← All detection heuristics · Social Engineering
high
SE_TRAVEL_SUPPORT_PHONE_SCAM
What it means
Document repeats phone numbers in airline, travel, refund, or support-scam wording.
Why it fires
Travel-support scam PDFs use repeated phone numbers and airline/refund/support phrases to rank in search results and route victims to attacker-controlled call centers. The rule requires multiple phone hits plus travel/support terminology and repeated call-language stuffing. A single phone number in an itinerary or invoice does not satisfy these conditions.
Other Social Engineering heuristics
SE_BOOKING_COMPLAINT_PHISH PDF_FAKE_DOCUMENT_COMPONENT_INSTALLER OOXML_QR_CREDENTIAL_PHISH SE_CALLBACK_SCAM_TEMPLATE PDF_BRAND_ACCOUNT_UPDATE_REDIRECT_LURE PDF_IMAGE_REPEATED_DECOY_REDIRECT_LURE PDF_IMAGE_DOCUMENT_REVIEW_HOST_LURE PDF_LOCALIZED_DOWNLOAD_HOSTING_LURE PDF_MINIMAL_VIEW_DOCUMENT_REDIRECT PDF_NESTED_ENCODED_CROSSHOST_REDIRECT PDF_RFP_EXTERNAL_ACTION_LURE PDF_UTILITY_REFUND_OFFDOMAIN_LURE PDF_SPARSE_MOVED_ARTICLE_DOORWAY