Phishing: Hotel and accommodation, Switzerland 2024
After booking via booking.com, guests received a message in the name of their hotel saying that the credit card had to be checked again.
- Incident · 03.2024 · Switzerland
- Evidence: confirmed by an authority
- Phishing
- Account takeover
As of
What happened
Because the fraudsters had taken over the hotel’s business account, the message really did come from booking.com and gave correct booking data. The link led to a deceptively real phishing page, and entering the card details quickly led to unexpected debits.
- Affected
- Company (anonymous)
- Industry
- Hotel and accommodation
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- Hotel’s business account taken over via phishing or malware
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income because customers stay away after the incident
Mostly no information 1 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Letters, call centre, credit monitoring
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Hotels must secure their account on booking platforms with two-factor protection, otherwise their guests become victims.
Sources
- Wochenrückblick Woche 10: Betrügerische E-Mails im Namen von booking.com (opens in a new window) Bundesamt für Cybersicherheit BACS (bis 2023: NCSC) · 12.03.2024
«Die E-Mail stammt dabei tatsächlich und überprüfbar von booking.com und wird im Namen des Hotels verschickt, bei dem der Empfänger gebucht hat.»