New TSA PreCheck Scam Hitting Travelers This Year. Here's How to Avoid It

Scammers are smart, so we need to be smarter.

Once an obscure program, TSA PreCheck has gained a lot of popularity due to travel rewards credit cards that offer credits for signing up. Unfortunately, that popularity has a downside: scammers.

Just in time for holiday travel, scammers have started targeting travelers with phishing emails and fraudulent websites aimed at TSA PreCheck renewals. The goal is to get both the renewal fee and your personal information for potential future fraud.

We talked to former FBI analyst Crane Hassold, who now works as the Director of Threat Intelligence at Abnormal Security, for more information about how to spot these scams and what to do if you find yourself the target of one.

Detecting TSA PreCheck scams can be tough

Perhaps the most troubling part of these new scams is that they're so detailed. Hassold says scammers have taken a lot of time and effort to make accurate fakes that closely mimic authentic TSA emails and websites. This can make it hard to tell if you have a legitimate website or a fraudulent one.

"Unlike other scams we see every day, these TSA PreCheck scam emails are actually quite sophisticated," said Hassold. "The normal red flags we tell people to look out for aren't really there."

On the plus side, Hassold says there are still things you can look for to decide if you're taking the bait of a scammer. The most obvious will be the email address of the sender. You should also watch out for payment requests that seem off.

"Actual emails from the TSA will be sent from a .gov email address, while these scam emails are sent from a .com address," said Hassold. "Also, official payments for government services can generally be made using a variety of methods, but the only payment method for the 'application fees' requested in the scam is PayPal."

Since the TSA is a part of the Department of Homeland Security (DHS), you may also get emails or notifications from DHS. These should also have the .gov address.

Use a trusted search engine to find direct links

Given how hard it can be to tell a fraudulent email from a legitimate one, the best advice is to avoid using in-email links to access your account. Instead, use a trusted search engine to go directly to the TSA or DHS website.

As with TSA email addresses, the official website will have a .gov domain, rather than a .com or .org. You should also look for the lock icon near the website bar in your browser to ensure you're on a secure website.

Once you click on the Apply or Renew links on the TSA website, you're taken to the Universal Enroll page. This is a part of the DHS website and should contain the DHS.gov domain.

Report account fraud to the police and the FTC

Despite your best efforts, you still may wind up the victim of one of these sophisticated scams. When asked about what to do if you suspect a scam, Hassold agrees with the advice from the TSA that you should follow these steps:

1. Report the fraud to your local police department
2. File a report with the Federal Trade Commission website (ReportFraud.ftc.gov)
3. Alert your credit card issuer or bank about the fraudulent charge

That last step is especially important if you want to get your money back. The TSA website specifically says that the TSA isn't responsible for reimbursing anyone who attempts to enroll or renew a TSA PreCheck account through a fraudulent website.

Scammers may be getting smarter, but there are still things we can do to stymie their efforts. With a little extra vigilance, you can avoid becoming a victim of fraud this holiday season.