Scammers on Facebook impersonate Europe’s largest airlines

I had been planning my vacation for half a year, and everything was going to be perfect. It was just around the corner, in two days, when I got my flights canceled. Twice.

Desperately, I went through all the official SAS airline channels searching for help. I contacted their support through a chatbot, even directly called SAS, but to no avail. My vacation was supposed to start the next day. I was devastated and just wanted to vent.

This was the point when I found the SAS customer reviews and complaints group on Facebook. I noticed passengers were posting their experiences with the carrier there, so I did too. As a last resort, I contacted their “support group” via DM, hoping for a solution. After a moment, I realized I had just messaged a scammer in what was apparently a fake airline customer support group.

I immediately blocked the chat. Yet, my colleague on the Research Team decided to go further and had a call with a scammer. How they milk disappointed passengers for money is what this research case study is all about.

Facebook airline scam network attracted 220,000 “airline customers”

We searched Facebook for groups that introduce themselves as customer support, complaint, or refund channels for Europe’s largest airlines, uncovering a broad airline scam network. We found 39 groups, with 220,018 “members” altogether. The data suggests that it is not a scattering of opportunists, but the fingerprints of a coordinated operation — in simple terms, a well-established airline impersonation scam operating across Facebook.

The groups target the largest airlines whose passengers can generate high amounts of complaints. Out of the 15 top airline groups in Europe,⁴ 14 had at least one active fake Facebook group impersonating customer support, complaint, or refund helplines. The exception was Norwegian Air Shuttle ASA, for which there was a 2-day-old group, so there were no details yet.

The scammers don’t spread evenly. British Airways alone is targeted by 8 of the 39 groups, followed by Jet2 (5), KLM (4), and Vueling (3). The carriers with the heaviest consumer-complaint flow could be the most impersonated by scammers. A report from the UK Civil Aviation Authority found that British Airways had the highest cancellation rate in 2024, for example.⁵

How the Facebook airline scam works: “Send us your refund money, and we’ll book you a new flight”

To understand how the scam works, we contacted one of the Facebook groups directly, posing as a disappointed passenger who was affected by a canceled flight. We chose to contact the group regarding the flight SK970 from Mumbai to Copenhagen, which was canceled on June 24. We reached out via the WhatsApp number +447454745087 listed on a fake SAS Facebook support group, showing how a Facebook airline scam can quickly move victims onto other private messaging channels.

Crucially, every personal detail we supplied was fabricated using Surfshark’s Alternative ID. This tool generates a complete synthetic identity (name, date of birth, address, and a working email alias) so that no real personal information is ever exposed online — which is what made it safe to walk the scam all the way through and document it.

The contact answered as “George Harrison Customer Care,” operating from a WhatsApp Business account. The Business account matters: it gives a sense of legitimacy that a personal WhatsApp account wouldn’t.

After seeing our message, “George” called. Throughout the conversation, the agent insisted we stay on the call the entire time and never hang up — a classic pressure technique designed to stop a target from pausing, reflecting, or checking the airline’s real website mid-process.

The agent explained they would use the money refunded by the airline to purchase a new flight. Not having a flight confirmation number or a refund did not matter; they claimed that they would process everything for us anyway.

Collecting personal data in an airline customer support scam

Next came data harvesting: we were sent a Google Form to complete, a common tactic in airline customer support scams. The fields requested went beyond what any genuine refund needs and included personal data: full name, email address, confirmation / booking number (we left this blank, but the scam proceeded regardless), date of birth, phone number, country of residence, city, street address, postal code, reason for refund or compensation, amount to be compensated or refunded, where to send it — with a tick-box for credit or debit card, plus a box to “review” the service.

Expand

A turning point in the airline refund scam

Then the scam revealed its real mechanism. Once the form was submitted, “George” instructed us to download the WorldRemit app — a legitimate international money-transfer service — and create an account using the preset password, “Refundme2026.” This is the turning point in the airline refund scam: a real airline refund is pushed to your original payment method and never requires you to install a money-transfer app or open an account with a password chosen by the “agent.” The supplied password strongly suggests the account was intended to be accessed by the scammer, turning the victim’s new WorldRemit account into a tool for moving money out, not in.

Once the passenger is convinced to link their bank/card “so the refund can be processed,” it provides the account with a funding source. The scammer can then log in and send transfers to a receiver they control (for example, a cash pickup or mobile money wallet, which are harder to trace).

At this point, we had documented the full chain — contact, psychological control, data harvest, and the money-movement turning point — so we ended the call. The scammer rang back immediately, another pressure signal, after which we blocked the number.

