Fraud Markets Are Now Selling Trips to Consumers

We bought a flight from a fraud marketplace to see whether it would actually fly.

For $52 in cryptocurrency, a Telegram vendor who calls himself QOBIZ Online sold us a Miami-area itinerary at half off. We sent him a Google Flights link, a passenger name, and a date of birth. A few hours later — after his first attempt on a JetBlue booking threw errors and he switched carriers — he sent back a confirmed reservation, live inside the airline’s own system, in the name we had given him.

That small purchase marks a change in who these fraud markets sell to. Telegram’s fraud channels used to be wholesale operations: fraudsters selling raw materials — stolen card numbers, hijacked logins, step-by-step “methods” — to other fraudsters. Increasingly, they sell retail, delivering finished products to ordinary buyers who may never realize what they bought. It’s the guy selling watches off a tarp on Canal Street — except the tarp is a chat thread, and buying from it feels a lot like the “conversational commerce” ordinary shoppers are already growing used to. And it can reach almost anyone: Telegram is a mainstream app now, with more than a billion monthly users, roughly 87 million of them in the United States. That kind of in-chat buying hit $11.3 billion in 2025 and is projected to roughly double within five years. A black-market travel agent is now a few taps away from the everyday bargain-hunter.

We can’t say for certain how QOBIZ obtained our seat. But everything we saw carries the earmarks of fraud as law enforcement defines it — starting with a discount so steep that Interpol treats it as a near-certain sign of a stolen ticket. This is the story of how one of these markets works, what it was like to buy from it, and what the evidence suggests was really going on.

The marketplace

QOBIZ runs a storefront that markets deeply discounted travel to the general public. His Telegram channel, “Flights booking Hotels discounts,” advertises a standing offer — “EVERYTHING 50% OFF,” “100% Safe & Secure,” “Order Now — DM Fast!” — over a large library of photos and videos used as sales material. It reads less like a criminal forum than a discount travel agency.

The channel’s storefront, as displayed on Telegram.

A few facts about the operation. The channel became a Telegram “supergroup” — a small chat upgraded into a large, scalable community — on December 9, 2025. We tracked it as part of our routine monitoring of channels that trade in illicit goods, collecting its public activity between February 18 and June 1, 2026: 283 text posts of ads, booking confirmations, customer testimonials, and proof-of-service screenshots. By then, the group listed more than 140,000 members, though Telegram membership inflates easily, and the actual posting came from far fewer accounts.

Flights are the core product, but they’re only the entry point. Sorting the travel-related posts in our dataset shows how broad the counter has become:

*Mention defined as use of a specific airline company, hotel, or other travel-related product or service.

The advertised bookings run from budget domestic flights to itineraries topping $2,000, on brand-name platforms throughout — Southwest, JetBlue, Frontier, and American; Agoda, Booking.com, Expedia, Priceline — and beyond travel entirely, down to grocery delivery and bill payments.

How he earns trust without a name

A marketplace like this faces a selling problem that legitimate businesses don’t. It offers none of the protections that make people comfortable buying online — no credit-card chargeback, no PayPal dispute, no company to look up, no Google or Yelp reviews, no recourse at all if the deal goes bad. But it also can’t lean on the trust machinery of the traditional dark web — escrow services, long-running forum reputations — because its customers aren’t criminals who know that world. They’re ordinary shoppers chasing a deal. So what’s a fraudster to do?

His answer is to put a track record on display. He floods the channel with screenshots and videos of supposedly completed orders, captioned with their value and speed — “$1900+ Southwest done same day,” “$1500+ New York Hotel done smoothly,” “$1200+ Airbnb done” — surrounded by customer “vouches” and “+Rep” endorsements that stand in for the star ratings of a real marketplace, complete with vacation photos from his buyers. A prospective buyer has no way to check any of it.

Proof-of-service post showing completed flight booking.

Proof-of-service post showing completed hotel booking.

He also takes the risk off the buyer. Many posts advertise a “No Upfront Payment Required” policy, letting a customer see the booking before sending money he could never claw back — the strongest possible answer to the fear of being scammed. And he keeps the crime out of frame: the pitch is always vacations, Disney trips, and half-price luxury travel, never “I have stolen access.” The customer is invited to think about the trip, not where the discount comes from.

Buying a ticket

Advertising can be staged, so the only real test was to place an order. We kept it deliberately small — a $52 flight — and never used what he sent, to limit both the money reaching a presumptive criminal and any harm from a fraudulent booking.

We approached him as a buyer wanting a cheap flight from Washington, D.C. to the Miami area. He sent back a standardized intake form asking for the itinerary, passenger name, and date of birth, and listed the ways he’d take payment: Zelle, Cash App, or Bitcoin. He quoted 50 percent off.

What happened next didn’t look like a scam: The vendor behaved like a customer-service rep working a difficult order. He stayed in contact for hours, reported that the first airline's itinerary was returning errors, asked for an alternative, switched carriers, and ultimately delivered a confirmed reservation on a different airline in the name we’d supplied, with a checked bag included, as a PDF over Telegram.

Delivery of the flight booking over private message.

The reservation behaved like a real one. He sent screenshots from the airline's booking portal showing a valid confirmation code, our passenger’s details, a June 2026 departure, and a Washington Dulles–to–Fort Lauderdale routing that lived inside Frontier’s system rather than as a standalone document. The passenger data matched exactly what we’d given him, which means the booking was created for our request, not recycled from an old one. Days later, it went a step further: a fully formed boarding pass landed in our inbox by email — a real seat, a boarding group, a scannable barcode. We never used it, but as far as the airline was concerned, a passenger we had invented was cleared to fly. We never boarded, so we can’t swear the plane would have carried our made-up traveler to Florida — but by every indication short of the jet bridge, it would have.

So what did we actually buy?

The most revealing screenshot was the airline’s own payment screen. It showed the ticket had been paid for with a Visa card that was neither ours nor our passenger’s, for $115.97 — while we had paid the vendor $52 in cryptocurrency, separately. In other words, the real fare went onto a valid payment card, and we handed QOBIZ roughly half of it in crypto for the service of arranging that.

This is the closest our evidence comes to the mechanism, and it fits what investigators would expect. No legitimate seller could sustain a half-price fare: airlines net only about $7 per passenger, a margin near 3.6 percent, according to the International Air Transport Association. The math only works when the inventory costs the seller nothing — a ticket bought on a stolen card, a room booked with hijacked loyalty points, a seat purchased through a compromised account or a synthetic identity, or a trip taken and then charged back. A payment on a card that isn’t yours is the signature of the first and most common of those methods.

We can’t prove fraud outright, and we can't know for certain the provenance of the payment card used to make the purchase. We didn’t fly the ticket, and our evidence is the vendor’s own screenshots. But a steep discount, an anonymous seller paid in crypto, and a booking charged to someone else’s card together bear the hallmarks of stolen-card fraud as law enforcement describes it. What we can say plainly — and what we have since shared with law enforcement — is that the vendor took an inquiry, moved it through payment to a working reservation, and delivered, which, in these markets, is the whole value proposition.

Then he did one more thing. Shortly after our booking cleared, QOBIZ reposted it in his channel — our reservation, wrapped in fresh promotional language for discounted flights, hotels, and Airbnb stays. Having sold us the ticket, he upcycled us into the sales pitch for the next customer. The track record he advertises is impossible for any buyer to verify — but we can confirm that at least one entry on it was real. It was ours.

Our completed reservation, reposted by the vendor as an advertisement.