It's okay to outsource, but if you put your brand on something, you're taking responsibility for what that something does. If a Flying Blue branded website scams people the way OP described, it's Flying Blue that takes the negative image hit, not some no-name company that operates it.