Booking Phishing: how to protect your hotel and your guests?

A guest calls the front desk after receiving a message about their reservation. It includes their name, stay dates, and the correct amount. Yet, they are suddenly asked to confirm their credit card details or make a payment via a link.

The message seems credible because it is based on real information.

In some attacks, the starting point is not Booking.com itself, but a compromised partner account or hotel device. The attacker can then access certain reservation data and use it to send fraudulent messages to travelers. Booking.com specifically identifies phishing as a frequent cause of partner account takeovers.

Understanding this scenario helps teams recognize warning signs faster and limit the consequences for both the establishment and its guests.

‍

How can an attack originate from the hotel's Booking.com account?

The scenario often follows a fairly simple chain of events.

It all starts with an employee receiving an email, SMS, or WhatsApp message that appears to be from Booking.com. It might concern a reservation issue, an urgent request, or an invitation to log back into the Extranet.

The link leads to a fake login page. If the credentials are entered, the attacker may attempt to take control of the account. Malware installed on a hotel computer can also serve as an entry point. Booking.com specifically cites phishing, malware, and remote access tools as risks affecting partners.

Once access is obtained, certain reservation information may become accessible. The attacker then has enough context to craft a message that is much more convincing than a standard phishing attempt.

For example, the traveler might receive:

"Your payment could not be validated. Please confirm your reservation within two hours to avoid cancellation."

The link then leads to a fake payment portal designed to steal banking information.

The danger lies in the sequence:

compromised account → access to reservation information → personalized message → fake payment link.

For the hotel, this risk directly concerns the protection of customer data in the hospitality industryand not just the security of a Booking account.

‍

Which messages should alert your team?

An email that perfectly replicates the Booking.com logo and colors is not necessarily authentic.

It is primarily the context and the requested action that must be examined.

A request warrants extra verification when it creates an unusual sense of urgency, asks you to re-enter a password, includes an unexpected attachment, or directs you to a login page via a link received by email, SMS, or WhatsApp.

Booking.com states that its Partner Service may ask for the property ID, but it does not require your account password or sensitive financial information. The platform also recommends being particularly cautious regarding links and attachments received via messaging services.

Rather than clicking directly, the team can open Booking.com from their usual bookmark or type the service address themselves, then check if the same request appears in the Extranet.

This simple habit significantly reduces the risk of landing on a copycat site.

‍

Secure access before educating guests

The first line of defense is on the hotel side.

Booking.com specifically recommends two-factor authentication, staff training, up-to-date security software, and proper account management.

Two-factor authentication is particularly important: if a username and password are compromised, the attacker still has to clear an additional hurdle before they can log in.

Passwords must also be unique. Reusing the same password for Booking, professional email, and other tools turns the compromise of a single service into a risk for multiple accounts.

Finally, access should correspond to the actual needs of the team. An employee who no longer needs to use a tool should not retain their credentials indefinitely.

Security therefore relies as much on technical settings as it does on daily habits.

‍

Make your legitimate payment requests easy to recognize

It is difficult for a traveler to identify a fake message if the hotel's legitimate communications are constantly changing.

One day, a payment link arrives by email. The next, a request is sent manually via WhatsApp. Another time, bank details are requested directly in a message.

The more scattered your practices are, the more normal a fraudulent request can appear.

It is therefore useful to clearly define how the hotel communicates before the stay and how a legitimate payment request is presented.

This consistency aligns with the principles of good hotel communication throughout the guest journey : the traveler should know what message to expect, when, and through which channel.

For operations requiring a bank guarantee, a structured process also limits the manual handling of payment data. GetWelcom offers, in particular, a hotel pre-authorization process presented as compliant with PCI DSS (Payment Card Industry Data Security Standard) requirements, an international standard that governs the security of credit card data.

This obviously does not make phishing impossible. However, the more identifiable the official process is, the more likely an unusual request is to alert the guest or the team..

‍

What should you do if you suspect a compromise?

If an account or workstation appears to be compromised, the primary goal is to prevent the attacker from maintaining access.

Contact Booking.com via an official channel and report the suspicious activity promptly. Booking.com asks partners to notify them when they notice unusual activity.

Next, change the affected credentials from a device you consider secure and verify two-factor authentication.

If the same password was used elsewhere, change those access credentials as well.

You must then investigate what may have been done from the account: setting changes, messages sent, data accessed, or potentially affected reservations.

If the problem appears to stem from an infected computer, changing the password alone is not enough. The workstation must be isolated and checked before being used again to access hotel accounts.

‍

Guests have received the fake message: what should you tell them?

If travelers have received a fraudulent request, communication must be prompt and very straightforward.

Notify them via a channel whose authenticity is controlled by the establishment. There is no need to explain all the technical details of the incident to them immediately.

The message can get straight to the point:

You may have received a fraudulent message regarding your booking. Please do not use the payment link contained in this message and do not share your banking information. If in doubt, contact our property or Booking.com directly using their official contact details.

The guest needs to understand three things: which message is suspicious, what action to avoid, and how to verify their booking.

However, avoid stating too early that "everything is secure" if the incident analysis is not yet complete.

In this type of situation, the traceability of communications and data can also make it easier to identify the affected travelers. This is one of the issues addressed in our content on the digitization of the guest journey and compliance.

‍

Compromised Booking account: do you need to notify the CNIL?

It is not always necessary to notify the CNIL in the event of a compromised Booking account.
Receiving a phishing email does not in itself constitute a personal data breach.

The situation changes when an unauthorized person has actually accessed, disclosed, altered, lost, or destroyed personal data concerning travelers.

In this case, the incident must be documented and its risk level assessed.

The CNIL specifies that any breach must be documented internally. When it poses a risk to the rights and freedoms of individuals, it must also be reported to the CNIL as soon as possible and, if possible, within 72 hours of the company becoming aware of it. If the risk is high, the affected individuals must also be informed.

The hotel must therefore be able to quickly determine who makes this decision: management, the DPO, the IT manager, or an external provider, depending on its organization.

The right approach is not to systematically report every phishing attempt, but to verify whether personal data has actually been compromised and what consequences this may have for travelers.

‍

Prepare a protocol before the next incident

Discovering an attack is not the ideal time to look for the Booking.com phone number, decide who will change access credentials, or draft the first message to guests.

A one-page protocol can be sufficient.

It must specify who contacts Booking.com, who secures the accounts, who checks the computer workstations, who identifies the affected reservations, and who assesses any potential personal data breach.

Also, prepare a very short message template for guests in advance. It can be adapted to the specific incident without having to start from scratch.

Finally, give the entire team one simple rule: any unusual request for login credentials, payments, or data transmission should never be handled urgently without verification through an official channel.

This rule is easy to remember and protects both the hotel and its guests.

‍

Secure sensitive steps before arrival as well

GetWelcom helps structure pre-stay communications and digitize certain steps such as pre-authorization, in order to offer guests a more recognizable and better-organized experience.

Request a GetWelcom demo

‍