Direct answer: the biggest AI-era risk to a hotel’s Booking.com account is not a rogue chatbot. It is a well-written email to the reservations inbox that gets one member of staff to type their Extranet password into a fake login page, or to paste a ‘verification’ command that installs malware. Once criminals are inside the account they can see real reservations and message real guests asking for a ‘second payment’. Microsoft, Sekoia and Bridewell have each documented versions of this attack chain against hotels (Microsoft; Sekoia; Bridewell), and the UK NCSC assesses that AI gives criminals a clear uplift in exactly this kind of social engineering (NCSC). The fix is mostly process and identity, not new software. If you are also adding AI to your guest messaging or reservations inbox, build it so it makes these scams easier to spot, not harder.
This guide is for owners, general managers, revenue and reservations leads, and IT providers at UK hotels, B&Bs, serviced apartment and villa operators, plus tour operators and DMCs that hold OTA or channel manager logins. It is general information, not legal or security advice, and it does not describe any Kaize client incident. The example below is illustrative and built only from the published research cited.
What has actually been happening
The pattern is well documented and has been running for more than two years:
- December 2024 to at least February 2025: Microsoft Threat Intelligence tracked a campaign it calls Storm-1865. It impersonated Booking.com and targeted hospitality staff with emails about negative reviews, prospective guests, promotions and account verification. A fake CAPTCHA then told the user to press Windows+R, paste and press Enter, which ran a command that installed credential-stealing malware such as Lumma stealer, XWorm and AsyncRAT (Microsoft, 13 March 2025).
- April to October 2025: Sekoia described the ‘I Paid Twice’ campaign, named after a guest who paid once to the hotel and once to the criminal. Hotel machines were infected through the same ‘ClickFix’ trick. Guests then received WhatsApp or email messages with their real reservation details and a link to a Booking-branded card phishing page (Sekoia).
- From early January 2026: Bridewell tracked a new partner phishing kit. Emails from freshly created Gmail addresses, with subjects such as ‘Re: Automatic reply: Inquiry About Reserving Available Hotel Rooms’, linked to a ‘complaint’ page on a look-alike domain. Some used a Cyrillic ‘о’ in ‘booking’, and the infrastructure showed harmless decoy ‘hotel cleaning’ websites to visitors who failed its checks (Bridewell).
- April 2026: Booking.com confirmed that ‘unauthorized third parties’ may have accessed some guests’ booking information, including names, email addresses, phone numbers, booking details and anything shared with the accommodation. It said it had contained the issue and updated reservation PINs, and told The Guardian that financial information was not accessed (TechCrunch, 13 April 2026).
- June 2026: Switzerland’s National Cyber Security Centre reported more fraudulent WhatsApp messages that quoted real stays, dates and guest names. It described two variants: a fake ‘refund’ and the long-known takeover of hotel booking-system accounts, followed by urgent card ‘verification’ requests (NCSC Switzerland, 2 June 2026).
- October 2026: researchers at Gen Digital presented the ‘Reservation Hijack’ attack chain at Virus Bulletin 2026. It covers abuse of platforms including Booking.com and Cloudbeds and guest fraud delivered by platform messaging, SMS, WhatsApp and email (Virus Bulletin 2026 abstract).
The UK has felt it directly. Action Fraud received 532 reports of this Booking.com scam between June 2023 and September 2024, with victims losing £370,000. It says accommodation providers’ accounts were likely taken over through phishing (The Guardian, reporting Action Fraud figures). Sekoia also documents a criminal market in stolen Booking.com Extranet logins. High-quality logs are offered at $5 to $5,000, priced by number of properties, reservation volume and Genius tier, and the same buyers have expanded to Expedia, Airbnb and Agoda logins (Sekoia).
