Help desk impersonation, fake booking-site emails, and vendor risk drive travel cyber losses. See the patterns, the MGM figures, and a practical defense plan.
Travel and tourism companies hold payment cards, passports, and booking data. They run around the clock, depend on many vendors, and get busiest when staff are most stretched. Three attack patterns keep coming back. Attackers trick the IT help desk, phish booking platforms, and get in through vendors. All three start with trust. So the defense starts with checking identity and training the people at the front line.
Attackers go where the data and the pressure are, and travel offers both.
The data is rich. Hotels, airlines, and tour operators hold names, contact details, birth dates, and ID or passport numbers. Payments flow all day through booking engines, travel agencies, and card processors. So one stolen booking login can expose many guests at once.
The pressure is real too. Operations never stop, and peak seasons bring rushed staff. Teams also rely on a long chain of vendors. Rushed, helpful people are exactly who social engineering targets. Airlines show the same pattern, since airlines under IATA face email fraud in similar ways.
The costliest public example comes from MGM Resorts in September 2023. In an SEC filing, MGM estimated a negative impact of about $100 million to Adjusted Property EBITDAR in September, plus under $10 million in one-time expenses. Occupancy fell to 88%, compared with 93% a year earlier, partly because bookings through its website and mobile apps were disrupted.
Customer data was also taken. For some customers who booked before March 2019, the attackers got names, contact details, birth dates, and driver’s license numbers. A limited number of customers also lost Social Security or passport numbers.
MGM’s filing does not say how the attackers got in. Reports at the time said the group claiming credit had phoned the help desk after finding an employee on LinkedIn. Treat that account as reported, not confirmed. Even so, it matches a pattern defenders see often.
Discover how Threatcop protects your workforce from modern cyber threats.
A help desk exists to help. Managers measure staff on speed, and callers often sound stressed. That is the ideal setting for a convincing impersonation, and vishing attacks use it on purpose.
The numbers show how common this has become. Mandiant’s M-Trends 2026 report found that voice phishing was the most common way into cloud environments.
| Initial vector in cloud intrusions | Share |
|---|---|
| Voice phishing | 23% |
| Third-party compromise | 17% |
| Stolen credentials | 16% |
| Email phishing | 15% |
| Insider threats | 14% |
Two of those rows matter most for travel. Voice phishing leads, and third-party compromise follows. Both abuse trust in a person or a supplier, not a flaw in software.
Booking platforms are a second target. For example, Microsoft Threat Intelligence reported a phishing campaign, which it tracks as Storm-1865, that impersonated Booking.com and targeted hospitality organizations. It began in December 2024, ahead of some of the busiest travel days.
The emails carried a link, or a PDF holding one, that led to a fake Booking.com page. The page used a fake CAPTCHA to run a ClickFix attack, a trick that makes the user run the malware. It told the user to open a Windows Run window and paste a command. That command installed malware that steals logins, and the goal was fraud and theft.
Notice how well the lure fits the job. A hotel worker who handles Booking.com messages every day expects them, so the timing near peak season added pressure. Holiday phishing scams work the same way, by borrowing a busy moment.
Travel businesses rely on property systems, booking engines, travel agencies, and payment processors. So a weakness at any of them can reach the business without touching its own network.
Third-party compromise ranked second in Mandiant’s cloud data, so this is not a niche risk. Ask each key vendor four questions. Do you require MFA? How fast will you tell us about an incident? What access do you have to our data? How do you check callers who ask to change our accounts? Then limit each vendor to the data it needs.
So start with the roles that carry the most risk. Each needs one clear habit.
| Role | Main risk | One habit to teach |
|---|---|---|
| IT help desk | Fake callers | Verify identity through a call-back to a number on file before any reset |
| Reservations | Fake booking site messages | Open the platform from a saved link, never from a message |
| Finance | Payment and bank detail changes | Confirm changes by phone with a known contact |
| Front desk | Fake guest or supplier requests | Report odd requests before acting |
| Managers | Pressure to skip checks | Back staff who pause to verify |
Test the plan before a real incident. Run a short tabletop exercise each quarter in which a caller asks the help desk to reset a manager’s access during a busy check-in period. Time how long staff take to verify the caller, and note where the process breaks. A rehearsal finds gaps that a policy document never will.
Three changes help every role. Protect booking and admin logins with phishing-resistant MFA. Teach staff never to paste a command that a web page gives them. And make reporting a one-click habit, so a suspicious message reaches security within seconds.
Seasonal hiring and shift work make one annual course a poor fit. Staff need short practice for their own role, including phone calls, since the help desk is a weak point.
Threatcop Security Awareness Training (TSAT) runs simulations across multiple attack vectors, including voice, SMS, and QR codes, alongside email. So help desk and reservations staff can meet a pressured caller in a safe setting. TSAT’s Employee Vulnerability Score then shows which roles struggle, and repeat-offender identification points coaching at the people who need it.
TSAT also reports average breach time, which shows how fast a lure turns into a compromise. And its Active Directory integration keeps role groups current as seasonal staff join and leave, so the right simulations reach the right people.
Travel and tourism firms do not face peculiar attacks. They face ordinary tricks aimed at rushed, helpful people with valuable data. The MGM filing shows how costly one weak point can be, and Microsoft’s Booking.com findings show how closely attackers time lures to peak season. So verify identity before every reset and payment change. Protect booking and admin logins with phishing-resistant MFA. Ask vendors hard questions. And train front-line staff, including seasonal hires, with short practice they can finish. Trust is the business model in travel, so build checks that protect it.
Travel businesses hold payment cards, passports, and booking data, and they run constantly with many vendors. Peak seasons add pressure on staff. Attackers combine rich data with rushed, helpful people, which makes social engineering especially effective.
In travel cybersecurity terms, the MGM Resorts attack is the costliest public case. MGM estimated a negative impact of about $100 million to Adjusted Property EBITDAR in September 2023, plus under $10 million in one-time expenses. Attackers also took personal data for some customers, including driver’s license numbers. MGM’s filing did not say how they got in.
Common routes include phone calls to the help desk from fake employees, and fake emails posing as booking sites. Microsoft documented a Booking.com campaign aimed at hospitality organizations that used a fake CAPTCHA to install credential-stealing malware. Learning to recognize social engineering attacks helps staff spot both.
There is no single answer, but social engineering is the common thread. Fake help desk callers, fake booking site messages, and hacked vendors all exploit trust. Verifying identity before resets and payment changes addresses the most expensive ones.
Use short lessons and tests for each role, not one annual course. Include phone-based practice for help desk and reservations staff, keep role groups synced with the directory, and give everyone a one-click way to report a suspicious message.
Praveen Pal Singh is the Growth Director – North India & ASEAN at Threatcop, with experience spanning cybersecurity, business growth, and People Security Management. He works with organizations to address human-layer risks and strengthen their cybersecurity resilience. His areas of expertise include cybersecurity awareness, social engineering, phishing, email security, human risk management, and People Security Management. He is passionate about helping organizations build stronger, people-centric defenses against evolving cyber threats.
Teen-led groups hit M&S, Co-op, and Harrods through help desk calls. See why young people turn to hacking and...
NCA research found cyber suspects average 17 years old, and most start before 16. See why arrests do not...
AI code is flawed in nearly half of tested tasks, and developers are targets too. See how to train...
