Phishing aimed at your staff
Front office, reservations and finance get messages from strangers every day. That's what makes them the easiest targets.
Phishing email held
- Subject
- “Verify your account within 24 hours”
- Attachment
- Invoice.pdf containing a QR codeNeeds checking
- QR leads to
- A fake sign-in pageNeeds checking
Illustration. Names, domains and data shown here are fictitious.
Fake messages that look like everyday work
Phishing is a fake message that gets staff to click a link, open an attachment or type in a password. In hospitality it often looks like everyday work: a supplier invoice, a guest complaint with a “photo” attached, or a verification request from a platform.
More recently, links are hidden in QR codes inside PDFs or images, so they slip past email filters and get opened on staff's personal phones.
What it means for your business
Passwords fall into the wrong hands
One email or platform password is enough to open many other doors.
A way in for ransomware
A malicious attachment can install software that later locks your PCs and PMS.
Payments get diverted
A compromised account can send fake invoices to guests and partners.
Warning signs to look out for
Share this list with your front office, reservations and finance staff. When in doubt, ask first.
- Time pressure: “your account will be closed”, “confirm now”, “24-hour deadline”.
- A guest complaint or invoice that asks you to open an attachment or link to see the details.
- A QR code in an email or PDF that asks you to sign in.
- A sign-in page appears after clicking a link, even though you're already signed in.
- The sender's address doesn't match the name shown.
- Odd attachment types like .html or .zip, or a document asking you to “enable content”.
How SiberWisata helps
Cloud Email Protection works inside the Google Workspace or Microsoft 365 you already use.
Cloud Email Protection
Phishing emails, malicious attachments and links hidden in QR codes are checked before they reach staff. If one gets through and later proves malicious, we pull it from every inbox and check who clicked.
See this service →Cyber Assurance
With Cyber Assurance, staff have someone to ask: forward a doubtful message and we'll tell you whether it's safe.
See this service →Monitoring is continuous. Analyst hours and response times are agreed per plan and written into the contract.
Malicious email pulled from 6 inboxes
One staff member opened the link. That account's password needs to be changed.
Illustration. Names, domains and data shown here are fictitious.
How it works
Email is checked
Every incoming email is checked: content, attachments, links and QR codes.
Misses are pulled back
If an email later proves malicious, we remove it from every inbox.
Accounts are secured
Staff who clicked get help changing their password, and suspicious sign-in sessions are cut off.
Related threats
All threats →Email account takeover
Work email taken over, including session theft that gets around two-step verification.
Read more →Hijacked OTA accounts
Your partner account on a booking platform is taken over and used to ask guests for payment.
Read more →Ransomware
Malware that locks computers and data, then demands a ransom, often at the busiest moment.
Read more →
Not sure your organisation is safe?
Tell us about your organisation. We look at your situation from the outside and explain what we find in plain language, without obligation.