Hackers Exploit Hotel Booking Systems to Send Fake Payment Requests to Guests

Researchers report a growing “Reservation Hijack Scam” targeting hotel booking workflows: attackers phish hotel staff or partners to steal credentials and access real reservation data, then send legitimate-looking, time-urgent payment requests (via Booking.com messaging, WhatsApp, SMS, email, or PDFs) that redirect victims to typo-squatted sites to harvest payment details; activity has been observed across the UK, France, Germany, the US, Brazil, and Australia, and mitigations include phishing-resistant authentication, staff training, and monitoring of guest messaging systems.