A traveler calling Expedia for flight changes was given a phone number by an employee — but it was one digit off from the real number, connecting them to a scammer who tried to steal their account credentials. The incident raises critical questions about phone support security and how travelers can verify they're speaking to legitimate representatives.

The traveler booked flights using reward points through the TD Bank Expedia website. When they needed to change departure dates, they called regular Expedia customer service. The employee couldn't find the booking and gave them a phone number for TD Bank Expedia support.

Here's where it went wrong: the number was a 888 number instead of the legitimate 877 number — a single digit difference that connected to scammers instead of customer service.

The fake representative asked for an email address and itinerary number, then told the traveler to check their email for a verification code from Expedia. "My fault, I just saw the code and gave it to him and totally glossed over the note saying don't give this to anyone, no one from Expedia will ask for this code."

Red flags emerged: the person sounded unprofessional, kept putting the traveler on hold, and sent a second code — at which point the traveler hung up.

How the Scam Works

This is a sophisticated account takeover attempt. The verification code was likely Expedia's two-factor authentication or password reset code. By obtaining it, scammers could:

1. Change the account password 2. Modify or cancel existing bookings 3. Use stored payment methods for fraudulent bookings 4. Access personal information for identity theft

The fact that the scammer had the traveler's email and itinerary number suggests either: - The original Expedia employee was complicit - The scammer had access to a data breach - The one-digit-off phone number is deliberately registered to catch misdialed calls

Protecting Yourself

Never trust phone numbers given verbally. Always independently verify by: 1. Googling the company's official customer service number 2. Checking your booking confirmation email for contact information 3. Using the contact number listed on the company's official website (type the URL yourself, don't click email links)

Never share verification codes sent to your email or phone. Legitimate customer service will never ask for these — they're designed to verify YOU to the system, not the other way around.

If something feels off, hang up and call back. Legitimate companies won't pressure you to act immediately.

The traveler immediately changed their banking and Expedia passwords and checked for unauthorized credit card charges. They also reported the incident to Expedia — though it's unclear if the original employee who provided the wrong number faced consequences.

The Broader Problem

Travel booking scams are increasingly sophisticated. The FTC reports that travel fraud cost Americans over $95 million in 2023. Phone number spoofing and one-digit variations are common tactics because travelers are often stressed, in unfamiliar time zones, or dealing with urgent problems.

As one commenter noted: "The fact that it was ONE DIGIT OFF and led to scammers means this is organized and deliberate. They're counting on typos and verbal errors."

For travelers: slow down, verify independently, and remember that your urgency is exactly what scammers exploit.