Hotels, holiday resorts, and hospitality providers across the United Kingdom and Europe are facing an unprecedented wave of targeted cyber-scams. Criminals are actively exploiting third-party booking software, channel managers, and property management systems to infiltrate guest databases.
Because threat actors are managing to steal real booking details such as guest names, exact holiday dates, property titles, and booking references, they are launching highly convincing social engineering campaigns via WhatsApp and text message. They trick guests into believing there is an urgent payment failure or security check, driving them to click rogue external links and hand over their payment card details.
Why This Matters to Hospitality Players
When guests receive messages quoting 100% accurate itinerary data, their natural scepticism vanishes. Frontline teams are facing panicked calls, making it essential for all hospitality operators to understand the mechanics of this supply-chain breach and protect their communities.
Understanding the Guest Experience and Threat Unlike traditional, obvious spam emails, these reservation-hijack scams completely disarm consumers by leveraging authentic travel itineraries.
The Upstream Breach: Bad actors compromise administrative extranet logins or exploit software vulnerabilities upstream at the technology vendor level to harvest live guest itinerary lists.
The Social Engineering Strike: Prior to arrival, guests receive messages addressing them by name, naming their specific resort, and quoting exact dates and booking IDs.
The Financial Trap: Victims are warned of an urgent card authorisation failure or deposit expiration, driving them to forged checkout pages where their card details are stolen.
Essential Guidance for Frontline Teams and Resorts
When guests call in a panic, reception staff should reassure them, reinforce the golden rule that properties never ask for payment card updates via text or WhatsApp link, and advise them to block and delete the message. Management teams should audit their software security providers, request written confirmation of system integrity, and consider proactive pre-arrival security advisories to incoming guests.
Consumer Reporting Mandate
If any of your guests have been affected by this scam, they should be advised to report the issue directly to Report Fraud, the national reporting centre for fraud and cybercrime, at https://www.reportfraud.police.uk/ (or by calling 0300 123 2040). Affected individuals must also contact their bank or card issuer immediately.
Get in Touch with EUROC: Any resorts or hospitality players looking for guidance, support, or wishing to share their own experiences can contact us directly via email at support@euroc.org. We continue to monitor this cross-border situation closely to protect our industry.
This briefing is issued by EUROC for hospitality personnel and leadership teams.
