These days there’s a lot of talk about scams linked to online bookings. The European Commission has opened an investigation into Booking.com. It wants to know whether the platform does enough against fake listings and misleading advertising. It also wants to know whether it does enough against phishing that exploits the data of people booking a room. I manage hosting for several hospitality businesses. I saw a hotel phishing scam land in a client’s inbox just a few weeks ago. It isn’t a statistic. It’s a real email, with a real link, sent to a real person.
The sender uses a generic name. Nothing suspicious at first glance. The subject line is innocuous: “Room availability from 10 to 12 November”. The text is in reasonably natural English. It has a few small imperfections, the kind a native speaker would notice, but nothing that triggers an immediate alarm. The writer says they want to book. They ask for confirmation of availability. Then they add a detail that seems harmless: they claim to have attached a copy of their passport, “to make the booking easier”. There’s also a small detail about timing: they’ll be travelling from the 9th, so they’d prefer to have everything confirmed in advance.
That line, “I’ll be travelling”, is a precise psychological lever. It isn’t an aggressive urgency. It doesn’t ask for money straight away. It just creates a plausible reason to hurry, to reply before thinking too much about it. I saw the screenshot of this email, with the link redacted for security. I find it an almost textbook example of how an effective hotel phishing scam is built: polite, credible, with a pinch of calculated urgency.
How a hotel phishing scam works in two steps
The mechanism has two distinct phases. It’s worth understanding both, because from the outside they seem trivial, yet they work. The first phase is the email. It contains a shortened link, the kind that passes through a redirector: a service that hides the real destination behind a short address. Clicking it, you don’t immediately see where you’re going to end up. That’s already the first deception, small but effective.
The second phase is the landing page. It’s a screen pretending to be a confirmation or payment procedure. Visually it resembles a real platform, sometimes closely enough to fool even people who’ve worked in the sector for years. That’s where the real damage happens. The property manager, convinced they need to verify availability or confirm the booking, enters their own credentials. These could be their Booking or Airbnb extranet credentials. Or their email account, or their website’s admin panel. From that moment on, the credentials are already in the hands of whoever sent the email. The rest, in the eyes of the person who’s been scammed, happens afterwards, when it’s too late to turn back.
Why hotel managers are such an easy target
Anyone working in a hospitality business receives dozens of similar requests every week. Emails from guests, questions about availability, last-minute confirmation requests. It’s a constant flow, often handled in a rush, between one check-in and the next. One extra message, polite and plausible, blends in well with that flow. It doesn’t stand out. The weak point isn’t the manager’s technology. It’s their limited time, and the habit of replying quickly to someone who looks like a real guest. That’s exactly why a hotel phishing scam works so well: it doesn’t target a computer system, it targets a busy person.
The red flags to recognise
There are concrete signals. None on its own is enough to prove a scam, but together they tell a clear story. The contact comes through a direct email, not through the platform’s official channel: Booking and Airbnb both have internal messaging systems, and a genuine guest almost always uses them. The link is shortened or masked, so you can’t tell where it leads just by reading the address. The message asks you to “verify availability” by clicking a link, instead of letting the manager check from their own dashboard, typing the address in by hand as they’d normally do. The tone is polite, almost considerate. The urgency is measured: it doesn’t scare you, but it still pushes you to act quickly, before you think it over.
Why I filed this under “Between the Chair and the Keyboard”
I opened this category on the site specifically for cases like this hotel phishing scam. “Between the Chair and the Keyboard” is a joke that anyone who works in information security knows well. It points to the exact spot where the damage almost always happens: the person in front of the screen, not the software. The booking platform isn’t at fault in this specific episode. The problem isn’t a bug in Booking or Airbnb. It’s the moment a human being, perhaps in a hurry, clicks a link they shouldn’t have clicked. Understanding this helps you defend yourself better. Antivirus software isn’t enough. You need the habit of pausing for a second before clicking, every time.
If credentials end up in the wrong hands regardless, it’s worth considering whether to change them straight away, wherever they’re used. I covered this when I wrote about database credential rotation after an ISPConfig breach. The technical context is different, but the principle stays the same.
What to do to protect your property
The first rule is simple, but it’s worth repeating often: never enter credentials by clicking a link that arrived by email, even if it looks urgent. If someone writes saying they want to book, you check from your own dashboard. You type the address in by hand, you don’t follow a link sent by a stranger. The second rule concerns two-factor authentication. It should be switched on for every account that matters: the platform’s extranet, your email account, your website’s admin panel. Even if credentials get stolen, a second factor still blocks access in most cases. The third rule is reporting. Every suspicious message should be reported to the platform, which uses this data to block other similar attempts. It’s no coincidence that how these episodes are handled is one of the reasons behind the European investigation. The hotel phishing problem concerns the platforms too, not just individual managers.
Anyone who wants to follow developments can read the Italian news agency AGI’s account of the Commission’s inquiry into Booking.com. It sums up well what’s happening. And why it matters even for people running a small property, not just the big chains.
If you’ve already clicked or entered your details
If it’s already happened, it’s best to move quickly. Change the password of the affected account straight away. Change it everywhere else you’ve reused the same password too: that’s a common mistake, and whoever steals credentials knows it well. Turn on two-step verification, if you hadn’t already. Check the account’s login history. Look for sessions or devices you don’t recognise. Alert the platform, which has dedicated procedures for compromised accounts. If you’d attached real documents to the email, keep an eye on them: a stolen ID document can be reused elsewhere, not just for other scams in the hospitality sector.
The case I saw didn’t cause any damage. Whoever received it paused for a moment before clicking, and reported it to me. That was enough. Technology helps, spam filters help, but in the end it’s always the person deciding whether to click or not that makes the difference. The hotel phishing scam problem, almost always, comes down to the chair and the keyboard.
Leave a Reply