Attackers Exploit Hotel Booking Systems to Defraud Guests

Key Takeaways

• A sophisticated fraud scheme is targeting hotel guests by exploiting legitimate booking systems and communication channels.
• Attackers use stolen reservation details to send highly convincing fake payment requests via platforms like WhatsApp, SMS, email, and Booking.com.
• The scam, dubbed “Reservation Hijack Scam” by Gen Digital researchers, involves either booking platform lures or direct compromise of hotel management software like Cloudbeds.
• Victims are redirected to malicious, typo-squatted domains designed to steal credit card information and bank transfer details.
• The primary affected regions include the UK, France, Germany, the US, Brazil, and Australia.

Attackers Leverage Hotel Booking Systems to Defraud Guests Globally

Travelers worldwide are increasingly becoming targets of an elaborate fraud operation that weaponizes their own hotel reservations. Cybercriminals are infiltrating trusted hotel booking processes and utilizing official communication platforms to send guests highly credible, yet fraudulent, payment demands. This tactic frequently catches victims off guard due to its deceptive authenticity, as detailed in recent research into this scam.

The fraudulent activity typically commences with a message, often via WhatsApp, seemingly originating from a hotel’s Guest Relations department. These messages contain accurate details about the guest’s upcoming stay and request payment verification prior to arrival.

Because these communications incorporate precise trip information—such as the hotel name, dates of stay, and sometimes the exact amount due—they often appear to be standard pre-arrival notifications rather than malicious attempts.

This illusion of normalcy is central to the scam’s effectiveness. Attackers do not require sophisticated language or advanced tools; they merely need sufficient authentic context to make their fraudulent requests indistinguishable from legitimate customer service interactions. This scheme was thoroughly investigated and documented by analysts and researchers at Gen Digital, with their findings published on March 25, 2026.

Researchers Martin Chlumecký and Luis Corrons coined the term “Reservation Hijack Scam” to describe this threat. They emphasize that it extends beyond simple phishing with a travel theme, representing a comprehensive workflow attack built upon stolen context and exploited trust. The highest concentration of observed incidents has been noted across the United Kingdom, France, Germany, the United States, Brazil, and Australia.

The scam operates through two primary avenues. The first involves booking-platform lures, where victims receive messages via WhatsApp, SMS, email, or Booking.com’s internal messaging system. These messages, purporting to be from hotel staff, direct guests to fraudulent payment portals.

The second, more insidious approach, involves attackers directly compromising hotel-side software platforms. This includes systems like Cloudbeds, a widely adopted hospitality management system. Compromise is typically achieved by phishing hotel employees to steal their login credentials.

Once inside these systems, attackers gain access to genuine reservation data and can leverage the hotel’s legitimate communication tools to message guests. This makes distinguishing the fraudulent messages from authentic hotel interactions nearly impossible.

How Attackers Compromise Hotel Systems From the Inside

The compromise of hotel software systems represents a significant escalation in this scam. After acquiring staff credentials through deceptive login pages, attackers log into actual hotel management environments. This grants them full visibility into upcoming reservations, including guest names, contact information, stay dates, and payment specifics.

In some instances, attackers employed what researchers termed a “Scam-Yourself Attack Tactic.” This involved tricking hotel partners into executing a malicious command disguised as a mandatory security update. This command installed a remote access trojan, providing the attackers with persistent access to the system.

With this established access, the attackers could then dispatch fraudulent payment requests directly through legitimate hotel or booking-linked accounts—channels that guests already trust for their reservations. Documented cases show victims receiving professionally designed PDF documents impersonating hotel groups, often with urgent payment deadlines of 24 to 48 hours.

Some of these fraudulent PDFs were hosted on legitimate, but compromised, partner storage platforms, adding another layer of false credibility. These documents would then redirect victims to typo-squatted domains—such as frontdesk-reservation[.]com, frontdesk-online[.]biz, and hotel.form842987[.]digital—specifically designed to harvest credit card numbers and bank transfer details.

What You Should Do

• Verify Directly: If you receive any message from a hotel requesting payment verification or re-entry of details, do not click on any links provided. Instead, navigate directly to the hotel’s official website or the original booking platform through your browser.
• Contact Your Bank Immediately: If you have already submitted payment information to a suspicious link, contact your bank or credit card provider without delay. Cancel the affected card and enable transaction alerts to monitor for unauthorized activity.
• Stay Alert for Follow-on Fraud: Be vigilant for subsequent fraud attempts in the days and weeks following a potential compromise, as your personal information may have been exposed.
• Hotels: Implement Strong Authentication: Hospitality businesses must prioritize the security of their guest communication tools. Implement phishing-resistant multi-factor authentication (MFA) for all employees, especially those with access to reservation systems.
• Enhance Access Controls: Strengthen access controls around reservation data exports and monitor messaging workflows for unusual activity.
• Develop Incident Response Plans: Establish and regularly practice swift incident response plans to address potential compromises effectively. Smaller properties, often resource-constrained, should prioritize MFA to prevent credential theft.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.