An old deception returns in a new form. They send out job offers and tempt people with high salaries

Criminals hacked into hoteliers’ accounts and sent requests to their customers to provide additional information for the reservation, to repeat payments or to authorize a payment card. Now the scam is back, but in a completely new version.

Scammers are impersonating Booking.com again. They promise easy money

ESET cybersecurity experts have just detected another wave of SMS scams impersonating the Booking.com platform. Instead of threatening to cancel your reservation, they tempt you with high earnings and easy and pleasant work. In this way, they look for people who want to earn extra money after hours, but their real goal is, of course, to steal money.

“Our company recruits remote workers for hotels around the world, so you can flexibly plan your work and only take 30-50 minutes a day. The work content mainly includes simple booking tasks, increasing customer flow and being relaxed and happy,” we read in the content of the SMS published by ESET experts. Criminals impersonate mainly Booking.com, but also well-known hotel chains, including: Hilton, Four Seasons, Accor and Marriot.

If the recipient of the text message takes the bait and responds to the message, the scammer (or perhaps a bot) begins to explain what the job is and encourages them to take part in the recruitment process. The victim’s alleged task is to “place orders for major hotel platforms” cooperating with Booking.com. In exchange for approximately 30-50 minutes of work a day, she will receive from PLN 400 to PLN 2,500 each day.

Then comes the request. As always, it’s about money

Then, the fraud victim receives a link to a platform impersonating Booking.com, where he or she is to set up an employee account. It quickly turns out that to start “work” you need to transfer approximately PLN 160 in the Tether cryptocurrency. “The fraud comes down to extorting a payment in the USDT (Tether) cryptocurrency from the victim. After a long conversation with the bot, a request appears to transfer 40 USDT, which is the equivalent of approximately PLN 160. This money would be irretrievably lost, and at further stages of the fraud it would probably appear demands for larger amounts that should be transferred in order to allegedly earn even more,” says Kamil Sadkowski, an analyst at the ESET anti-virus laboratory.

Fortunately, fraud is easy to detect due to frequent linguistic errors and the unreliable appearance of the fraudsters’ website. It is also worth noting that trusted companies do not look for casual workers through SMS spam and do not demand payments in cryptocurrencies from candidates.

“The intrigue is suspicious and sewn from the very beginning. Any such unrealistic promises should raise suspicions. Additionally, the bot’s messages contain linguistic errors. In turn, the fake platform built by cybercriminals does not look very reliable, but uses the graphic identification of well-known hotel brands. It protects against fraud also the current ESET antivirus package, which quickly identified and blocked the website used by fraudsters as phishing,” writes Kamil Sadkowski later in the comment.