The Federal Trade Commission is again warning travelers that scam booking sites hide inside paid search results as Americans start hunting Thanksgiving and year-end fares, a seasonal spike that costs victims both money and loyalty-account credentials.
How the fake sites appear
FTC consumer alerts describe fraudsters buying ads that sit above legitimate airline and hotel links, or registering web addresses one typo away from a brand you trust. Click through and you may reach a polished checkout page that charges real cards but never ticketed the itinerary—or that steals login details for rewards accounts.
Scammers also text drivers about bogus unpaid tolls during peak road-trip weeks, a parallel scheme the commission flagged earlier this year. The through-line is urgency: pay now, fix the “error” before your flight, or lose the fare.
Payment rails scammers prefer
Legitimate travel sellers accept major credit cards with chargeback protections. Fraud pages push wire transfers, gift cards, payment apps or cryptocurrency—methods the FTC says are nearly impossible to reverse once sent.
If a “customer service” agent insists on Zelle or Bitcoin to hold a seat, stop. Real airlines may charge change fees, but they do not demand prepaid gift cards to release a boarding pass.
Red flags before you pack
Prices far below every other portal, pressure to book within minutes, and requests to communicate only through encrypted chat are common tells. Another is an email confirmation from a domain that does not match the carrier’s official host.
Call the hotel front desk directly using the number on its corporate site to confirm that a third-party broker actually holds your room. The same step works for boutique inns that outsource booking engines.
Protecting loyalty balances
Stolen frequent-flyer logins are fenced on criminal marketplaces for quick redemptions. Use unique passwords and multifactor authentication on airline apps, and review account activity after any booking session on a new device.
Credit card travel portals from issuers can be genuine shortcuts, but open them from your bank’s app—not from an email link—to avoid phishing clones.
If you already paid a suspicious site
Contact your card issuer immediately to dispute the charge and request a new card number. File a report at ReportFraud.ftc.gov so investigators can spot patterns, and keep screenshots of the fake site before it goes offline.
For toll-text scams, look up your state toll agency’s official site rather than tapping the link in the message. Many agencies do not text first-time delinquency notices without prior mailed statements.
Planning around real rules
Once a booking is legitimate, separate scams from policy changes: TSA still limits liquids in carry-ons to 3.4-ounce containers, while formula and breast milk receive exemptions with extra screening. Knowing the real security rules helps you spot fake “TSA precheck” messages that try to harvest passport numbers.
Holiday travel demand is visible in fare calendars already; scammers scale their ad spend alongside it. The defensive habit is boring but effective—bookmark the sites you fly, verify before you click, and pay in ways your bank can unwind if the confirmation never arrives.