A traveler who has booked a real hotel can receive a fraudulent request containing the correct arrival date and reservation number. Criminals can use those details to demand payment information, warning that the room will otherwise be canceled.

Complete the form to unlock this article and enjoy unlimited free access to all PYMNTS content — no additional logins required.

The European Commission’s Booking.com investigation, announced Wednesday (Oct. 21) and reported by PYMNTS, took note of the arrangements through which such scams can reach guests. Regulators are reviewing reservation-data sharing with accommodation providers and the platform’s messaging service, alongside fraudulent listings and advertising transparency. No wrongdoing has been established. Booking.com said it’s cooperating and prioritizes security and personal information protection.

The exposure extends across what might be thought of as the “supply chain” of the businesses involved in fulfilling a reservation. Platforms feed data to hotels, tied to guest information, employees access partner accounts, and customers expect further instructions about their stays. Unauthorized access at the provider level can supply information used to make a subsequent payment request convincing.

Bridewell, a cybersecurity firm, described that sequence earlier this year. Attackers targeted hotel employees with fraudulent messages and imitation login pages. After obtaining partner-account credentials, they accessed customer names and booking information through the reservation platform.

Travelers subsequently received WhatsApp messages containing accurate reservation details and warnings that their bookings would disappear within 24 hours. Links directed them toward pages impersonating the booking service. The approach exploited information from a legitimate commercial relationship to solicit a response through a separate communication channel.

Source link