The Reservation Desk Scam Hiding in Search Results

The lure 

Unlike many phone scams Netcraft tracks, scammers do not always initiate the call or text; the victim often does. Fraudsters use SEO spam, advertisements, and user-generated content to connect their phone numbers with well-known brands. Someone searching with a search engine or large language model (LLM) for a query as broad as “[Airline name] support number” could encounter a result containing an unrelated number positioned alongside the airline’s name. Because the victim initiated the search, they may assume the returned information is trustworthy.

We have seen the same numbers appear in content associated with multiple airlines. This is an important signal because a phone number supposedly providing support for one airline becomes much more suspicious when a reverse search shows it being promoted as a contact number for several unrelated brands. Even when multiple airlines outsource customer support to the same call center, legitimate services would typically use separately branded advertising and distinct public-facing phone numbers for each airline. A legitimate ticket consolidator may use one number for bookings across multiple airlines, but it would generally advertise under its own brand and clearly identify itself as a third-party service, not represent the number as the official customer support line for several unrelated airlines.   

For example, Netcraft identified two phone numbers embedded throughout a forum post presenting itself as a guide to making reservations with a leading luxury resort brand. When we searched for the numbers separately, we found them promoted as customer service or reservation numbers for numerous unrelated travel brands. One of the numbers appeared in search results alongside airlines including Delta, Emirates, United and American Airlines, despite the same number also being promoted in connection with a luxury resort.  

This cross-brand reuse can provide an additional signal when investigating a suspicious reservation number. A single search result may look legitimate to a traveler, but searching the number itself can reveal that the same supposed “customer service” line is being presented as the contact number for multiple unrelated companies. 

Screenshot of a Google results showing how one adversary-owned phone number could be manipulated to appear to belong to multiple companies.

Another consequence of fraudsters using SEO spam, advertisements, and user-generated content, UGC, is search engines using AI to summarize this false information and answer questions directly. If false phone numbers are repeatedly associated with a brand across websites, forums, and other indexed content, that information can potentially find its way into AI-generated responses. Instead of clicking a suspicious-looking advertisement, a victim could specifically ask an AI-powered search tool how to contact an airline and be given a malicious number.  

From the victim’s perspective, the process feels completely normal. They searched for their airline, were given a number, and called it. By the time the call is made, the telco provider, much of the deception has already taken place.

The call 

Some fraudsters impersonate the airline company, while other fraudsters may simply answer as “reservations,” call themselves a “consolidation desk,” or say that they can help with reservations for a particular airline without ever claiming to be that airline. Those statements, taken alone, may not constitute direct impersonation.  

We encountered this issue when investigating a number associated with a leading U.S. airline. The number appeared in search results in a way that positioned it as a contact number for the airline. When we called, the service answered as “reservations.” When specifically asked whether we had reached the U.S. airline, the agent eventually clarified that the service was a consolidator and not the airline.  

If the call recording were the only piece of evidence available, the case would be difficult to classify as straightforward impersonation. When the search evidence is added, however, the situation looks different. The victim searched for the specific airline, encountered a number positioned alongside the airline’s name, and reached a generic reservation service when they called.  

The first part is discovery: Where did the victim find the number, and how was it represented? The second is the interaction itself: How did the person answering identify the service, and what did they tell the victim? The final piece is the outcome: What information or payment did the victim provide, and what service did they ultimately receive? 

More manipulation 

Search manipulation is not the only way victims can be directed to the wrong service. We have also investigated cases involving numbers that closely resemble legitimate customer service numbers. 

In one U.S. airline case, a number being used for a “flight reservation” advertisement differed by only one digit the airline’s legitimate toll-free number. Someone mistyping, misreading or simply not closely checking the number could easily believe they had contacted the airline. The number itself may have been legitimately allocated, which again makes the case more complicated than simply identifying an unauthorized phone number.

Recycled numbers create another obstacle. We investigated a number that had previously belonged to an Airline based in Asia. After the airline stopped using it, the number was eventually acquired by another party. Historical pages online continued to associate the number with the airline, meaning consumers could still encounter it while searching for the airline. 

During our investigation, calls to that number on multiple occasions resulted in agents identifying the service as the airlines’ reservation desk. In one call, an agent stated that it was a Airlines reservation service. In another, an agent said it was “the reservation desk of [the Asia-based airline].”  

This type of scenario highlights a problem that is likely to become increasingly relevant for telco providers. A number can be legitimately reassigned while its historical identity remains scattered across the internet. If the new holder benefits from that existing association, determining where legitimate number reassignment ends and deceptive use begins can become difficult. 

Actions Telco providers should take 

Telco providers may be presented with a challenge when reviewing these reports. A provider cannot simply disconnect every travel agency that receives a complaint. Third-party booking services can be legitimate businesses and providers need enough evidence to confidently determine that their services are being used abusively. 

At the same time, requiring explicit brand impersonation as the primary evidence can leave an important gap. If a fraud team calls a number and hears “reservations, how can I help you?”, that interaction does not explain how the number was advertised, what the consumer saw before calling, or why the consumer believed the number belonged to a particular company. 

For example, one user on a popular scammer tracking forum flagged a company that manages toll-free phone numbers and branded calling, said they could not take action against one phone number identified in these types of scams because the user reporting the service didn’t have enough concrete evidence. They requested evidence of the following:  

• Impersonation of various travel agencies.

• Fraudulent services and products to defraud victims out of money. 

• Claiming to book non-existent flights on behalf of various travel agencies or airlines.

• The alleged bad actors operating out of an illegal call center in India.

• Lack of endorsement by any legitimate travel agencies or their affiliates in the U.S. 

Telco providers might not have insight into whether the same number is appearing in search results for multiple unrelated brands. This is why context can make such a significant difference when reviewing reservation scam reports. 

Instead of treating the call recording as the entire case, it can be useful to think of it as one piece of a larger evidence package. Screenshots of search results, the queries that surfaced the number, advertisements or user-generated posts, reverse searches showing associations with other brands, call transcripts, and victim reports can collectively explain how the scheme works. 

The big picture 

Reservation scams demonstrate why phone-based fraud requires cooperation across industries. The phone call may be where the victim ultimately interacts with the operator, but the infrastructure that gets them there can span search engines, advertising platforms, websites, forums, AI powered search tools, and telco operators.  

Each part of the scam sees something different. Search engines and online platforms promote content and direct users. Travel brands hear directly from the victims and Digital Risk Protection companies like Netcraft that specialize in protective monitoring. Payment providers can see suspicious transactions, while telco providers have visibility into the infrastructure connecting the consumer to the bad actor on the other end. Sharing those pieces of information can turn what initially looks like an ambiguous complaint into a larger campaign.