heise+ Booking.com phishing: This is how you spot fake hotel news

A phishing attack targeting users of Booking.com has emerged as a growing concern among travelers and cybersecurity experts. In late July 2026, several customers received suspicious messages via WhatsApp from hotels they had booked through the platform. These messages falsely claimed there was a payment issue with their reservation and urged immediate action by clicking on a link. The messages appeared authentic, with booking details matching those in the user’s account. However, these communications were part of a sophisticated phishing scheme designed to steal personal data. The breach originated from compromised accounts of hotel administrators within Booking.com's Extranet system, which allows property managers to access guest information and manage bookings. This security flaw enabled attackers to impersonate legitimate hotel staff and target unsuspecting guests. The incident follows a surge in similar attacks in early April 2026, during which numerous Booking.com users reportedly received both warnings from the platform and phishing messages. Some recipients fell victim to the scams, providing sensitive information such as login credentials and financial details. Booking.com responded by alerting affected users and urging them to verify all communication through official channels. Despite these efforts, the vulnerability highlights gaps in the company’s security measures, particularly regarding the management of third-party access to its systems. According to internal discussions with Predrag Vuckovic, head of IT security at Booking.com, the company is working to strengthen authentication protocols and improve monitoring of unusual activity within the Extranet. Hoteliers have expressed concerns over the increasing frequency of such incidents, noting that many of their staff accounts have been compromised. Some businesses reported unauthorized access to customer data, leading to potential identity theft and financial fraud. Industry representatives have called for greater transparency from Booking.com regarding how user data is protected and shared with third parties. They argue that while the platform provides valuable services, it must take more responsibility for securing the digital infrastructure that supports its operations. One hotel manager stated, “We’re not just victims here, we’re being used as a vector for cybercriminals.” Meanwhile, other phishing schemes have targeted individuals directly, bypassing the need for intermediaries like Booking.com. In Wipperfürth, Germany, a 87-year-old woman was tricked into handing over her valuables after receiving a fake call from someone claiming to be a police officer. The caller told her that her son had caused a fatal accident and needed money for bail. She later met a second individual posing as a court employee and handed over her gold jewelry and coins. Police are investigating the case and have issued appeals for witnesses who might have noticed anything unusual. This case underscores the broader risk of social engineering tactics, where criminals exploit human psychology rather than technical vulnerabilities. Another recent scam involves fraudulent emails sent to users of online banking services, warning them that their accounts would be suspended unless they clicked on a link. These messages mimic official correspondence and often include urgent language to provoke quick responses. Cybersecurity analysts warn that such tactics are becoming increasingly common, as scammers refine their methods to evade detection. While some users have fallen for these tricks, others have managed to avoid falling prey by verifying the authenticity of the messages through official channels. As authorities continue to investigate these incidents, there is growing pressure on companies like Booking.com to enhance their cybersecurity frameworks. Experts suggest implementing multi-factor authentication for administrative accounts, conducting regular security audits, and educating users about the risks of phishing. Meanwhile, consumers are advised to remain vigilant, especially when dealing with unsolicited communications related to travel bookings or financial transactions. With cybercrime evolving rapidly, staying informed and cautious is essential for protecting personal data and preventing financial loss.