'Everything looked real': How scammers are hijacking your holiday

After a data breach in April, dozens of travellers told the ABC they had been targeted by phishing scams. (ABC News: Mark Leonardi) Dozens of travellers say phishing scams are still targeting them over their Booking.com reservations. Experts say travel booking data is highly valuable to scammers because it contains details about identity, movement and finances. A cybersecurity expert is warning people to be vigilant and set up extra security protocols when making a booking. Link copiedShareShare articleAustralian travellers are being left out of pocket and fearful their personal data has been stolen amid growing concerns over the security of online travel bookings. A cybersecurity expert says travel booking information has become a lucrative target for criminals, with stolen data traded and shared on the dark web before it is used in highly targeted scams. Some Booking.com customers are being warned their personal information may have been accessed by unauthorised third parties, prompting fresh concerns about the security of travellers' data. After a data breach revealed by Booking.com in April, ABC News has been contacted by dozens of travellers who say they have been caught up in phishing scams involving fake hotel messages on WhatsApp and emails with their personal details and booking information. "Travel booking data is highly valuable because it contains detailed information about a traveller's identity, movements and finances," cybersecurity expert Professor Daswin de Silva said. "There's an assumption that people who travel have financial capacity, which makes them appealing targets for cybercriminals." Western Australian traveller Grant Holman said he was targeted by a sophisticated scam soon after booking accommodation for a trip to Africa. The Mandurah resident, a long-time member of Booking.com and a "Genius" loyalty member, said the scam messages appeared legitimate and included highly specific details from his reservation in Addis Ababa. Grant Holman and his wife say they were targeted by scammers after reserving accommodation on Booking.com. (Supplied) "It had all the correct information, including the booking reference and PIN," Mr Holman said. "The urgency was extreme. I was told I only had a few hours to act or my booking would be cancelled." Mr Holman said he received more than 10 near-identical messages urging him to confirm payment details or risk cancellation and penalty fees. There have been more than 800 complaints about Booking.com in the past two years, varying from refund battles to last-minute cancellations. (ABC News: Billy Cooper) He said some messages were sent to both his email address and on the Booking.com platform. "Either the scammers have access to your systems or something has gone wrong somewhere," he said. Melbourne traveller Meththa de Silva said he almost fell victim this week to a sophisticated WhatsApp phishing scam that used detailed information from a Booking.com reservation for his coming trip to Vietnam. "The message was pretending to be from the hotel asking me to make the payment. It had my name, hotel name, travel dates and the due fees," Mr de Silva said. Meththa de Silva and Saumya Panditha came under phishing attack before their holiday to Vietnam. (Supplied) "I provided the details but the transaction didn't go through, and that's when I realised it was a phishing attack." He has now cancelled his credit card, just days out from his Vietnam holiday, and has lodged a complaint with the Office of the Australian Information Commissioner. "I sent all the details to Booking.com customer service and they haven't responded and didn't give me any advice," he said. "There doesn't seem to be any consequences for these multinational companies. Australian law can't touch them." Booking.com contacted customers in April warning that their personal details might have been accessed by "unauthorised third parties". Professor de Silva, from La Trobe University, said online travel platforms relied on millions of hotels, operators and smaller providers worldwide, many of which might not have robust cybersecurity systems in place. "The weakest link is often the third-party supplier," Professor de Silva said. Hundreds of complaints against Booking.com are piling up as customers and hosts allege they've lost money, their property has been trashed and no-one is taking responsibility. He said scammers often targeted frontline staff, such as hotel receptionists, with convincing emails to gain access to booking systems. "It only takes one employee to click a malicious link or open an attachment," he said. "From there, attackers can access booking systems and extract customer data." He said the information was valuable because it was precise, time-sensitive and could be exploited immediately. "In many ways, we're conditioned to overshare in travel," he said. National figures compiled by the ABC show at least 842 complaints were made about Booking.

'Everything looked real': How scammers are hijacking your holiday

Key takeaways

More in international