Hackers Hide Fake Airline Numbers in Google Search

Travelers searching for customer service numbers on Google increasingly encounter fraudulent phone lines, thanks to a scheme that exploits the search giant’s systems in ways difficult to detect. According to The Points Guy, scammers have discovered how to trick Google’s AI Overview and AI Mode into promoting fake numbers alongside legitimate contact information for major travel companies.

How Fraudsters Manipulate Google’s Search Results

The mechanics of this fraud are straightforward but remarkably effective. Hackers gain unauthorized access to high-authority websites—particularly universities, government agencies, charities, and religious institutions—and upload PDF files specifically designed to fool Google’s automated systems.

Targeting Authority Domains

Scammers focus on websites with significant trust signals in Google’s algorithm, especially those ending in .edu or .gov. These domains carry inherent authority in search results, making them ideal vehicles for spreading fraudulent content. Once a government website or university is compromised, Google’s crawlers index the malicious PDFs quickly, often giving them prominent placement simply because of the parent site’s credibility.

Keyword Stuffing for Machine Reading

The uploaded PDFs are crammed with keywords designed to be picked up by Google’s crawling bots but intentionally look like spam to human eyes. These documents contain repetitive phrases linking scam call center numbers to major airlines, hotels, and cruise lines. The files are constructed purely for machine-reading, not human comprehension—their purpose is feeding false information into Google’s index.

AI Overview Integration

Once indexed, these fraudulent pages get pulled into Google’s AI Overview and AI Mode features, which synthesize information from multiple sources to provide quick answers. Because the hacked sites are high-authority domains, Google’s AI systems treat them as reliable sources and may present the fake numbers as official customer service channels without verifying accuracy.

A Real-World Case: Marcia Hannon’s $4,500 Loss

Read also: Six Alaska cruise shore excursions from heli-hiking to whale watching · Getting to Glacier Bay: Access Options, Activities, and Costs · Sitka, Alaska: Culture and Wildlife Off the Cruise Beaten Path

Marcia Hannon discovered the real-world consequences of this scheme when arranging flight changes for six elderly travelers in their 70s and 80s flying from Boston to Geneva through Zurich on Swiss International Air Lines. When the airline modified one of their flights, the new routing created an impossibly tight connection.

Attempting to resolve the situation, Hannon tried reaching Swiss through official channels. The phone number on her ticket was disconnected, and the airline’s website chat placed her far back in a queue with no clear movement. After waiting more than an hour without speaking to anyone, she turned to Google for help.

The number Google displayed connected her immediately to someone claiming to represent Swiss. This person promised to rebook the flights and refund the old tickets. To “complete” the transaction, Hannon was asked to sign a credit card authorization form that arrived via email, displaying the airline’s branding.

Minutes later, American Express sent her a notification. Her card had been billed $4,500 by a merchant called WHOP, a digital marketplace with zero connection to Swiss or the alleged transaction. Fortunately, American Express had already flagged the suspicious charge and refused to honor it, despite Hannon having signed the authorization. Many scam victims don’t receive such protection.

The Scale of the Compromise

Multiple Hacked Institutions

The Points Guy’s investigation revealed how widespread this attack has become. Searching for basic travel support like “How to get a refund from American Airlines” displayed results from Rutgers University. Fraudulent PDF files appeared in search results and AI responses despite the university’s administrators having no knowledge they were hosting this content.

When The Points Guy contacted Rutgers’ IT department with evidence, the university found hundreds of malicious “articles” and removed them. The University of California Merced’s website served as the source for fake Swiss Air Lines contact information, while a fertility clinic’s hacked pages fueled search results for United Airlines support. The Office of the National Coordinator for Health Information, a U.S. government agency, hosted PDFs directing people to Royal Caribbean scam call centers. Most concerning, fraudulent pages were discovered hosted directly on Google.com itself, promoting Expedia scam numbers in Google’s own AI Overview.

Rapid Adaptation by Fraudsters

When authorities and Google remove hacked pages, scammers simply move to new targets. After ONC’s hacked pages disappeared and Google removed content from Google.com, the City of Freeport, Texas and The Villages in Florida began hosting the same scam call center PDFs within days. These operations are relentless and adaptive.

Google’s Response and Its Limitations

When confronted with examples of fake numbers appearing in AI Overview and AI Mode, a Google representative stated that the company’s “anti-spam protections are highly effective at keeping scams out of our features.” Google indicated that spam-fighting systems run constantly and scammers are removed as soon as they’re detected or reported.

The response highlights a fundamental challenge: scammers often compromise new sites and upload new PDFs faster than Google can remove them. Even when pages are taken down, the bots work faster than the cleanup crew. Users can report bad search results by clicking the three-dot menu beside results, sending feedback directly to Google, though enforcement varies in speed and effectiveness.

How to Stay Safe From These Scams

Avoid Google for Customer Service Numbers

The most straightforward protection is to stop using Google to find contact information for travel companies. Given the current state of AI Overview and the prevalence of compromised high-authority sites in search results, Google is no longer a reliable source for this information.

Verify Source Domains

If you do use Google for travel support, scrutinize the source. If the answer comes from a university, government website, charity, or religious institution when you’re seeking airline or hotel contact details, treat it with extreme suspicion. These sectors are the scammers’ preferred targets because of their domain authority.

Use Official Mobile Apps

Nearly every major travel provider, bank, and credit card issuer maintains a mobile app today. Downloaded directly from the official app store, these apps guarantee access to authentic customer service channels without the risk of encountering fraudulent information through search results.

Recognize Red Flags

If a supposed airline representative asks you to sign unusual authorization forms or requests credit card information in an unconventional way, hang up and verify the number using an official channel. If their instructions are confusing or defy logic, trust your instincts.

Act Quickly if Compromised

If you realize you’ve already shared credit card information with a scammer, contact your card issuer immediately. Many banks and credit card companies offer identity theft monitoring either free or for a modest fee.

Source: The Points Guy Articles