Booking.com hack redirects users to fake payment page

Booking.com data breach overview: 

• Who: Security researchers at Akamai say bad actors are using a fake Booking.com payment page to steal consumers’ credit card information. 
• Why: The fake Booking.com payment page is part of a multi-step information stealing campaign where bad actors are breaching the systems of hotels, booking sites, and travel agencies. 
• Where: Consumers nationwide are at risk of falling victim to these hacking campaigns. 

Hackers have been using a bogus Booking.com payment page to steal consumers’ credit card information, according to security researchers.

The fake Booking.com payment page is part of a multi-step campaign wherein bad actors are breaching systems of hotels, booking sites, and travel agencies and stealing their customers’ financial data, reports Bleeping Computer. 

According to a security researcher at Akamai, consumers are being sent a link for an alleged card verification needed to keep a reservation that leads them to a fake Booking.com payment page. 

To protect themselves, consumers are advised not to click on any unsolicited links — regardless of how legitimate they appear  — and to be cautious of any messages that prompt them to take immediate action, reports Bleeping Computer. 

Bad actors corresponding with consumers through Booking.com’s official messaging platform, say researchers

Messages sent to consumers from the bad actors appear so real in part because they are sent from the booking site’s own official message platform, according to researchers, who warn this gives a consumer no reason to question whether they are legitimate. 

“After the infostealer is executed on the original target (the hotel), the attacker can access messaging with legitimate customers,” said Shiran Guez, information security senior manager at Akamai, as reported by Bleeping Computer.

Consumers are ultimately recommended to contact a business — in this case Booking.com — at an official email address or phone number to obtain clarification about any messages. 

In other data breach news, a class action lawsuit was filed against Dollar Bank this month by a consumer arguing the bank failed to adequately protect sensitive data of its customers during a data breach from 2021 to 2023. 

Dollar Bank is accused of failing to fulfill its promise to protect the data of its customers during the data breach, which allegedly may have affected more than 13,000 of its current and former customers.

Have you been sent a link to a fake Booking.com payment page? Let us know in the comments! 

Read About More Class Action Lawsuits & Class Action Settlements:

• Mr. Cooper class action claims mortgage provider’s negligence resulting in data breach
• Dollar Bank class action claims data breach affected 13K+ current, former customers
• Postmeds class action alleges data breach compromised customer personal, health info
• FTC to require more entities to report data breaches