Where AI comes into it
The NCSC’s assessment is that AI gives criminals an ‘uplift’ in social engineering, phishing and passwords. For less-skilled criminals it gives a ‘significant uplift’. Generative AI can already write convincing lures ‘without the translation, spelling and grammatical mistakes that often reveal phishing’ (NCSC, near-term impact of AI). Its later assessment expects AI to keep making intrusion ‘more effective and efficient’ to 2027, increasing the frequency and intensity of threats (NCSC, 2027 assessment).
That matters for hotels because a lot of standard advice still leans on spotting bad writing. Booking.com’s own partner guidance lists ‘spelling mistakes, bad grammar’ among the warning signs (Booking.com for Partners), and Microsoft suggests checking for typos (Microsoft). That is still worth doing, but it is getting weaker. The NCSC’s wider point applies: training alone ‘can’t teach everyone to spot all phishing emails’, so defences need technical and process layers as well (NCSC phishing guidance).
There is a second AI angle that gets less attention. Hotels are now connecting AI tools to the same places criminals aim for: the reservations inbox, OTA messaging and the channel manager. Done carelessly, that adds new logins to steal and new ways for a fake message to look official. Done well, it can make the real hotel’s behaviour so predictable that a fake request stands out.
How the attack lands on an ordinary hotel day (illustrative)
Every step in that example comes from the published campaigns above (Microsoft; Sekoia; Bridewell). None of it needs the attacker to break Booking.com’s own systems. Action Fraud said the account takeovers were likely the result of phishing against the accommodation provider (The Guardian).
Eight controls that matter more than any new tool
1. One named login per person, with 2FA, on the Extranet and on email
Booking.com asks partners to create individual Extranet accounts rather than shared ones, and to add two-factor authentication to all work applications, ‘such as email’ (Booking.com for Partners). Microsoft goes further and recommends phishing-resistant authentication and MFA on all accounts, with no exclusions (Microsoft). The reservations mailbox matters as much as the Extranet, because password resets and alerts land there. Remove leavers and seasonal staff the day they finish. The NCSC’s advice is to remove or suspend accounts that are no longer used and keep privileged access to the minimum (NCSC).
2. Sign in from a bookmark, never from an email link
Booking.com tells partners to sign in through its own sign-in page (Booking.com for Partners), and Microsoft says to go to the website directly rather than follow a link (Microsoft). Make it a written front-desk rule: complaint, review and ‘verification’ emails are read in the Extranet, reached from a saved bookmark. The NCSC also notes that some password managers will not autofill on fake websites, which gives staff a useful warning sign (NCSC).
3. Front-desk PCs should not be able to run what a web page tells them to
The ClickFix step only works if an ordinary user can open the Run box and launch a script. The NCSC recommends limiting administrator accounts, keeping devices patched and not using admin accounts for email or browsing (NCSC). Microsoft lists controls such as blocking obfuscated scripts, checking links when they are clicked and network protection against malicious domains (Microsoft). Ask whoever runs your IT one direct question: ‘If someone at reception pastes a command into Windows+R, what stops it?’
4. Know the takeover signs and who checks them
Booking.com’s list of signs is practical: guests receiving payment requests you did not send, unrecognised changes to contact details, rates, availability, content or channel manager, ‘new location’ sign-in emails, and new 2FA phone numbers or users added to the property (Booking.com for Partners). Give one person a weekly check of users and 2FA numbers, and route ‘new location’ alerts to a monitored mailbox rather than one person’s inbox.
5. Tell guests what you will never do, and then never do it
The NCSC suggests telling customers what to look out for, for example ‘we will never ask for your password’ (NCSC). Booking.com advises partners to communicate with guests through Booking.com and avoid WhatsApp and other outside channels (Booking.com for Partners). Put one plain sentence in confirmations and pre-arrival messages: ‘We will never ask you to re-enter card details through a link in a message. If you are unsure, call us on the number on our website.’ This only works if your own team and tools keep to it, including any AI that writes guest messages.
