Loading story…
Finland’s National Cyber Security Centre warned that phishing campaigns targeting hotel reservations are abusing Booking.com and related accommodation services with messages that look legitimate because they contain real booking details. Victims have received messages shortly after making reservations, sometimes through Booking.com’s own messaging channel and sometimes via WhatsApp, with references to genuine hotel names, customer identities, and actual reservation information. The messages often begin as routine confirmations before claiming there is a problem with the booking, identity verification, or payment card.
The fraudulent messages direct travelers to spoofed websites designed to mimic hotel or booking pages and steal payment-card data. Finnish authorities said the accuracy of the information strongly suggests attackers obtained access to hotel or reservation accounts, likely through phishing or other account compromise, allowing them to view reservation records and in some cases prior conversation history. Officials said similar incidents have been reported for years, with a notable rise in reported cases, and advised customers to verify any payment or identity requests through independent contact channels with the hotel or booking provider.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On April 17, 2025, Finland's National Cyber Security Centre advised users to verify suspicious reservation messages through independent contact channels with the booking service or accommodation provider. The warning followed continued phishing campaigns leveraging compromised hotel account access.
In spring 2025, multiple phishing incidents abused hotel reservation services, especially bookings made through Booking.com. Victims were contacted soon after booking via WhatsApp or Booking.com's messaging platform with convincing messages that used authentic reservation details and sought payment card information.
Finland's National Cyber Security Centre assessed that compromises affecting hotel reservation services continued after the start of 2025. The growing accuracy of reservation details in phishing messages suggested ongoing breaches of hotel or booking-service accounts.
Finland's National Cyber Security Centre said it had received earlier sporadic notifications about phishing incidents involving Booking.com reservations before the surge seen later in 2023. The scams used real booking details and directed victims to spoofed payment pages.
Several cases affecting Finnish customers were reported in August 2023, marking an increase from earlier sporadic reports. Fraudulent messages were sent through Booking.com's legitimate messaging channel and attempted to steal payment card data.
Ars Technica reported on phishing messages targeting Booking.com users in February 2023. The messages appeared credible and were tied to genuine reservation details, indicating attackers had access to hotel booking information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
National CERT teams in Croatia and Slovenia warned that attackers are using stolen accommodation reservation data to run highly convincing phishing campaigns impersonating **Booking.com** and lodging providers. The messages, often sent from foreign phone numbers over **WhatsApp** and sometimes via **Viber** or SMS, cite real guest names, phone numbers, stay dates, and booking details to claim there is a payment problem or reservation issue, then direct victims to fraudulent websites designed to capture bank card information or induce unauthorized payments. The warnings follow confirmed security incidents involving **Booking.com** and the Croatian hotel reservation provider **Phobs**, whose systems exposed personal, contact, and reservation data used by accommodation providers across the region. Booking.com said unauthorized parties accessed some users’ reservation information but not home addresses or payment card numbers, while SI-CERT said there is no indication financial data was stolen from Phobs; however, both incidents created enough context for realistic social engineering. CERT authorities urged travelers to verify any payment request only through Booking.com’s official app or website or by contacting the accommodation provider through an independent channel, and advised anyone who submitted card data to notify their bank immediately and report financial theft to police.
Jul 24, 2026Gen Threat Labs reported that **more than 350 accommodations in 50 countries** were tied to "Reservation Hijack" scams that used real booking details to target travelers with convincing phishing messages. The campaigns delivered fraudulent payment requests through **SMS, WhatsApp, email, and in-app messages**, directing victims to fake accommodation-branded payment pages. Researchers said the activity appeared organized and repeatable, citing shared phishing-page components, repeated asset paths, fake live-support chat features, and common card-validation language across multiple incidents. The findings followed **Booking.com** warnings to customers that unauthorized parties may have accessed reservation-linked information and reset reservation PINs, indicating exposure of private booking data that could be used to personalize scams. Gen said the largest concentration of affected properties was in Europe—especially **Germany, France, the United Kingdom, Italy, and Spain**—but the activity also reached the **United States** and other regions. The company urged travelers to verify payment requests only through official booking channels, while accommodations were advised to strengthen **MFA**, account monitoring, endpoint protection, and staff phishing awareness.
Jun 29, 2026
Attackers are exploiting hotel reservation systems and booking workflows in a fraud campaign dubbed the **Reservation Hijack Scam**, using stolen reservation details and compromised staff accounts to contact real travelers through trusted channels including Booking.com messaging, email, SMS, and WhatsApp. Researchers said the scam is especially effective because messages arrive in legitimate conversation threads or from authentic hotel accounts, making fake payment requests appear to be routine customer service. Victims are then directed to spoofed guest portals, branded PDFs, or typo-squatted payment sites designed to steal card details or induce bank transfers. In more advanced intrusions, attackers first phish hotel employees for credentials to hospitality platforms such as **Cloudbeds**, or gain persistent access by tricking partners into running malicious commands that deploy a remote access trojan. Cloudbeds said observed cases were caused by credential phishing rather than a breach of its platform. The activity has been reported most heavily in the **UK, France, Germany, the US, Brazil, and Australia**, prompting recommendations that travelers verify payment requests only through official hotel or booking channels, while hospitality organizations strengthen phishing-resistant authentication, access controls, monitoring, and incident response.
Jun 29, 2026