By PYMNTS | October 21, 2026
Highlights
Criminals can target hotel employees before approaching their guests.
Accurate reservation details can lend credibility to fraudulent payment requests.
Travel businesses share responsibility for protecting booking data and communications.
A traveler who has booked a real hotel can receive a fraudulent request containing the correct arrival date and reservation number. Criminals can use those details to demand payment information, warning that the room will otherwise be canceled.
The European Commission’s Booking.com investigation, announced Wednesday (Oct. 21) and reported by PYMNTS, took note of the arrangements through which such scams can reach guests. Regulators are reviewing reservation-data sharing with accommodation providers and the platform’s messaging service, alongside fraudulent listings and advertising transparency. No wrongdoing has been established. Booking.com said it’s cooperating and prioritizes security and personal information protection.
The exposure extends across what might be thought of as the “supply chain” of the businesses involved in fulfilling a reservation. Platforms feed data to hotels, tied to guest information, employees access partner accounts, and customers expect further instructions about their stays. Unauthorized access at the provider level can supply information used to make a subsequent payment request convincing.
Hotel Employees Provide an Entry Point
Bridewell, a cybersecurity firm, described that sequence earlier this year. Attackers targeted hotel employees with fraudulent messages and imitation login pages. After obtaining partner-account credentials, they accessed customer names and booking information through the reservation platform.
Travelers subsequently received WhatsApp messages containing accurate reservation details and warnings that their bookings would disappear within 24 hours. Links directed them toward pages impersonating the booking service. The approach exploited information from a legitimate commercial relationship to solicit a response through a separate communication channel.
For hotels, employee-account security consequently affects guests’ payment exposure. For platforms, verifying an accommodation provider’s identity doesn’t establish that every later use of its account is authorized. Access controls and the ability to suspend compromised accounts remain necessary throughout the relationship.
In comments provided to PYMNTS on Wednesday (Oct. 21), George Ralchev, head of risk at emerchantpay, said, “As travel scams rise, businesses are increasingly protecting their customers from fraud by embedding security into every stage of the customer journey. Our research shows that a third (34%) of holiday-makers have seen an increase in potentially fraudulent travel content on social media over the last 12 months.”
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
Travel Scams Carry Substantial Losses
September’s PYMNTS Intelligence report “Fraud’s Loyalty Tax: How Scams Cost Banks Their Customers” reports average travel-scam losses of $35,272, the highest among the categories examined. The report’s scam-level findings concern respondents’ most financially damaging personal scam within five years.
Travel fraud also reaches customers before a genuine reservation exists. The Federal Trade Commission warns that criminals copy rental listings, advertise properties they don’t control or invent accommodations. Customers may discover the deception upon arrival. Supposedly free vacations can also lead to demands for upfront fees.
These schemes require different checks. Confirming that a property exists helps expose an invented listing. A scam built around an authentic booking requires verification of the sender’s authority and the requested payment.
Payment Requests Need Independent Confirmation
The FTC recommends checking property addresses and warns against rental offers requiring payment exclusively by methods such as cryptocurrency or gift cards. UK Finance’s Take Five guidance advises customers to contact providers directly about supposed refunds or overpayments, avoid unsolicited links and notify their banks immediately after suspected fraud.
Travel businesses can support those precautions by giving guests an independent way to confirm additional charges within their established booking relationship. Payment instructions should identify the authorized recipient and explain how the charge relates to the reservation.
The B2B work includes limiting employee access to guest records, reviewing suspicious account activity and coordinating warnings when information is exposed. Platforms, hotels and payment providers hold different portions of the booking and transaction history; their response procedures should allow them to connect those records.