Booking fraud is becoming harder to recognise. Phishing messages can contain genuine-looking reservation details, fraudulent payment requests can appear to come from a hotel or booking platform, and advances in artificial intelligence are making impersonation attempts more convincing.
For hotels, this is not just an IT problem. Front desk, reservations, finance and management teams can all find themselves dealing with guests who have received a suspicious message, clicked a fraudulent link or been asked to make an unexpected payment.
The key point: hotels cannot prevent every scam circulating online, but they can make their own accounts harder to compromise, train staff to recognise suspicious activity and give guests a clear way to verify unexpected payment or booking requests.
Why Booking Scams Are Becoming More Convincing
Traditional phishing was often easier to spot because messages contained obvious spelling mistakes, unusual formatting or generic language.
That is changing.
Modern attackers can produce polished messages quickly and may use information obtained from compromised accounts, public websites or social media to make an approach appear more credible.
Booking.com itself warns travellers that phishing messages can appear to come from an accommodation provider or Booking.com and may contain convincing information about the dates and cost of a stay.
Poor spelling is no longer a reliable way to identify fraud. Staff should pay more attention to what a message is asking someone to do, where a link leads and whether the request is consistent with the genuine booking.
One of the Biggest Risks Is Account Takeover
A particularly serious scenario is where an attacker gains access to a hotel’s email account, booking-platform account or another system containing reservation information.
That can make fraud much more convincing because the attacker may have access to real guest names, stay dates and booking information.
Booking.com specifically identifies partner account takeover as a cyber-security risk and notes that phishing can lead to unauthorised access to partner accounts and guest information.
This is why protecting hotel accounts is just as important as teaching guests how to spot suspicious messages.
Common Booking and Payment Scam Patterns
Urgent Payment Requests
A guest is told that their booking will be cancelled unless they immediately confirm payment details or send money.
Fake Login Pages
A message directs the recipient to a website designed to imitate a genuine hotel or booking platform.
Impersonation
Someone pretends to be a hotel employee, supplier, booking platform or senior colleague to make a request appear legitimate.
AI Can Make Impersonation More Difficult to Spot
Artificial intelligence can make written messages more fluent and can also be used to generate or imitate voices.
Regulators have already warned that voice-cloning technology can be used in scams where a caller sounds like someone the victim recognises.
For hotels, the practical lesson is not to try to become experts at detecting synthetic audio. It is to avoid treating a familiar voice, writing style or caller name as sufficient proof of identity.
A simple rule: unusual requests involving money, credentials, guest information or urgent action should be verified through a separate trusted channel rather than relying solely on the message or call itself.
What Front Desk Teams Should Look For
Front desk and reservations teams do not need to identify exactly which technology a criminal used. They need to recognise when something does not match the normal booking or payment process.
- A guest saying they were unexpectedly asked to provide card information again.
- A request to make a payment using a method that differs from the booking confirmation.
- Pressure to act immediately to prevent a reservation being cancelled.
- Links that lead somewhere different from the expected hotel or booking-platform website.
- A guest presenting confirmation details that do not appear in the hotel’s PMS or booking platform.
- Messages asking the guest to continue a conversation outside the normal booking channel.
- Unexpected requests for passwords, verification codes or login details.
Booking.com’s own traveller guidance warns guests about urgent requests to provide payment information again and advises them to verify suspicious messages before taking action.
Do Not Assume the Guest Has Done Something Wrong
If a guest arrives with a booking confirmation that the hotel cannot find, several explanations are possible.
The booking may have been made through another channel, there may be a systems or synchronisation issue, the guest may have misunderstood the reservation details, or they may have encountered fraud.
The right response is to establish the facts rather than immediately label the guest or booking as fraudulent.
Confirm the guest’s name, dates, booking channel and reference number, then check the PMS and relevant booking platform before deciding what has happened.
What to Do if a Guest Appears to Have Been Scammed
The hotel’s role is to help establish what is genuine, preserve useful information and direct the guest to the appropriate organisations.
Check the hotel’s PMS and the relevant booking platform rather than relying solely on the email or screenshot provided by the guest.
Ask the guest to retain the suspicious email, message, website address, payment request and transaction information rather than deleting them.
Report misuse through the relevant booking platform or service provider so they can investigate the account, listing or message involved.
If money or card information has been provided, the guest should contact their bank or card provider promptly for advice.
If the scam contains genuine hotel booking information or appears to have originated from a hotel-controlled account, involve the hotel’s IT or cyber-security support immediately.
Keep enough information internally to identify repeated patterns without unnecessarily copying or retaining sensitive guest information.
If Real Booking Data Was Used, Investigate the Hotel’s Accounts
This is one of the most important distinctions.
A completely generic phishing message may have nothing to do with the hotel’s own systems.
