Hijacked booking platform (OTA) partner accounts
Attackers get into your partner account on a booking platform, then message your real guests through the platform's chat asking them to “re-verify their card” or pay through a link.
New sign-in to partner account email
- Account
- [email protected]
- Sign-in from
- A country never used beforeNeeds checking
- Time
- 03:12 WITA
- Just before
- “Verify your partner account” email opened 10 minutes earlierNeeds checking
Illustration. Names, domains and data shown here are fictitious.
Fake messages inside a real conversation
Many properties manage bookings through a partner account on an OTA platform. Attackers go after these accounts, usually with a fake email that looks like it's from the platform and asks staff to “verify the account”.
Once in, they can see upcoming reservations and message guests through the platform's chat. Because the message appears in the official conversation, guests trust it and pay through a fake link.
What it means for your business
Guests lose money
Guests enter card details or pay on a fake link, even though their booking is real.
Booking data exposed
Guest names, stay dates and contact details are visible to the attacker.
Your account may be restricted
The platform may limit the account while it investigates, just when you need to take bookings.
Warning signs to look out for
Share this list with your front office, reservations and finance staff. When in doubt, ask first.
- Emails asking you to log in to the “extranet” or “partner portal” via a link, not from the app or address you normally use.
- Guests ask why they've been asked to re-enter card details or pay through a link.
- Messages to guests that none of your staff wrote.
- Notifications of a new sign-in, password change or settings change that nobody on the team made.
- One password shared by many staff, with no two-step verification.
How SiberWisata helps
Booking platform partner accounts are usually tied to a work email and used on reservations PCs. That's where we can help.
Cloud Email Protection
Cloud Email Protection holds fake emails that imitate booking platforms, and flags suspicious sign-ins to the email used for your partner account.
See this service →Managed Detection & Response (MDR)
MDR watches the front office and reservations PCs where staff read email and log in to platforms, for signs of password theft.
See this service →Cyber Assurance
With Cyber Assurance, staff can forward any doubtful message “from the platform” to us before clicking anything.
See this service →Monitoring is continuous. Analyst hours and response times are agreed per plan and written into the contract.
Fake booking-platform email held
The “verify partner account” link goes to a site the platform doesn't own. Three staff received it.
Illustration. Names, domains and data shown here are fictitious.
How it works
Entry points watched
We monitor the partner account email and your reservations staff's devices.
Early signs caught
Fake emails, odd sign-ins and settings changes are flagged for an analyst to check.
Fast first steps
If an account is confirmed compromised, we help lock access, change passwords, turn on two-step verification and prepare a report to the platform through its official channel.
Related threats
All threats →Staff phishing
Fake emails, messages and QR codes aimed at front office, reservations and finance.
Read more →Email account takeover
Work email taken over, including session theft that gets around two-step verification.
Read more →Payment fraud
Fake “our bank account has changed” messages that divert payments from guests, agents or suppliers.
Read more →
Not sure your organisation is safe?
Tell us about your organisation. We look at your situation from the outside and explain what we find in plain language, without obligation.