Scammers have discovered a new and nearly undetectable way to steal travelers' money — and this novel scheme is lurking online in plain sight. In fact, you might have already seen it yourself without even knowing it.
It's a well-known fact that fraudsters can game online search results so that fake numbers they operate populate first in search results for various airlines and hotels. But they are now using a whole new version of this stratagem to dupe consumers, and it's so confusing that it often works.
Bad actors are hacking into the websites of universities, charities, religious institutions, museums and even government organizations. Once inside, the scammers quickly publish PDF files specifically optimized to attract Google bots while remaining hidden to the websites' administrators.
Those pages are filled with false information and fake customer service numbers and are specifically designed to trick Google into displaying them in visible places in the search results.
Unfortunately for travelers, these fraudsters are getting shockingly good at this scheme. Google's AI Overview and AI Mode are currently falling prey to a scheme that has them presenting scam call center numbers as the official customer service channels of many major travel providers.
As a consumer advocate and TPG's ombudsman, I regularly work with troubled travelers who have lost thousands of dollars after calling a false number Google recommended. And the losses are not limited to consumers. Banks and credit card companies sometimes choose to take a monetary hit rather than go through a prolonged and expensive investigation after a customer has been victimized.
But that is not always the case, and their goodwill in refunding customers for fraudulent charges is becoming less frequent.
Here is my latest report on the surprising new way scam call centers are tricking both Google and travelers in 2026 and what you can do to spot and avoid the fraudsters.
She Googled an airline but called a scam line
Last July, Marcia Hannon turned to Google to find out how to reach a live person at Swiss International Air Lines.
"A group of six elderly travelers in our 70s and 80s were flying from Boston to Geneva," Hannon told me. "We were flying through Zurich. Swiss made a change to one of the flights which made the connection too tight for our group to maneuver."
Hannon took on the responsibility of making flight changes for the group, but immediately ran into problems.
"The phone number on our tickets for Swiss was disconnected," Hannon recalled. "The chat window on the website said 47 people were ahead of me and there was no other contact information."
After waiting for her turn for over an hour to talk to a chatbot, Hannon says her placement in line never changed. That is when she searched Google for help.
Hannon dialed the number Google displayed and reached someone immediately. The person on the other end of the line told her he was going to change the tickets and refund the old ones.
The scammer told her that in order to complete the transaction, she would just need to sign a credit card authorization form. She soon received an email which appeared with the Swiss logo and seemed to be coming from the airline.
Hannon signed the authorization and sent it right back, eager to have the new tickets confirmed. Moments after approving the charge she received a notification from American Express that her card had just been billed $4,500 by a merchant called WHOP, which she later learned is a digital marketplace with no affiliation to Swiss.
She hung up with the scammer posing as a Swiss agent and reported the fraud to American Express. Hannon hoped it wasn't too late to block the charge.
There was good news for Hannon. American Express had already flagged the charge as suspicious and, although she had signed and approved it, Amex did not.
She was relieved but she wanted to share her experience with others as a warning. Hannon asked me to investigate what had happened and why Google was displaying incorrect phone numbers for the airline.
Here is what I have found.
A new scam that uses Google's algorithm against consumers
For some time, I have noticed that, instead of getting better at detecting fraudsters, Google seems to be getting worse.
Like other scam call center victims who contact me, Hannon had not taken note of the name of the website that contained the number she called. All she remembered was that Google had identified it as the valid phone number for Swiss.
So, I had a look myself and what I found was surprising and, unfortunately, quite dangerous for travelers looking for reliable information.
Searching for "Swiss Air," Google AI Mode created an article constructed with information patched-together from around the internet. Many scam call centers were highlighted and in a confident-sounding AI amalgamation, Google advised travelers to dial the number for what turned out to be a scam call center rather than the actual airline and ask for a "tier-two claims agent."
Even more surprising than this result was that the reference AI Mode was using to generate this guidance was a hacked page of the University of California Merced website, which Google had indexed. When I clicked through to the page on the university's website, it showed an error message, so the admins had already taken it down. Unfortunately, unless someone reports the inaccurate search results to Google, the impression of the hacked page can remain in the search results for days, or even weeks, with the numbers on display.