6. Make AI guest messaging boringly consistent about money
If you use AI to draft or send OTA replies, set hard rules in the integration, not only in the prompt. The tool must never send a payment link, never ask for card numbers and never create urgency around cancellation. Any payment question goes to a person, who answers inside the platform. Our Booking.com Messaging API guide explains which requests must stay on the Extranet and how Booking’s phishing redaction appears in the API. The aim is simple: if your real messages never ask for money by link, guests and staff can treat any message that does as a scam.
7. Treat AI and integration credentials like Extranet passwords
An AI inbox assistant, a messaging integration or a channel-manager connector usually holds tokens that can read reservations or send messages. Those tokens are worth stealing in the same way as the logins Sekoia saw being sold (Sekoia). Give each tool its own credential with the narrowest scope the vendor offers, record who can see it, and rotate it when staff or suppliers change. If the tool reads untrusted email, also apply the controls in our prompt injection guide: an assistant reading a stranger’s email should have no more power than that stranger.
8. Use automation to flag look-alikes, not to judge them
Some of the most telling signs in Bridewell’s research are mechanical: brand-new sender addresses, look-alike domains, punycode (‘xn--’) domains that hide Cyrillic letters, and specific URL patterns (Bridewell). These are better caught by simple, deterministic rules in your email filter, such as ‘external sender + Booking.com branding + link not on booking.com’, than by asking a language model whether an email ‘seems genuine’. A model can then help with the next step, such as summarising why a message was held or drafting the alert to the team. The decision to release it stays with a person.
If it happens: the first 24 to 72 hours
Questions to ask your AI, PMS or channel manager vendor
- Which reservation data and which messaging actions can your tool reach, and can we limit it to the minimum?
- How are your tokens to our OTA and PMS accounts stored and scoped, and how do we rotate or revoke them?
- Can your tool ever send a link or a payment request to a guest without a person approving it? Can we switch that off completely?
- Does your tool follow, preview or summarise links in inbound email? If so, what stops it presenting a phishing link as a to-do item?
- What do you log, and how quickly would you tell us about unusual sign-ins or settings changes made through your connection?
FAQ
Is this only a Booking.com problem?
No. Sekoia found the same guest phishing pages impersonating Expedia and stolen-login buyers expanding to Expedia, Airbnb and Agoda (Sekoia), and the Virus Bulletin 2026 research covers Cloudbeds as well (Virus Bulletin). Booking.com is simply the most-targeted brand in the published reports.
We are a small B&B. Does any of this apply?
Yes, arguably more so. Small properties often share one login and run email and the Extranet on the same laptop. The first five controls cost almost nothing: separate logins, 2FA, bookmarks, a non-admin user account and one clear sentence to guests.
Should we stop using AI in guest messaging?
No. The risk in these campaigns comes from stolen human logins, not from AI replies. But AI messaging should strengthen the rule that money is never requested by link, and it should never weaken it.
Can AI detect these phishing emails for us?
It can help, especially in the mail filters most providers already run. But the strongest signals, such as new sender, look-alike domain and off-domain link, are better handled by fixed rules. Keep the final decision on anything involving credentials or payments with a person.
Kaize point of view
Most hotel AI projects begin with the guest conversation. We think this one should begin with identity. Before an AI tool is allowed to read the reservations inbox or reply on an OTA, every human and machine login near that data should be named, protected with 2FA, kept to the minimum access needed and watched. Then design the AI so the hotel’s real behaviour is consistent: no links asking for money, no invented urgency, and a person for every payment question. In a year when criminals can write as well as your front desk, a predictable process is the best protection your guests have.
Related reading: Booking.com Messaging API and AI auto-replies, prompt injection controls for travel AI agents, PCI DSS and cardholder data in AI checkout, what hotel and tour operator staff can put into ChatGPT, Copilot or Gemini and how travel companies should control AI agents.
If you run a hotel group or tour operator and want to add AI to reservations or guest messaging without opening new routes for fraud, Kaize can help you map the logins, set the guardrails and test the tools. Start with an AI opportunity review or discuss a project.