But if the attacker appears to know genuine reservation details that should not be publicly available, the hotel should investigate how that information may have been obtained.
- Booking-platform account activity.
- Email sign-in logs and suspicious forwarding rules.
- Administrator and privileged accounts.
- Recently approved MFA prompts.
- Connected applications and integrations.
- Endpoints used by reservations and front desk staff.
- Third-party suppliers with access to booking information.
Depending on what is discovered, the incident may also need to be assessed under the hotel’s data-protection and cyber-incident procedures.
Multi-Factor Authentication Is One of the Most Important Controls
Hotel email, booking-platform, remote-access and administrator accounts should be protected with multi-factor authentication wherever it is available.
MFA means that possession of a stolen password alone is normally not enough to access the account.
Booking.com recommends 2FA for partner accounts, while the Information Commissioner’s Office recommends multi-factor authentication as an important way of protecting systems and personal information.
Start with email, booking platforms, PMS administration, remote access and any account capable of viewing guest information or changing payment and communication settings.
You can read more in our guide to MFA and 2FA for hotel email and cloud accounts .
Train Staff to Verify, Not Just Spot Typos
Security awareness training should reflect the fact that modern phishing messages can look professional.
Staff should understand normal hotel processes well enough to recognise when a request falls outside them.
- A guest receiving an unexpected payment-verification message.
- A supplier asking for bank details to be changed urgently.
- A senior manager apparently requesting an unusual payment.
- A booking-platform message asking staff to sign in through an unfamiliar link.
- An unexpected MFA approval request.
- A caller asking for guest information without following the hotel’s verification process.
The objective is not to make staff suspicious of every interaction. It is to give them a clear escalation route when something falls outside the normal process.
Make It Easy for Guests to Verify Genuine Communications
Hotels can also reduce confusion by making their genuine contact channels obvious.
Booking confirmations and the hotel’s website should contain clear contact details so a guest can independently check an unusual request.
Where appropriate, confirmation messages can also explain how the hotel normally handles payments and advise guests to contact the hotel directly if they receive an unexpected request.
Good practice: encourage guests to use the contact details shown on the hotel’s official website or original booking confirmation rather than telephone numbers or links contained in an unexpected message.
Review Who Has Access to Guest Information
Hotels often have several systems and suppliers with legitimate access to reservation information.
PMS platforms, booking engines, channel managers, online travel agents, CRM systems, payment providers and integrations can all form part of the booking journey.
This means cyber security should include the wider supplier and integration landscape, not just the hotel’s internal computers.
- Remove accounts belonging to people who no longer require access.
- Avoid sharing administrator accounts between multiple members of staff.
- Use MFA wherever supported.
- Review privileged access periodically.
- Understand which third parties can access guest information.
- Keep hotel computers and browsers patched and supported.
- Have a clear process for reporting suspicious activity.
AI Is Changing the Presentation of Fraud, Not the Fundamentals
Artificial intelligence can make scams look and sound more convincing, but many of the underlying techniques remain familiar.
Attackers still rely on urgency, impersonation, stolen credentials, malicious links and attempts to persuade people to bypass normal processes.
That means established cyber-security controls remain valuable.
Protect Accounts
Use MFA, strong authentication and appropriate access controls.
Verify Requests
Confirm unusual requests through a known and independent communication channel.
Prepare Staff
Give front desk and reservations teams clear processes for recognising and escalating suspicious activity.
What Should Trigger an Immediate IT Escalation?
Not every suspicious guest message indicates that the hotel’s technology has been compromised.
However, some signs deserve immediate investigation.
- Multiple guests receive similar fraudulent messages containing genuine booking details.
- Messages appear to have been sent from a genuine hotel account.
- Staff notice unfamiliar sign-ins or MFA requests.
- Booking-platform or email settings have changed unexpectedly.
- Guest messages are being redirected or answered by somebody unknown.
- A member of staff entered credentials into a suspicious website.
- Malware or remote-control software is suspected on a hotel device.
The sooner those incidents are investigated, the better the chance of containing the problem and protecting further guests.
The Bottom Line
AI is making some booking and impersonation scams more convincing, but hotels do not need an entirely new cyber-security strategy to respond.
The priority is to protect the accounts criminals want to compromise, train teams to verify unusual requests, make genuine communication channels clear to guests and investigate quickly when real reservation information appears in fraudulent messages.
For the front desk, the most useful skill is not being able to identify whether something was generated by AI. It is knowing when a request does not match the hotel’s normal process and exactly who to escalate it to.
How Secure Are Your Hotel’s Guest-Facing Systems?
Hotel IT Company helps hotels and spa resorts review email security, MFA, endpoints, networks, cloud systems and the wider technology environment that supports guest operations.
Explore the Hotel Technology & Cyber Review
Leave a Reply