'Everything looked real': How scammers are hijacking your holiday bookings

Australian travelers face growing threats from sophisticated online scams that exploit stolen travel booking data, leaving them out of pocket and worried about compromised personal information. Cybersecurity experts warn that this data is a lucrative target for criminals, traded on the dark web for highly personalized fraudulent schemes.

“

Travel booking data is highly valuable because it contains detailed information about a traveler's identity, movements and finances. There's an assumption that people who travel have financial capacity, which makes them appealing targets for cybercriminals.

Following a data breach by Booking.com in April, numerous travelers have reported falling victim to phishing attacks. These scams often involve fake messages on platforms like WhatsApp or emails containing specific personal and booking details. "Travel booking data is highly valuable because it contains detailed information about a traveler's identity, movements and finances," explained cybersecurity expert Professor Daswin de Silva. He added that travelers are often perceived as having financial capacity, making them appealing targets.

“

It had all the correct information, including the booking reference and PIN. The urgency was extreme. I was told I only had a few hours to act or my booking would be cancelled.

Grant Holman, a frequent Booking.com user from Western Australia, described being targeted shortly after booking accommodation for a trip to Africa. He received over 10 near-identical messages, some via email and the Booking.com platform itself, demanding urgent payment confirmation under threat of cancellation and penalties. "It had all the correct information, including the booking reference and PIN," Holman stated, expressing a loss of confidence in the platform's data security. "Either the scammers have access to your systems or something has gone wrong somewhere."

“

Either the scammers have access to your systems or something has gone wrong somewhere. I've lost confidence in their ability to keep my data secure.

Similarly, Melbourne traveler Meththa de Silva narrowly avoided a sophisticated WhatsApp scam for his upcoming trip to Vietnam. The fake message, appearing to be from the hotel, included his name, hotel details, travel dates, and fees. "I provided the details but the transaction didn't go through, and that's when I realised it was a phishing attack," he said. He has since canceled his credit card and filed a complaint with the Australian Information Commissioner's Office, highlighting the pervasive nature of these threats.

“

The message was pretending to be from the hotel asking me to make the payment. It had my name, hotel name, travel dates and the due fees. I provided the details but the transaction didn't go through, and that's when I realised it was a phishing attack.