Hiding in plain sight (or site, as the case may be)
After getting this result, I searched Google using the term "Swiss flight irregularities." This time it directed me right to a scam call center, which it called the airline's "Primary US escalation line."
Again it told me I should ask to speak to a "tier-two agent" or supervisor. The reference the AI Mode used in this suggestion was a fertility clinic that had been hacked and was now full of articles with keywords devised to fool Google. That site's admins had detected the hack, though, and the pages were no longer on the site.
Although Google AI Mode presented this information as a secret hack to "bypass front-line gate blocks," calling that number is a guaranteed way to chat with a scammer.
Infected search results are fooling AI
In recent months, more and more travelers have been contacting me after calling scammers pretending to represent airlines whose numbers had appeared in search results.
To get a better understanding of what was going on, I queried Google on dozens of questions like, "How to get a refund from American Airlines," "How to change my United Airlines flight" and "Delta Air Lines refund help."
That's when I noticed something very odd.
Rutgers University had become one of Google's top results as a leading authority on nearly every travel-related question I posed.
Strange PDF files hosted on various pages on the university's website were appearing in AI Overview, AI Mode and the general search results on Google.
If I tried visiting those pages directly, though, I couldn't do it from Rutgers' site. They were only accessible from the links on Google. When I contacted the public relations department of Rutgers to let them know that hackers were uploading malicious files on their site, I was initially met with skepticism.
I shared the URLs that proved these files did exist on the university's website, though, and the IT department delved into the admin sections of these pages, found the fraudulent files and went to work to wipe them from the university's site.
By then, however, the damage was done. The criminals had successfully uploaded hundreds of "articles," which Google had quickly indexed and given a prominent position in the search results because of the high authority of Rutgers' .edu university domain. It didn't matter that the content in the articles did not make sense. The bots could not tell the difference. Unfortunately, it would take days, and in some cases weeks, to erase their imprint across the internet.
Authority hijacking using .gov and .edu websites
These examples are not anomalies. Hackers from the new wave of scam call centers are infiltrating any high-authority website that has security soft spots — particularly preferring ".edu" and ".gov" websites since those tend to be given more authority by Google's algorithm. However, even Google's own network is prime internet real estate for these scammers.
The fraudsters are targeting the customers of airlines, cruise lines, car rental companies and hotels. Their scheme casts a wide net across the industry and no travelers should let their guard down when attempting to reach their travel provider's customer service line.
In a search earlier this month for "Royal Caribbean change cruise help," Google is displaying a scam call center in AI Mode alongside the actual number of RCCL. The origin of the phony number is an official U.S. government website that has been hacked (Office of the National Coordinator for Health Information — ONC).
I clicked through to the page on ONC and found a keyword-laden PDF file that the scammers had uploaded. Any human who clicks on this page will recognize that this is just spam and would not be tricked by the actual document. But that page isn't meant for humans. In fact, the bad actors hope real people do not click on the link. Instead, this document is purely meant for a Google bot to read and then put the phone number on display in the search results for a cruise passenger to find — no clicking through to the source site necessary.
Probably my most disturbing test happened when I searched for Expedia. Google AI Mode displayed only one phone number for Expedia 24-hour support. That feature would certainly be appealing to travelers needing immediate assistance. Unfortunately, anyone who uses that number will be delivered right into the hands of a scam call center.
But the most troubling part of the citation was the source: Google itself.
Similar to the Royal Caribbean search, when I clicked through to the source of the phone number, I found a keyword-riddled spam page hosted on Google.com. It was filled with the repetitive statements that identified the number as Expedia support. Then, Google further put forward this scam call center by listing it in the AI Overview and summary for travelers hoping to quickly reach Expedia's 24-hour customer service.
Asking Google about these search results
I shared some of my recent findings with an executive at Google who handles media relations. This is someone I have spoken to previously about scam call centers appearing in high-traffic searches on the internet. I asked her what their team makes of this growing problem. I also alerted the administrators of the ONC website that the platform was hacked.
