That 'angry guest' email from Booking.com? It's a scam, not a 1-star review

An ongoing phishing campaign disguised as a Booking.com email casts keystroke and credential-stealing malware into hospitality employees' inboxes for financial fraud and theft, according to Microsoft Threat Intelligence. Redmond says the email attacks began in December, and were still happening as of February. The threat intel …

[Omnipresent]

The irresponsibility

Shown by the tech industry in handling our data only comes down to a couple of options.

1: Selling our data to whoever asks for it is more profitable than your business model is.

2: kids with AI have been given the job of internet security.

3: You were evil to begin with, with evil intensions.

There are no other excuses for being this irresponsible with customer data. The amount of scams coming over text and phone calls mean I do not reply to anything for any reason unless I'm expecting you to contact me. The phones are now useless as well. Enshitification continues.

[Anonymous Coward]

Re: The irresponsibility

"I clicked a banner on a website saying it is a document, it downloaded an exe file and said to install the PDF reader. As the person who authorises the purchasing of Adobe licenses at my company, I do not see any issue with this request and shall install this program so I can open the PDF file."

Side-note: We contacted our malware vendor about why it hadn't been detected and got a copy pasted response. The following morning we got an alert from someone else's computer who had been infected a few weeks prior with the same thing from a banner ad on a different website. We now officially categorise ad blockers as security tools.

[MiguelC]

Clicking a link by instinct? It happens, I get that.

Running commands on your PC because the website tells you to? That's a total lack of critical thinking!

[An_Old_Dog]

No Useful Feedback

The spokesperson also declined to tell us how many organizations have been affected by this latest Booking.com phishing campaign.

"Half the money I spend on phishing emails is wasted. Unfortunately, I can never tell which half."

[Anonymous Coward]

Booking sites

A scam within themselves.

Book direct guys, that’s where the savings are at.

[Josco]

Re: Booking sites

Not aways possible. I was at a large hotel in Leicester and for various reasons we required another room. I went to reception where the spotty youth said they were fully booked. In front of him I whipped out my phone, went to Booking.com and booked a room there and then for that night. Job done.

[katrinab]

Re: Booking sites

They had probably sold a block of rooms to Booking.com, so that's why Booking.com had a room and the hotel didn't?

[Swedish Chef]

Re: Booking sites

That's the most likely explanation. Has happened to us on several occasions as well (and also the other way around - direct booking possible while booking.com said sold out). Some hotels even straight up told us that they're full but to check booking.com.

[Swedish Chef]

Can confirm

Currently planning a trip across Spain and staying in various hotels booked on booking.com (often the only way to get accommodation in remote areas). Keep receiving messages from several hotels asking me to fill in a form required by the local tourism authority.

The messages contain my booking reference, dates of stay, real name and sometimes address, and lead to various phishing forms. They've also been sent from the hotel's genuine booking.com account (I can see them in my own account's inbox).

booking.com customer support are no big help, they just forward any reports to the hotel in question, who then either ignore them or say that they didn't send any messages (you don't say).