Booking Accommodation? NASK Advises How Not to Fall Victim to Scams

The travel season increasingly marks the beginning of… a phishing attack. Cybercriminals are impersonating popular booking platforms, such as Booking.com, taking over accommodation accounts, and sending fraudulent messages about surcharges, booking freezes, or the need to “confirm payment.” Their goal is to trick users into divulging credit card details and login credentials. Cybersecurity experts at NASK and CERT Polska are issuing strong warnings that the scale of “Booking-related” scams is on the rise. Here’s what you need to know to stay safe.

Cybersecurity Experts Warn of Surging “Booking” Scams

NASK, a leading cybersecurity research and development institution, in its latest communication, directly warns against a dynamically growing campaign. Cybercriminals are leveraging the popularity of Booking.com to extort money and personal data from travelers. They target both individuals making reservations and property owners, relying on the trust placed in a well-known brand and the time pressure travelers often face just before their trip. The holiday season, much like other busy online periods, has become a prime target for cybercriminals, who constantly adapt their tactics, from deceptive social media ads to sophisticated phishing campaigns. According to experts from NASK and CERT Polska, the scam typically follows a similar pattern: victims receive a message alleging an issue with their reservation – a block, a required surcharge, additional payment verification, or a threat of cancellation. The message includes a link leading to a website that strikingly resembles the official Booking.com service but operates under a different domain or contains subtle typos in its address. It is on these fake sites that users are prompted to enter their login details or credit card information.

Common “Booking” Scam Scenarios

Cybercriminals employ various methods to trick their victims. Understanding these common scenarios is crucial for effective protection.

Scenario 1: Classic Phishing via Email or SMS

The first frequently observed scenario is classic phishing: an email or SMS warning that a reservation will be canceled if the user doesn’t immediately confirm payment or update their details. The link provided leads to a counterfeit website that is visually almost indistinguishable from the genuine Booking.com. However, the web address is altered, and the form is designed to harvest logins and card details, which then fall into the hands of criminals.

Scenario 2: Compromised Accommodation Accounts

This scheme is more sophisticated as it involves cybercriminals first gaining unauthorized access to a host’s or accommodation property’s account within the reservation system. Once logged into a legitimate account, they contact guests directly through the platform, requesting additional payments, a change in payment method, or a “re-authorization of the card,” often via an external payment gateway. Victims feel they are communicating with the actual hotel because they see their reservation history and genuine stay details, making the scam highly convincing.

Scenario 3: Deceptive Offers on Real Platforms

The third variant involves fraudulent or highly misleading offers posted on actual reservation platforms. In these cases, criminals exploit attractive pricing and loopholes in terms and conditions, hoping users will transfer a deposit via bank transfer, cryptocurrency, or to a private account outside the official system. Once the money reaches the scammer, all contact ceases, leaving the traveler without accommodation upon arrival.

Data Breach and the New Wave of Phishing

The problem of “Booking-related” scams intensified following a recent security incident where cybercriminals gained access to data belonging to some users and service partners. Information from Booking.com and analyses by independent security firms indicate that the attack was primarily carried out through hotel partners and intermediaries. The stolen information included email addresses, phone numbers, and booking details. While the platform assures that credit card data and financial information remained encrypted and were not compromised, the mere possession of genuine reservation details allows scammers to craft incredibly credible messages. Victims receive emails or in-app messages containing correct stay dates, hotel names, or guest numbers. This accuracy further lowers their vigilance and makes it challenging to distinguish between a scam and legitimate system correspondence.

Why These Scams Work

“Booking-related” scams leverage several well-known psychological mechanisms: time pressure, fear of losing a reservation, pre-travel uncertainty, and the automated behaviors of users accustomed to quick mobile transactions. Messages like “confirm payment immediately,” “your reservation will be canceled,” or “you’ll lose your discount shortly” are designed to prompt users to click a link and provide data without thoroughly checking the address or sender. “Vacations are a harvest season not only for farmers but also for cybercriminals. Booking accommodation should be the start of a successful rest, not lead to stress and financial loss. Unfortunately, during the holiday season, scammers exploit haste and emotions to persuade users to provide their data or make a transfer. Therefore, it’s worth remembering a basic rule: pause for a moment and thoroughly check which website and entity you are dealing with. A few minutes of caution can protect us from losing money, but also from more serious consequences, such as data theft.”
— Iwona Prószyńska, Head of the Strategic Cybersecurity Communication Team at NASK Additionally, many users access Booking.com and other reservation platforms on the go – on public transport, at the airport, or between meetings – which encourages hasty decisions. When faced with a legitimate-looking login screen or payment window, it’s easy to overlook subtle differences in the website address or minor linguistic errors that would normally raise suspicions. Always be vigilant, not just against phishing but also against other threats like mobile malware that can compromise your device and data.

How to Protect Yourself

Experts from NASK and CERT Polska emphasize that effective defense against “Booking-related” scams begins with a simple principle: stay calm, be vigilant, and exercise limited trust in links received in messages.

• Verify Directly: If a message indicates a problem with your reservation or payment, always log into the service independently by typing the official address directly into your browser or using the official app, rather than clicking on a provided link.
• Official Payment Channels Only: Never make payments for a reservation outside the platform’s official system. A request to transfer money to a private account, in cryptocurrencies, or via an unusually generic payment gateway should immediately raise a red flag.
• Contact Directly: In case of any doubt, it’s best to contact the hotel or property directly using the phone number or email address provided on their official website and in your original reservation confirmation. Do not use contact details provided in suspicious messages.

Source: NASK, Cyberrescue. Opening photo: Gemini

About Post Author