A guest messages the front desk: the hotel asked them to “re-verify” their card through a link, and now there are charges they did not make. The message came through the booking platform, used the hotel’s name and had the right reservation details. Nobody at the hotel sent it.
Scams like this have become one of the most common security problems for hotels that sell through online travel agencies (OTAs). This guide explains the three scams hotels see most, how staff can spot them in seconds, and the controls that stop them.
The Three Scams Hotels See Most
1. Fake guest messages that install malware
Staff receive an email that looks like it comes from Booking.com or a guest: a complaint, a negative review, a special request or an account warning. The link leads to malware that steals passwords. In March 2025, Microsoft reported a campaign that impersonated Booking.com to target hospitality staff in North America and elsewhere, using lures such as negative reviews and guest requests. The link showed a fake CAPTCHA that told the user to press a keyboard shortcut and paste a command, which installed credential-stealing malware (Microsoft, via Hospitality Net).
2. Hijacked OTA accounts that message your guests
Once a password is stolen, criminals log in to the hotel’s extranet and message guests directly, using real reservation details. Booking.com told KrebsOnSecurity that these attacks stem from partners’ computers being infected with malware, which gave criminals access to partner accounts (KrebsOnSecurity, November 2024). Guests are pushed to “verify” a card or pay outside the platform.
3. Fake invoices and banking changes
Group organizers, corporate accounts and suppliers receive emails that appear to come from your accounting team, asking them to pay a deposit to new banking details. These often use a lookalike domain or your own domain if it is not protected. See email spoofing and DMARC for hotels.
Five Checks Staff Can Do in 30 Seconds
- Does it ask you to sign in, open an attachment or run something? Booking.com warns partners about messages with links or attachments that ask them to sign in or enter personal or financial information (Booking.com partner safety tips).
- Did a web page tell you to press keys and paste something? No legitimate CAPTCHA asks you to open the Run window or paste a command. Close it.
- Is someone asking for a password or card number? Booking.com says its partner service team will only ask for your property ID, never your password or credit card number.
- Check the sender’s actual address and the link before clicking. Go to the extranet by typing the address or using the app, not the link.
- When in doubt, ask. Forward it to your IT provider or manager instead of clicking.
Controls That Stop These Scams
- Two-factor authentication on every OTA and email login. A stolen password alone is then not enough. Booking.com recommends it for partners.
- Separate logins for every staff member, removed the day someone leaves. No shared front desk passwords.
- Protected front desk computers: supported operating systems, security updates, and endpoint protection that blocks infostealer malware.
- Email domain protection with SPF, DKIM and DMARC so criminals cannot send as your exact address.
- Staff training on these scams, repeated when new lures appear.
- A clear guest policy in confirmations: “We will never ask you to re-enter card details by message or email.”
If an Account Has Been Taken Over
- Change the password from a clean computer and turn on two-factor authentication.
- Report it to the platform. Booking.com asks partners to report suspicious activity immediately through its partner security reporting page.
- Check the account for changed contact details, banking details or messages sent to guests, and warn affected guests.
- Have the computer that was used checked for malware before anyone logs in from it again.
- Change passwords for email and any other accounts used on that computer.
For the wider picture, see the cyber threats that actually target hotels and our free hotel PCI checklist (PDF).
Frequently Asked Questions
Will Booking.com ever ask for my password?
No. Booking.com says its partner service representatives will only ask for your property ID, never your account password or sensitive financial information such as a credit card number.
How do criminals get into hotel OTA accounts?
Usually by stealing passwords with malware on a front desk or office computer, often installed through a fake guest or platform email. Two-factor authentication and protected computers stop most of these attacks.
A web page asked us to press keys and paste a command to prove we are human. Is that normal?
No. That is a known malware technique. Close the page and have the computer checked.
What should we tell guests?
Tell them in confirmations and on your website that you will never ask them to re-enter card details by message or email, and that they should call the hotel directly if they receive such a request.
Can AutoSecure help after an incident?
Yes. We help hotels secure accounts, clean and protect front desk computers, and set up two-factor authentication, email protection and staff training.
Talk to AutoSecure
Worried about scams reaching your front desk? AutoSecure secures hotel computers, accounts and email across Ontario. See our hotel cybersecurity and email domain protection services. Call 226-476-3358 or book a free hotel technology assessment.