Holidaymakers are being warned to double-check their hotel reservations after experts revealed that data stolen during the cyberattack on Booking.com earlier this year is now being used in sophisticated scams that could leave travellers without a room when they arrive.
Cybersecurity specialists say the full impact of the April data breach is only now becoming clear as the busy summer holiday season gets underway. Criminals are reportedly using stolen customer information to impersonate hotels or Booking.com, tricking travellers into making extra payments or altering reservation details.
Because the stolen information includes genuine booking details, such as names, email addresses, phone numbers, travel dates and reservation amounts, the scams can appear highly convincing. Experts say this makes it much harder for victims to recognise phishing attempts compared with more traditional online fraud.
In some cases, travellers only discover something is wrong when they arrive at their destination. Their booking may have been changed, cancelled or no longer exist, leaving them searching for alternative accommodation at a time when hotels are already full, and prices are at their highest.
Cybersecurity experts also warn that resolving these problems can be difficult. If criminals have exploited leaked personal data, determining who is responsible is not always straightforward, and affected travellers may have to pay for replacement accommodation or additional transport while the issue is investigated.
To reduce the risk, experts recommend contacting your hotel directly a few days before travelling to confirm that your reservation is still valid. They also advise treating any unexpected email or text message requesting additional payments or updated bank details with extreme caution, even if it contains accurate booking information.
Travellers should keep copies of all payment receipts and booking confirmations and contact their accommodation again within 48 hours of departure.
