Reservation Hijacking: 1 in 3 Fraud Reports Are Impostor Scams

For cybersecurity teams, the travel scam wave is a textbook supply-chain and social-engineering convergence. Attackers are not targeting travelers directly; they are compromising hotel staff through phishing to harvest legitimate reservation data, then using that stolen context to make BEC-style messages nearly indistinguishable from real hotel communications. With AI-generated sites erasing visual red flags, traditional detection methods fail before the user even sees a link.

Travel scams have moved from the physical realm of pickpockets to a digital supply-chain threat that exploits compromised reservation systems and AI-generated fake websites. An Associated Press report published on September 10, 2026, details how scammers use artificial intelligence to produce convincing fake websites and weaponize stolen booking data to hijack hotel reservations. Florent Silve, an executive at corporate travel management platform Engine, said AI tools have erased the visual and formatting errors that previously helped consumers spot fraudulent sites. Iskander Sanchez-Rola, a scam expert at Norton, highlighted reservation hijacking as a particularly concerning trend. In this scheme, attackers phish hotel staff to steal login credentials, then use that access to pull real reservation details. They contact guests with emails or texts that include accurate dates, prices, and stay information, claiming a payment failed and demanding immediate action. Because the message looks exactly like a communication travelers are already expecting, it bypasses the traditional 'this looks suspicious' mental check.

“

A report published in June 2026 found that Americans reported losing $3.5 billion last year to imposter scams delivered through text, email, phone, social media, and search engines.

The underlying mechanics represent a significant escalation in social engineering. Scammers target hotel systems by phishing employees, obtaining credentials that grant access to legitimate booking services. Once inside, they can exfiltrate reservation data, then craft messages that reference a victim's actual stay dates or the exact cost of their hotel room. This abuse of trusted data transforms a generic phishing attempt into a highly personalized fraud. The initial intrusion is not against the traveler but against the hospitality provider, making it a supply-chain and social-engineering problem rather than a simple consumer scam. Attackers no longer need to guess details; they can extract them directly from the systems that hold them.

Federal Trade Commission data underscores the scale of imposter fraud. A report published in June 2026 found that Americans reported losing $3.5 billion last year to imposter scams delivered through text, email, phone, social media, and search engines. Nearly one in three fraud reports involved imposter scams, making it the most reported fraud category. Not all of those losses were travel-related, but the travel industry's reliance on confirmation messages, payment links, and third-party booking systems makes it an ideal environment for imposter tactics. Travelers are conditioned to respond quickly to urgent messages about failed payments or reservation changes, and fraudsters exploit that conditioned urgency.