EN
A convincing phishing campaign is targeting Frontier Airlines passengers with emails containing highly accurate flight and booking information. These messages claim that a passenger's reservation has an unconfirmed payment status or that a billing adjustment or refund requires attention. However, the emails are not legitimate Frontier Airlines communications. They use real travel details to make the messages appear trustworthy and trick recipients into sharing sensitive financial and personal information.
What makes this campaign particularly concerning is the accuracy of the information included in the emails. Some recipients have reported seeing their real names, actual flight itineraries, and matching booking confirmation numbers. In certain cases, the emails have even reflected itinerary changes made through Frontier Airlines.
The messages reportedly come from a non-Frontier email address and direct recipients to fraudulent websites designed to resemble the airline's official website.
So, how can you recognize a fake Frontier Airlines email, and what should you do if you have already interacted with one? Let's examine the warning signs and steps you can take to protect yourself.
This phishing campaign uses accurate travel information, payment related messages, and convincing website designs to make passengers believe they need to take immediate action regarding their reservations.
Here is how the scheme typically works:
The recipient receives an email that appears to be related to an existing Frontier Airlines booking. The message may claim that the reservation has an "unconfirmed status due to payment" or mention a "billing and adjustment refund."
These messages are designed to create concern. A passenger who has already purchased a ticket may worry that their reservation is not confirmed or that a payment problem could affect their upcoming journey. The email then encourages the recipient to follow a link to resolve the supposed issue.
One important warning sign is the sender's email address. The reported messages come from: noreply@reviewpro.com.
This is not an official Frontier Airlines email domain. Although the email may contain the airline's branding and booking information, the sender address does not match the airline's official website domain.
Scammers sometimes use third party platforms, customer communication services, or unrelated email infrastructure to make their messages appear more credible. The use of a familiar looking sender name or professional email format does not establish that a message is genuine.
Always check the complete sender address rather than relying on the display name shown in your inbox.
This is one of the most concerning aspects of this campaign. Unlike ordinary phishing emails that contain random booking numbers or generic greetings, these messages reportedly include highly accurate passenger information, such as:
This level of accuracy can make the email extremely convincing. A passenger might reasonably assume that only the airline or someone with access to its reservation information could know these details.
The accuracy of the information raises concerns about a possible backend data compromise or unauthorized access to booking related information. However, the precise source of the data has not been independently established.
It is also possible that information was obtained through a third party service or another compromised system. Therefore, passengers should not automatically assume that their Frontier Airlines account itself has been hacked.
Most importantly, having accurate booking information does not prove that an email is legitimate.
After creating concern about the reservation, the email directs the recipient to a website that imitates Frontier Airlines. These websites may include the words "flyfrontier" in their domain names, making them look related to the airline at first glance. One reported example is: - flyfrontiercrs.com. The reported malicious domain was newly registered shortly before the wave of phishing emails.
This is an important detail because scammers often register domains containing recognizable company names or brand related terms. They hope visitors will focus on the familiar words without examining the complete web address.
Always examine the complete domain name before entering personal or payment information.
Once visitors reach the fraudulent website, they may be asked to re-enter or update information supposedly needed to confirm their reservation or resolve a billing issue.
The requested information may include:
The objective is to collect sensitive information that scammers can potentially misuse for financial fraud, identity related fraud, or further phishing attempts.
Some users have also raised concerns that the phishing website could capture information entered into form fields even if the victim does not press the submit button. This possibility means that simply closing the page after entering information may not be enough to protect yourself.
Even when a suspicious email contains your actual booking information, several warning signs can help you recognize it.
Here are the most important things to check.
Frontier Airlines provides an official phishing awareness guide to help passengers recognize fraudulent communications.
According to Frontier Airlines Phishing Awareness Guide, the airline will never email customers asking them to:
This guidance is particularly important when evaluating the reported phishing campaign.
An email claiming that your booking has an unconfirmed payment status or that you must provide additional card information to complete a billing adjustment conflicts with the airline's stated practices.
If you receive such a message, do not follow its instructions. Instead, check your reservation through the official Frontier Airlines app or the legitimate website.
Your next steps depend on whether you simply received the email, clicked its link, or entered personal information.
Simply opening a suspicious email does not usually mean your personal or financial information has been compromised. Avoid clicking any links, opening unexpected attachments, or replying to the sender. You can report the message as phishing through your email provider and delete it.
If you only opened the fraudulent website without typing anything into its forms, you are likely safe from the primary information stealing objective of this campaign.
Close the page immediately and do not interact with it further. As an additional precaution, you can change your Frontier Airlines account password, especially if you have concerns about your account security.
Act immediately if you provided your card details on the suspicious website as below:
Do not assume your information is safe simply because you did not click the submit button. Some users have raised concerns that the phishing website may capture keystrokes or information entered into form fields before submission.
If you provided your email address, residential address, or other personal details, remain alert for additional suspicious messages, calls, and phishing attempts.
Change passwords if you reused the same credentials elsewhere. If you entered your Frontier Airlines account password on the fraudulent website, change it through the official website or app.
Regardless of what the email claims, verify your reservation independently. Open the official Frontier Airlines app or manually enter the official Frontier website.
Check your booking, confirmation number, payment status, and itinerary directly. Do not use the links, phone numbers, or contact details provided in the suspicious email.
The Frontier Airlines phishing campaign is especially concerning because it uses real passenger names, flight itineraries, and booking confirmation numbers to make fraudulent emails appear genuine. However, accurate travel details do not prove that a message comes from the airline. The non-Frontier sender address, payment-related urgency, and suspicious domains such as flyfrontiercrs.com are clear warning signs.
Frontier Airlines also confirms that it never emails customers asking them to re-enter card details, pay to receive a refund, or click links to confirm billing information. Do not trust or interact with these emails. Verify your booking directly through the official website or app, and contact your bank immediately if you have shared financial information.
The information in this article is provided for educational and awareness purposes. Company names, phone numbers, sender names, and other details referenced may have been impersonated, spoofed, or otherwise misused by scammers. Their appearance in this article does not necessarily identify the legitimate company, owner of a phone number or account as being involved in fraudulent activity.
This article has been written by a Scam Fighter Contributor, De-Reviews.com Team. If you believe the article above contains inaccuracies or needs to include relevant information, please contact ScamAdviser.com using this form.
De-Reviews.com Team is a group of scam researchers, editors, and online safety advocates dedicated to exposing online fraud and helping consumers stay safe online. The team has been investigating scams, fraudulent websites, phishing campaigns, and other online threats since 2014. Read the Full Author Profile.
