Fake airline flight refund / EU261 compensation phishing — non-airline sender impersonates Delta, United, Southwest, Ryanair, or a flight compensation service claiming an approved refund or EU261 delay compensation that requires the recipient to submit bank account or credit card details within a short deadline to receive the payment

Phishing emails impersonating airlines (Delta, United, Southwest, Ryanair, EasyJet, British Airways, etc.) or third-party "EU261 compensation claim" services, claiming the recipient is owed a flight delay or cancellation refund/compensation and requiring bank account details, credit card numbers, or routing numbers to process the transfer — with urgency framing ("claim expires in 48 hours," "unclaimed compensation will be forfeited"). Real airline refund portals automatically credit back to the original payment method and never request financial credentials by email. Two variants: (1) Direct airline impersonation — fake email from "[airline]-refunds.net" or "flightclaim-portal.com" claiming to hold an approved compensation amount; (2) EU261 aggregator impersonation — fake "flight compensation service" leveraging the legitimate EU passenger rights regulation to add credibility. Key facts: (1) EU261/2004 is a real regulation entitling passengers to up to €600 per delayed/cancelled flight — scammers exploit awareness of this regulation; (2) Legitimate flight compensation claim services (AirHelp, ClaimCompass) do NOT request bank credentials by email — they collect details through secure portals after identity verification; (3) The FTC has specifically warned against these scam sites which also charge a "processing fee" (typically $30–$75) before disappearing. Warning signs: email from non-airline domain, urgency to submit financial details, "unclaimed funds will be forfeited" framing.