Leaked booking details are making fake messages from “the hotel” increasingly hard to spot. Here are four tips from us at Invite Guest Technology to help you stay ahead.
In recent months, scammers have been using real booking details in messages that appear to come from the hotel. When the guest’s name, dates and hotel are all correct, it is hard to tell that the message is fake.
Earlier this year, Booking.com confirmed that unauthorised parties had gained access to the booking details of some guests. The security company Norton calls the phenomenon “reservation hijacking”. The scammers pose as the hotel and use a real reservation as bait to get the guest to pay for a problem that doesn’t exist. According to Norton, it is precisely the real details that make the scam so convincing. A message with the right hotel, the right dates and the right contact information looks like ordinary customer service.
Correct information is no longer proof
The fact that the details in a message are correct no longer means it is genuine. When the scammer knows who the guest is, when they are arriving and where they are staying, the guest often has little more to go on than the tone, the channel and whether they recognise it.
A typical example is a WhatsApp message from an unknown number a few days before departure. The hotel name and dates are correct, and the guest is asked to tap a link. What can give the scam away is that the message doesn’t sound like the hotel. That requires the hotel to have a clear and recognisable voice. When every message from the hotel looks the same and comes from the same sender, a message that breaks the pattern stands out.
“These days, most of us are pretty busy. It’s all too easy to share information that ends up being used for malicious purposes. We advise all our customers to be clear about the flow of the guest journey and to use a trusted sender name in the messages they send out,” says Julie Nytun Fossøy, Product Manager at Invite.
Four steps hotels and accommodation providers can take now
1. Tell guests what to expect
State in the booking confirmation which messages the guest will receive, where they will come from and when. If the guest receives something else, they know to stop and check.
2. Have one recognisable voice
Use the same tone, wording and greeting in the booking confirmation, the pre-arrival message and everything that follows.
3. Stick to fixed channels
Have one main channel for pre-stay communication, and let the messaging in other channels mirror the content there.
4. Secure your own accounts
Much of this fraud starts with a phishing email to hotel staff. Remind employees to use strong, unique passwords that are stored securely, and to enable two-factor authentication.
How does Invite ensure trustworthy communication?
Invite delivers a complete digital guest journey. Being integrated with most major booking and lock systems requires us to ensure trustworthy customer and guest communication at every step. With Invite’s system, businesses can add tailored text and trusted sender names to the messages sent to guests. Businesses can also encourage their guests to download the Invite InStay app.
Invite is continuously working to make it easy for hotels to communicate securely, so that guests always know what comes from the hotel and what doesn’t.
“Scammers are becoming ever more creative, but we can make it much harder for them to succeed. When guests recognise the hotel’s voice, it’s easier to spot a fake message,” says Fossøy.
