Travelers planning summer trips are being targeted by sophisticated phishing scams that impersonate legitimate travel companies like Booking.com. These scams leverage artificial intelligence to create highly realistic emails, often including personal details and offering enticing travel credits, to trick individuals into divulging sensitive information. Halimah Delaine Prado, Google's General Counsel, has noted the rise of AI-powered phishing originating from "outsider enterprises" in China, which are capable of creating convincing fake websites that defraud hundreds of thousands of Americans and result in millions of dollars in losses.
One such scam involves an email promising a $500 Booking.com travel credit. While appearing to be a genuine offer, closer inspection reveals several red flags. The sender's email address does not align with Booking.com's official domain, and the subject line, such as "(1) Pending," is vague and designed to create a sense of urgency. Scammers exploit the current travel season, knowing that individuals are actively booking flights and accommodations, making them more susceptible to such offers.
The deceptive emails often incorporate personal touches, such as using the recipient's real name multiple times, to enhance credibility. However, this personalization can be achieved by accessing data from previous breaches or public records, and does not indicate the email's legitimacy. A notable inconsistency in one observed scam email was a date mismatch: the email content referenced "March 2026," while it was sent on June 23, 2026. Such discrepancies can indicate reused scam templates.
Scammers also employ psychological tactics, including flattery by suggesting the recipient is a "loyal member" among a select group, and creating a false sense of urgency with strict deadlines, such as "before June 23, 2026, at 11:59 p.m." This pressure aims to prevent recipients from scrutinizing the details or verifying the offer through official channels.
The primary danger lies in the "Redeem Now" button. Clicking this link can lead to a fake Booking.com sign-in page designed to steal email addresses, passwords, payment details, or verification codes. These fake pages often mimic the legitimate website's branding, colors, and fonts. Experts advise against clicking any links within suspicious emails and recommend accessing Booking.com directly through its official app or by typing the website address into a browser to verify any offers or account information.
Booking.com has stated that the security and data protection of its partners and travelers are a top priority, employing dedicated teams and machine learning tools to monitor and block suspicious activity. The company advises travelers to keep all communication and payments within its platform, watch for unusual requests, and report suspicious messages through official customer service channels. They also emphasize that travelers should never move communication or payments outside of the platform, as this is a common tactic used by scammers to bypass security measures.
To protect against such scams, travelers are advised to always check the sender's email address carefully, be cautious of emails that use personal information, and avoid clicking links directly from emails. Instead, verify any rewards or credits by logging into the official Booking.com account or app. Turning on two-factor authentication (2FA) or passkeys for accounts, using strong antivirus software, and reporting phishing attempts are also crucial steps in safeguarding personal information and preventing financial loss. Utilizing a data removal service can also help reduce the personal information available to scammers for creating more convincing phishing attempts.