Hackers Exploit Hotel Booking Systems to Send Fake Payment Requests to Guests

Hackers are increasingly targeting hotel booking workflows to trick travelers into handing over payment details, using a technique that blends real reservation data with convincing social engineering.

The message references real booking details such as the hotel name, stay dates, or payment status making it appear legitimate. Instead of raising suspicion, the message feels like a routine pre-arrival check.

This is what security researchers describe as a “Reservation Hijack Scam.” Unlike traditional phishing, which relies on generic lures, this attack leverages real booking context to build trust.

The attacker doesn’t need sophisticated malware or perfect grammar just enough accurate information to make the request seem credible.

In more advanced cases, attackers move beyond simple impersonation. By phishing hotel staff or partners, they steal login credentials to hospitality platforms such as booking management systems.

According to the report, The scam often begins innocently. A traveler who booked a hotel days or weeks earlier receives a WhatsApp or SMS message claiming to be from the hotel’s guest relations team.

This allows them to access real reservations, guest contact details, and sometimes even payment information.

Once inside, attackers can send messages directly through legitimate hotel or booking platform accounts.

For example, a victim may receive a fraudulent payment request داخل an actual Booking.com conversation thread or hotel messaging system. Because the message comes from a trusted channel, detection becomes significantly harder.

This shift from spoofing identities to abusing real systems is what makes the threat particularly dangerous.

How the Scam Works

The attack typically follows a clear pattern:

• Initial compromise: Attackers phish hotel staff or partners, often באמצעות fake login pages or malicious “security updates,” to steal credentials.
• Data access: They gain visibility into real reservations, including guest names, dates, and contact details.
• Targeted outreach: Victims receive personalized messages via WhatsApp, SMS, email, or booking platform chats.
• Payment redirection: The message pushes users to a fake payment page, guest portal, or PDF link দাবিing urgent verification within 24–48 hours.
• Financial theft: Victims enter card details or approve payments, which attackers then exploit or resell.

In some campaigns, victims are routed through multiple layers such as branded PDFs or typo-squatted domains to increase credibility and evade detection.

Researchers have observed high activity across the United Kingdom, France, Germany, the United States, Brazil, and Australia.

The scam is not tied to a single platform; instead, it operates across multiple communication channels, including Booking.com messaging, WhatsApp, SMS, and email.

This flexibility allows attackers to adapt quickly, targeting travelers wherever they are most likely to respond.

Why It Works

Traditional phishing often fails because it lacks context. In contrast, Reservation Hijack scams reflect real-world details back to the victim. When a message includes accurate booking information, it feels like customer service rather than fraud.

PDFs pushed “payment verification” within 48 hours, using generic branding, urgency, and a prominent call to action to move the victim toward the real theft stage. 

Attackers also create urgency typically demanding action within 24 or 48 hours reducing the chance that victims will verify the request.

For travelers, the key risk is misplaced trust. Even messages that appear in legitimate booking threads or reference real reservations can be malicious.

Users should avoid clicking links in unsolicited messages and instead verify requests through official apps or websites.

For hotels and hospitality providers, the threat highlights a deeper issue: operational systems are now part of the attack surface. Compromised staff accounts can turn legitimate communication channels into tools for fraud.

Basic defenses such as phishing-resistant authentication, staff training, and monitoring of guest messaging systems are becoming essential.

Without them, attackers can quietly log in, exploit trusted workflows, and scale fraud without triggering traditional security alarms.

As these scams evolve, the line between legitimate service communication and cybercrime continues to blur making vigilance critical on both sides of the booking experience.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.