Expand

Facebook airline scam scheme

Stripped down, the scheme’s playbook runs in five stages:

1. Lure: a convincing fake support Facebook group surfaces when a traveler searches for airline help.
2. Control: the WhatsApp Business “agent” keeps the victim on the line and discourages hanging up the phone.
3. Harvest: a Google Form collects full personal identity details.
4. Turning point: the victim is told to install a money-transfer app (WorldRemit) and open an account with a password set by the scammer.
5. Cash out: the account becomes the channel for extracting funds; persistent call-backs maintain pressure.
   

Decoding fake airline Facebook groups

The same phone number, “different” airline support groups

One of the most interesting elements is the WhatsApp number in each fake Facebook group’s “About” section. The same WhatsApp numbers appear under fake airline Facebook groups impersonating completely unrelated, competing companies — something no legitimate airline help line would ever do.

Copy-paste scripts used in fake airline customer support pages

The “About” sections and even the names of the airline customer support Facebook groups are filled with very similar templates:

• Many groups embed the WhatsApp number directly in the group name (e.g., “RYANAIR CUSTOMER SUPPORT TEAM +447868173850”) — a search-optimization trick that helps this Facebook airline scam surface when travelers look up airline help;
• “Got questions or concerns? Our Awesome support team is here to help!” — appears in 6 groups, almost always paired with a wa.me/message/… deep link;
• “We are very sorry for the inconvenience… kindly WhatsApp customer service for quick assistance” — appears in 5 groups;
• 27 of 39 groups push a WhatsApp / wa.me / wa.link contact;
• 8 groups list a free Gmail or Outlook address as “official” airline support, which is a glaring tell, since no flag carrier runs customer service from a personal webmail account;
• 8 groups simply left the “About” section blank, typically the very newest shells, still being dressed up.

Built fast, inflated faster

These groups are strikingly young. The median group age is just 10 weeks, 64% are under three months old, and 26% are under a month old. Several show membership that is almost entirely a single week old, consistent with bulk member injection rather than organic complaints traffic:

How to avoid Facebook airline scams

Surfshark experts remind you how not to run into a scam on social media:

• A legitimate and reputable company might offer help and advice on social media. However, the entire customer support process will be handled only through the company’s official channels, using the contacts listed on the company’s webpage;
• If you happen to find yourself on any channel that isn’t a company’s official one, always double-check: the channel itself, the account you interact with, the links, and the contacts they share with you for reaching out. Trust only official company channels;
• Scammers feed on emotions. Travelers whose flights have been canceled, who are frustrated and angry, could not be a better target for scammers. You have to catch yourself when emotions take over; otherwise, it’s easier to fall for a scam;
• A legitimate company may first try to solve your problem publicly, replying to your post or comment where you mentioned them. It may send you a private message — or ask you to send one — if your case is very specific. And even then, it will ask you to communicate through the company’s official channels;
• If you want to write a complaint or share a poor experience publicly on social media, be sure never to reveal your personal information. Don’t attach any personal documents with names, surnames, or contact details, and make sure your social media profile does not reveal such data to strangers. Scammers can easily use your social media information for future targeting.

Methodology

Dataset: the analysis is based on a dataset of 39 Facebook groups identified as impersonating customer support, complaint, or refund channels for major European airlines. Data was collected on June 29, 2026. The groups span 19 airline brands belonging to 15 of Europe’s largest airline holdings by 2025 passenger volume. Russian airline Aeroflot (8th in Europe) was deliberately excluded, as Facebook is banned in Russia. For each group, the source data captured: group name, URL, About-section text, member count, posts today and over the last month, comments today and over the last month, members joined in the last week, group creation date, and the airline/holding it targets. We focused on groups with a direct contact number. However, two groups had no WhatsApp contact but were included in the dataset: Norwegian Air Shuttle, as it is a major European airline, and the group was very recent, so it is likely it will develop into a full scam group; an additional Jet2 support group, which had 4,000 members, so its likely targets are being messaged privately.

The dataset is a point-in-time snapshot; upon searching for the airline names, we extracted as many groups with details as we could find. Additionally, member counts, post activity, and group existence change rapidly, and some groups may have since been removed or renamed. Membership figures are as reported by the platform. Attribution of multiple groups to a single operator is sometimes confirmed by the presence of the same administrator(s) but equally inferred from shared numbers, shared scripts, and coordinated growth patterns. Two non-UK numbers were retained as recorded.

The contextual aviation statistics (summer-2025 traffic and full-year passenger totals) are network-wide European figures drawn from the external sources listed below; all pattern findings derive solely from the supplied dataset.

For the complete research material behind this study, click here.

References

¹ Eurocontrol (2025) “Special Flash Briefing — Summer 2025”
² Eurocontrol (2026) – “European Aviation Overview, 2025”
³ ACI Europe (2025) – press release 
⁴ Wikipedia (2026) List of largest airlines in Europe
⁵ UK Civil Aviation Authority (2024) – UK passenger complaints 2024
⁶ Airport Councils International (2026) – Airport Industry Report Q4 2024 and 12M 2025