Quick answer: Hotels are frequently targeted by fraud such as fake reservations, payment with stolen cards, fake agency and supplier emails (BEC) and phishing aimed at guests. The most common scenarios try to trick the front desk into a money transfer or handing over card details. The foundation of defense is verifying payment and refund requests, questioning requests that arrive outside official channels, and training staff against these scenarios.

Why are hotels a target for fraudsters?

A hotel is a business that processes high volumes of payments, communicates with many strangers and is expected to give fast service. These three traits create the ideal environment for a fraudster. The front desk is in a hurry, wants to please the guest and often does not question an incoming request too much. The fraudster exploits exactly this trust and haste.

The most common hotel frauds

Scenario How it works
Fake reservation (stolen card) Booking with a stolen card, then refund or no-show fraud
Fake OTA message Impersonating a Booking message to request card details from the guest
BEC (supplier/manager impersonation) A fake email asking accounting for an urgent money transfer
Fake refund request Posing as a guest to extract a payment refund or an excess refund
Phone fraud (vishing) Calling as the bank or head office to make the front desk perform a transaction

BEC: the most expensive hotel fraud

Business email compromise (BEC) is one of the most costly threats for hotels. The fraudster impersonates the email of a supplier or hotel manager and asks accounting for an urgent payment or a bank account change. Because the email looks realistic and applies pressure of urgency, the money goes to the fraudster's account if no verification is done. The golden rule of defense is to always verify payment or account change requests through a second channel, by calling a known phone number.

Defense rules for hotel staff

  1. Always verify payment, refund and bank account change requests through a second channel.
  2. Never request full card details from a guest by email or OTA message, and treat messages that do as phishing.
  3. Treat requests with haste and pressure with suspicion, because urgency is the fraudster's strongest tool.
  4. Monitor suspicious reservation, refund and no-show patterns.
  5. Put staff through regular phishing and social engineering training and test them with simulations.

The KAOS and DSET approach

DSET runs phishing and social engineering simulations aimed at hotels and measures staff resilience against these scenarios. On the email security side we audit SPF, DKIM and DMARC configuration, because weak email protection makes it easier to send fake mail in the hotel's name. Our KAOS security engine reports such weaknesses on the hotel's external attack surface. Our goal is not selling fear but showing the real scenario with evidence and preparing staff.

Related reading: hotel reservation and channel manager security, KVKK and guest data in hotels, email fraud BEC and CEO fraud, phishing and social engineering simulation, corporate email security SPF DKIM DMARC, phone fraud vishing.

Frequently asked questions

How do you protect against BEC fraud at a hotel? The most effective defense is to always verify payment and bank account change requests through a second channel. If a supplier or manager asks for an urgent payment by email, call that person on a known phone number to confirm. No matter how realistic the email looks, no money transfer should be made without verification. You should also make it harder to send fake mail in the hotel's name with SPF, DKIM and DMARC.

Is it normal to be asked for card details in a Booking message? No, this is a typical sign of phishing. A legitimate OTA does not request full card details from a guest or hotel through a panel message. When such a message arrives, do not click, do not share card details, and verify the situation through the official OTA channel. These messages usually come from a compromised account or an imitation link.

Does staff training really reduce these frauds? Yes, because most of these frauds exploit human error rather than a technical flaw. When staff learn to recognize fake request patterns and the pressure of urgency, resilience rises significantly. Regular phishing simulation is the best way to measure whether the training is durable.

Sources

For a phishing simulation aimed at your hotel and an email security audit, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.