Microsoft has issued a warning to hotel and accommodation owners about a new phishing scam targeting Booking.com listings.
With an increase in bookings expected over the Easter holidays and mid-year break, scammers are attempting to gain access to financial details by impersonating Booking.com in fraudulent emails.
How the scam works
Hotel and accommodation owners receive an email appearing to be from Booking.com, often claiming a guest has left a negative review or requiring urgent action. The email prompts the recipient to open a PDF or click a link, where they are asked to verify their login—sometimes even completing a CAPTCHA to add legitimacy. Once the login details are entered, cybercriminals gain access to accounts, potentially exposing financial information.
This type of scam has been active since 2023, with previous cases tricking guests into handing over financial details through fake cancellation notices. According to the ACCC’s Scamwatch, Australians have lost more than $337,000 to similar Booking.com scams. Now, criminals are shifting focus to accommodation providers, particularly smaller hotels and motels that may have weaker cybersecurity protections.
How to stay protected
Microsoft recommends several steps to help accommodation providers and consumers avoid phishing scams:
- Verify the sender’s email – Hover over the email address to check for legitimacy. Official companies do not request personal or financial details via unsolicited emails.
- Contact the service provider – If in doubt, reach out to Booking.com or any booking platform via their official website, not through email links.
- Be wary of urgent requests – Scammers often create a false sense of urgency to pressure users into taking immediate action.
- Hover over links before clicking – Malicious links may download malware; always check the full URL or type the website directly into a browser.
- Watch for typos and errors – Phishing emails often contain subtle misspellings or grammatical mistakes, such as “rnicrosoft[.]com” instead of “microsoft.com.”
- Educate staff on phishing scams – Ensure all employees handling bookings are trained to recognise scam emails and avoid clicking on suspicious links.
