A worldwide wave of hacker attacks on the internal IT systems of hotel chains and globally operating booking platforms has far-reaching consequences for consumer protection in the tourism sector. In recent weeks, cybercriminals have gained unauthorized access to highly sensitive customer databases and are now misusing the stolen information for targeted and technically sophisticated fraud attempts.
The perpetrators use real booking details, such as precise travel dates, correct customer names, and specific hotel names, to pressure victims into making payments via fraudulent messages. Consumer protection advocates and IT security experts are sounding the alarm, as the fake payment requests are now virtually indistinguishable from legitimate system messages, both visually and in terms of content. The Carinthian Chamber of Labor has issued an urgent security warning, urging travelers to exercise extreme skepticism when dealing with unexpected digital contacts, as the amount of damage caused by this scam is steadily increasing.
The anatomy of the attack and the professionalization of the perpetrators
The current security incident differs fundamentally from classic, often amateurishly worded phishing emails of the past. Through the direct theft of data from reputable platforms like Booking.com, as well as from numerous individual hotels, the attackers have gained precise insight into their victims' travel plans. This approach, known in technical terms as spear phishing, aims to exploit the existing relationship of trust between the traveler and the booked hotel. The criminals typically contact the victims via messaging services like WhatsApp or through the booking platforms' own internal chat systems, which they have accessed using stolen login credentials from hotel employees.
The deceptively realistic messages suggest to customers that additional verification of their credit card details or an immediate deposit is required to maintain their existing reservation. To increase the pressure on consumers, the perpetrators systematically use threats of extremely short deadlines. Vacationers are informed that if the deadline passes, the booking will be automatically canceled and a fee will be charged. Because the messages contain the exact booking number and the correct dates of the planned stay, many victims remain unsuspecting and follow the criminals' instructions.
The technical mechanisms behind the fake payment sites
The hyperlinks contained in the text messages lead users to external websites that the attackers have painstakingly replicated, using sophisticated graphics, the official user interfaces of well-known booking portals. As soon as a victim enters their credit card details, security code, or online banking login information on such a fake site, this information is transmitted to the perpetrators in real time. In many cases, the criminals immediately use the data for unauthorized withdrawals or sell the data sets on illegal marketplaces in the dark web.
Identifying these fraudulent websites is made more difficult by the fact that perpetrators often use internet addresses that are deceptively similar to genuine domains by incorporating minor letter transpositions or using alternative country-code top-level domains (ccTLDs). Furthermore, attackers are increasingly relying on encrypted connections, resulting in the appearance of the trusted padlock symbol in the browser address bar, which many laypeople mistakenly interpret as a guarantee of a secure and legitimate website.
Legal classification and preventive recommendations from consumer protection organizations
From a legal perspective, the disclosure and misuse of this data constitutes a serious violation of the General Data Protection Regulation (GDPR). For the affected hotels and platforms, these incidents result not only in significant reputational damage but also in potential liability risks if it can be proven that IT security standards were negligently disregarded. The consumer protection department of the Chamber of Labor emphasizes that reputable booking platforms and accommodation providers would never request sensitive payment data via unsecured chat functions or messenger services.
Clear guidelines have been formulated for consumers to effectively prevent financial losses. As a general rule, clicking on any links in unexpected payment requests should be avoided. Instead, it is strongly recommended to manually access the official and familiar website of the hotel or booking platform in your browser and contact customer service directly using the telephone numbers provided there. Under no circumstances should the contact details provided in the suspicious message be used, as these could lead directly to the fraudsters. If a loss has already occurred, it is essential to immediately block the affected credit card and secure evidence by taking screenshots for later filing a police report.