Research

Your flight was cancelled. Is the refund message real?

Travel disruption gives scammers the one thing they need most: a believable reason to rush you

Luis Corrons's photo

Security Evangelist at Gen

Published

Read time

8 Minutes

Your flight was cancelled. Is the refund message real?

Written by

Security Evangelist at Gen

Published

Read time

8 Minutes

Your flight was cancelled. Is the refund message real?

    Related article

    Fake hiring pages abuse FIFA and other major brands to steal work credentials

    Share this article

    You have a summer flight booked. You have seen the headlines about jet fuel shortages, cancelled routes and higher travel costs. Then a text message arrives: your flight has been affected, and you need to click a link to confirm your refund or rebook before the offer expires. 

    That message feels plausible because the situation around it is real. In April, IATA warned that Europe could start seeing flight cancellations by the end of May if jet fuel shortages materialized. Airlines and governments have since been trying to reassure travelers, while also publishing guidance on passenger rights, refunds and re-routing.  

    That is exactly the kind of confusion scammers like. They do not need to cause the disruption, they only need to arrive at the right moment, with the right brand logo and the right sense of urgency. 

    Why travel disruption works so well as a scam hook 

    Most scam messages fail because they arrive out of context. A random refund email from an airline you never use is easy to ignore. A refund message from the airline you are flying with next week, during a period of public travel disruption, is different. 

    The scammer’s job is to make you think: “This could be real.” 

    That can happen in several ways. You might receive a fake cancellation email that links to a refund form. You might search for an airline’s customer service number and land on a fake support page. You might post publicly on social media asking an airline for help, then receive a reply from an account that looks official. Or you might get a WhatsApp message that knows your hotel name, travel dates or booking reference. 

    Each version uses the same pressure point: you are worried about losing money, losing your flight or being stranded. 

    Criminals are already using disruption this way. In March, The Guardian reported that fake airline support accounts were targeting travelers affected by Middle East flight disruption. Some victims were looking for help or refunds, then received replies from accounts pretending to represent airlines. The scam moved into direct messages, where victims were asked for details and sent links that led to money being taken instead of refunded.  

    The jet fuel story gives scammers another pretext. A message can claim that your flight was cancelled, your fare changed, your fuel surcharge failed, or your refund must be claimed within a few hours. None of those claims needs to be true to be effective. 

    The scam may start before the message arrives 

    A fake travel message becomes much harder to spot when it includes real information. 

    This is the idea behind Reservation Hijack scams, a form of targeted phishing where cybercriminals use real booking details to make a message look legitimate. In some cases, attackers may use information exposed through breaches or compromised travel systems. In other cases, they collect details from emails, social media posts, previous leaks or fake customer service interactions. Gen has previously described Reservation Hijack scams as scams that use real hotel booking details to make fraudulent payment or verification requests feel authentic.  

    That distinction matters. A scam message does not need your credit card number to fool you. Knowing your name, your destination, your travel dates and your booking platform may be enough. 

    What these scams can look like 

    A travel disruption scam usually does not begin with a strange offer. It begins with something boring and administrative. That is part of the trick. 

    You may see messages like: 

    “Your flight has been cancelled due to fuel supply issues. Claim your refund here.” 

    “Your rebooking is pending. Confirm passenger details within two hours.” 

    “Additional airport tax or fuel surcharge is required to keep your booking.” 

    “Your hotel reservation will be cancelled unless payment is verified.” 

    “Due to high call volume, please continue this request on WhatsApp.” 

    The exact wording changes, but the structure is familiar. There is a problem, a deadline and a link. The message may also move you away from the official channel into SMS, WhatsApp, Telegram, direct messages or a phone call. Once that happens, the scammer controls the conversation. 

    There is another detail worth watching: some messages do not ask for money immediately. They start by asking for your booking reference, last name, phone number or one-time password. That can still be dangerous. Those details can help scammers access a booking, impersonate you to customer support, reset an account or make the next message more convincing. 

    Your real passenger rights can be used against you 

    If an airline cancels your flight, you may have rights to a refund, re-routing or assistance, depending on where you are travelling and the rules that apply. The European Commission said passengers affected by cancellations continue to have rights to reimbursement, re-routing or return, airport assistance and compensation for last-minute cancellations in relevant circumstances. It also said airlines cannot retroactively add fuel surcharges to already published final ticket prices.  

    That information is useful for travelers, but it is also useful for scammers. 

    A fake refund message becomes more believable when people already know refunds are possible. A fake rebooking link becomes more believable when airlines are genuinely changing schedules. A fake “fuel surcharge” demand becomes more dangerous when fuel prices are in the news, even though legitimate retroactive charges may not be allowed in many cases. 

    This is why the safest route is not to judge the message only by whether the story sounds plausible. During travel disruption, many scam stories will sound plausible. Judge the channel instead. 

    How to check before you click 

    Start from the airline or booking platform’s official app or website. Do not use the link in the message. Open the app yourself, type the website address yourself, or use the contact details listed on your original booking confirmation. 

    Check whether the same cancellation, refund or payment request appears inside your account. If the message is real, the airline or hotel should be able to confirm it through an official channel. 

    Be careful with social media support. If an account replies to your public complaint, check whether it is linked from the airline’s official website. Look at the handle carefully. Fake support accounts often copy logos and names, but have small differences in spelling, low follower counts or recently created profiles. The Guardian reported that fraudsters often scan social media for passengers trying to contact legitimate airline accounts and reply to them first, which makes the scam harder to spot.  

    Do not share one-time passwords, payment card details or login credentials with anyone who contacts you unexpectedly. A real airline or hotel does not need your banking OTP to send you a refund. 

    Be especially suspicious of pressure. “You have 30 minutes to claim your refund” is not customer service. It is a tactic. 

    What to do if you already clicked 

    If you entered payment details, contact your bank or card provider immediately. Ask whether the transaction can be blocked or reversed, and request a new card if needed. 

    If you shared login details for an airline, hotel or booking platform, change the password from the official site or app. Use a unique password, not one you use elsewhere. Turn on two-factor authentication where it is available. 

    If you shared a one-time password or authentication code, assume the account may have been accessed. Check your booking details, payment methods and recent account activity. 

    Report the scam to the airline, hotel or booking platform being impersonated. If the scam came through social media, report the account as impersonation. If money was taken, report it to the relevant fraud authority in your country. 

    The real lesson for summer travel 

    Travel disruption changes how people behave. They search for support numbers in a hurry. They post publicly because customer service queues are long. They accept strange instructions because they are worried about losing a flight or refund. 

    Scammers build around that behavior. 

    The safest assumption is simple: if a message about your flight, hotel or refund creates urgency and gives you a link, pause. Go back to the official source. A real cancellation will still be there when you check through the airline or booking platform. A scammer needs you to act before you do. 

    More on this topic

    Fake hiring pages abuse FIFA and other major brands to steal work credentials – From Research
    Who's Really Using Your Home Internet Connection? – From Research
    GoFlateLoader: A Widespread Golang Loader Delivering Multiple Infostealers – From Research

    Security Evangelist at Gen

    At Gen, Luis tracks evolving threats and trends, turning research into actionable safety advice. He has worked in cybersecurity since 1999. He chairs the AMTSO Board and serves on the Board of MUTE.

    Follow us for more