Phishing: Private individual, Switzerland 2023
A guest booked a hotel in Bern and on the same day received a WhatsApp message from a supposed receptionist who knew the travel dates, address and hotel costs.
- Incident · 01.2023 · Bern, Switzerland
- Evidence: confirmed by an authority
- Phishing
- Deception (social engineering)
As of
What happened
After harmless questions, she asked for credit card details or a payment; the Dutch telephone number made the guest suspicious, and he broke off contact. According to the NCSC, such booking data is stolen from hotels with the «RedLine Stealer» malware.
- Affected
- Private individual (anonymous)
- Industry
- Private individual
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- WhatsApp message with real booking data
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Misuse of card, Twint, e-banking
Strangers pay with your money
Mostly limited 25 of 29 private products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Someone who knows the booking details is not automatically the hotel: always check payment requests via WhatsApp directly with the hotel.
Sources
- Wochenrückblick Woche 4: Schadsoftware in Hotels - Buchungsdaten werden für Betrug gegen Hotelgäste verwendet (opens in a new window) Bundesamt für Cybersicherheit BACS (bis 2023: NCSC) · 31.01.2023
«Im konkreten Fall hat der Melder ein Hotel in Bern gebucht und noch am gleichen Tag eine Rückmeldung von der vermeintlichen Rezeptionistin über WhatsApp erhalten.»