Within hours, ONC's hacked pages disappeared from the search results. The Google-hosted scammer's page also came down. Unfortunately, the fraudsters just hacked new websites and were soon back in the AI Mode and Overviews. This time the City of Freeport Texas as well as The Villages in Florida were hosting the scammers' files for the same search terms. These operations are clearly relentless in their efforts.
In its response to my questions and examples, Google's spokesperson replied:
"Our anti-spam protections are highly effective at keeping scams out of our features and showing official customer support numbers where possible. We're continuing to roll out updates that make our spam-fighting systems even stronger and we keep the overwhelming majority of Search results spam-free."
She went on to explain that Google's spam detectors are active around the clock and scammers are removed from the search results as soon as they are detected or reported. The spokesperson pointed out that the bad pages I shared earlier were immediately removed.
Lastly, Google suggests that users can and should report bad search results to help fight back against these scam call centers. By clicking the three dot menu beside the result, users can deliver their feedback directly to Google.
What you can do to avoid falling victim to a scam call center
Today scam call centers are a plague in the internet search results. Sometime in the future, Google may release a new update that will de-list potentially fraudulent pages. For now, here is what to keep in mind if you are looking for contact information.
Do not try to find phone numbers through Google for now
Scammers have found a way to make Google promote their fake customer service numbers in the search results, AI Overview and AI mode. It is best not to ask Google for contact information at this time.
Slow down and take a look at the result
If you do choose to use the search engine for information, look at the hosting site. If you are asking a travel-related question but the answer that pops up is sourced from a university, government site, religious organization or charity campaign, it's likely that this is a scam.
Unfortunately, the travelers who are most vulnerable to falling for a scam call center are those that are facing a sudden flight cancellation or change and want to reach someone fast to fix the problem. Bad actors know that and are eagerly waiting for those calls. Before you dial any number promoted as "phone support," slow down and make certain you are not about to become a scammer's next victim.
Listen carefully and use your common sense
Remember, a fraudster's goal is to confuse their targets just long enough to complete their mission: to get their credit card information.
In almost all of the recent cases I have received, the traveler was presented with a convoluted plan that, even the victims later agreed, defied logic. Always listen carefully to what a phone agent is asking you to do. If their instructions sound unusual and are difficult to understand, hang up, verify the number you called and dial again. Don't forget to use your common sense before you hand over your credit card information and record locator.
Use your travel provider's mobile app
In 2026, nearly every major travel provider, bank and credit card company has a mobile app. If you download that app, you will be guaranteed to have the official contact number or online chat right at your fingertips.
Already been scammed? Here's what to do
If you realize too late that you dialed a scam call center and shared your credit card information and record locator, you need to act fast.
Take these steps, in this order:
- Call your credit card company and explain what has happened. If you do this fast enough, you may be able to prevent the charge from processing.
- Call your airline and let them know that your record locator is compromised. If your reservation has not already been tampered with, the airline can place a block on it so that a third party cannot make changes.
- Subscribe to an identity monitoring service. Unfortunately, these operations are often looking to steal more than just your cash. If you have provided personal information to bad actors, you are at risk for identity theft.
Many banks and credit card companies provide identity theft monitoring free of charge or at a low cost. Check with your providers to see what is available and then keep your eye out for any unusual activity. Alternatively, a third-party identity monitoring service like LifeLock can help minimize the long-term consequences of sharing personal information with criminals.
As AI gets more sophisticated and permeates online searches more, bad actors are finding new ways to manipulate it and to defraud travelers out of significant amounts of money. Don't be one of them. Use common sense, only contact airlines, hotels and credit card companies directly via their own apps, and take action quickly if you do fall prey to a scam.
Have a problem with an airline, cruise line, car rental company or hotel? Send your request for assistance to ombudsman@thepointsguy.com and I'll be happy to investigate and do my best to help you.
Editorial disclaimer: Opinions expressed here are the author’s alone, not those of any bank, credit card issuer, airline or hotel chain, and have not been reviewed, approved or otherwise endorsed by any of these entities.