Another fraud on Booking. The scam targets hoteliers, but the real target is travelers

It is often said to be wary of too attractive accommodation offers offered on platforms such as Booking.com, but this time the fraudsters are targeting hoteliers, not travelers. However, this is only an appearance, because the whole procedure is more complicated. It only takes a moment of inattention to lose money.

More scams on Booking.com. A complex scam that preys on inattention

The Computer Security Incident Response Team of the Polish Financial Supervision Authority (CSIRT KNF) is warning against fraud on the X portal by publishing an example of such a scam. As experts write, “criminals use phishing by sending malicious software (stealer) as an attachment to obtain Booking login details and then steal funds from hotel customers.”

The fraud scheme is simple. Criminals initially target owners of hotels, hostels or apartments by sending them e-mails with fake booking inquiries. However, the messages contain malware intended to steal login details to the Booking.com platform.

Then the hotel customers themselves become the target of fraudsters. Cybercriminals create fake offers and crafted websites, which they then send to hotel customers. Most often – writing from compromised accounts on the platform – they ask you to reconfirm your credit card details using a link to a fake website pretending to be Booking.com. A moment of inattention and we can lose money.

Experts from CSIRT KNF advise hotel owners and employees to be careful when opening attachments sent by e-mail and to use two-factor authentication when logging in. Customers of hotels booked through popular platforms should also be vigilant.

This is not the first time this type of scam has occurred, involving the takeover of accounts belonging to hoteliers. Such fraud was difficult to detect because cybercriminals could have information about the reservation, including – perhaps most importantly – the amount needed to pay. Only after some time (or after reaching the destination) it could turn out that the hotel stay had not been paid for at all.