Travel phishing scams have reached alarming new levels this summer, and every traveller booking a hotel or flight online is a potential target. The volume of attacks has more than doubled in three years. Furthermore, criminals are building fake booking sites at an industrial scale, targeting your payment details and travel data precisely when you are most distracted. Here is what is happening and how to stay safe.
Travel Phishing Scams Surge 122%
The numbers behind this threat are genuinely alarming. Check Point Research found that the hospitality, travel, and recreation sector recorded 2,291 average weekly cyberattacks per organisation in May 2026. Specifically, that figure represents a 24% increase year-over-year, and a 122% increase since May 2023.
Furthermore, the fake domain problem is growing faster than ever. In May 2026 alone, 47,318 new travel-related domains were registered. Critically, one in every 112 of those domains is already classified as malicious or suspicious. Many others remain dormant, waiting to be activated during peak summer booking season.
How the Scams Are Being Built
Criminals are not creating these sites manually. Instead, they operate coordinated, automated registration campaigns. Check Point Research identified three bulk-registration campaigns in the May data alone.
One campaign registered over 210 sequentially numbered hotel-lure domains following templates like “hotel-stay[N].com.” Another impersonated American Express and Lloyds Travel Choice. A third targeted travellers with general holiday-themed lures using .ink domains, a top-level domain frequently associated with short-lived phishing operations.
As a result, when you search for a hotel or airline online, fake sites can appear in search results, ads, or email offers. These sites are designed to look legitimate and steal your credit card and personal details.
Why Travellers Are Easy Targets
Summer travel creates specific vulnerabilities that attackers exploit. Specifically, people booking under time pressure make less careful decisions. Furthermore, travellers often use unfamiliar devices or public Wi-Fi when away from home.
Additionally, the hospitality sector itself is poorly defended. According to Security Magazine, 92% of travel agencies experienced some form of cyber threat in the past 12 months. Furthermore, 66% reported a compromise of sensitive customer data. Consequently, both consumers and the companies they book through are vulnerable simultaneously.
How to Spot Travel Phishing Scams
A few clear signals can help you identify fake booking sites. First, check the URL carefully before entering any payment information. Legitimate hotel and airline sites use their own domains, not variations or misspellings.
Second, be suspicious of any booking email that asks you to click a link to confirm payment or re-enter card details. Reputable platforms do not work this way. Third, search for the hotel or airline directly using a known, trusted source rather than clicking links in emails or ads.
Fourth, look for HTTPS and a padlock in the browser bar, though note that this alone is not sufficient, since many phishing sites now use HTTPS too. Therefore, always cross-reference the domain name.
What to Do If You’ve Been Scammed
If you believe you entered payment details on a fraudulent site, act immediately. First, call your bank or card provider and report the transaction. Most issuers can freeze the card and initiate a dispute.
Second, change any passwords you may have used on the site. Third, report the fake site to your national cybersecurity agency, such as CISA in the US or NCSC in the UK. The travel phishing scam surge is a serious, growing threat. However, simple awareness and a few extra seconds of caution can prevent your summer plans from turning into a financial nightmare.
You may be interested in this article: Hotel Phishing Attack Targets Front Desk: How Travelers and Hotels Can Stay Safe.
