust what they see.
