Hotel Booking Scams Rise: Phishing Attacks Target Guests and Staff

Recent reports indicate a surge in sophisticated phishing attacks targeting individuals who have booked accommodations through online platforms like Booking.com and Expedia, as well as hotel staff. These attacks exploit stolen guest data and leverage a deep understanding of hospitality workflows to steal credentials and financial information.

The Growing Threat Landscape

Cybercriminals are increasingly focusing on the hospitality industry due to the constant handling of sensitive guest data. A recent campaign, discovered by Mimecast’s Threat Research Team, involves highly convincing phishing emails designed to prompt immediate action from hotel managers and staff . These emails often mimic legitimate communications regarding tracking alerts, system updates, or booking confirmations.

How the Scams Function

One common tactic involves attackers gaining access to booking data – potentially through data breaches or vulnerabilities in third-party booking systems – and then using this information to craft highly targeted phishing messages. A recent case involved a traveler who received a WhatsApp message, purportedly from a corporate account, requesting credit card verification shortly after booking a hotel through onepagebooking.com . The message contained the traveler’s correct booking information, adding to its credibility.

The landing pages used in these scams are often meticulously designed to mimic legitimate websites, even displaying the correct booking details and logos. These pages then prompt users to enter their debit or credit card information, giving attackers complete access to their financial data.

Data Breaches Fuel the Attacks

The availability of stolen data from previous breaches plays a significant role in these attacks. Data from Booking.com and similar sites is being sold in bulk on the dark web, enabling cybercriminals to launch large-scale phishing campaigns . Major hotel chains like Marriott and Hilton have previously experienced data breaches affecting sensitive customer information .

Protecting Yourself and Your Business

• Be wary of unsolicited communications: Exercise caution with unexpected emails or messages requesting personal or financial information, even if they appear legitimate.
• Verify requests directly: If you receive a suspicious request, contact the hotel or booking platform directly using a known phone number or website.
• Check for website security: Before entering any sensitive information online, ensure the website uses HTTPS (glance for the padlock icon in the address bar).
• Use strong, unique passwords: Employ strong, unique passwords for all your online accounts and enable multi-factor authentication whenever possible.
• Report suspicious activity: Report any suspected phishing attempts to the relevant authorities and the affected company.

Resources for Checking Data Breaches

You can check if your email address has been exposed in a data breach using websites like Have I Been Pwned.

Looking Ahead

As cybercriminals continue to refine their tactics, it’s crucial for both travelers and hospitality businesses to remain vigilant. Strengthening security measures, educating staff, and promoting awareness among guests are essential steps in mitigating the risk of these increasingly sophisticated phishing attacks.