![\"Booking.com](\"https:\/\/www.europesays.com\/canada\/wp-content\/uploads\/2026\/05\/6e3e7e17f52295b104bbbc45dfd8df2e.jpeg\")
Booking.com screen <\/p>\n Booking.com screen <\/p>\n
We all get itchy feet as the climate begins to warm. For many Canadians coming out of a long winter, that means getting ready to travel.<\/p>\n
But a recent data breach at one of the world’s largest accommodation and reservations sites is putting travellers at increased risk for phishing attacks.<\/p>\n
The travel site Booking.com, based in Amsterdam (1), confirmed with CBC News that it was the target of a data breach and has been informing its customers of the issue (2). The travel site told CBC that no banking information was compromised as a result \u2014 only booking details and contact information were accessed \u2014 but the spokesperson did not disclose how many users were impacted by the event. However, the lack of financial data hasn’t stopped bad actors from using the information for nefarious ends.<\/p>\n
Don’t Miss <\/p>\n
Mert Aktas, a resident of Istanbul, Turkey, who used the site to book a hotel in Greece months ago, told the news outlet that he received an odd WhatsApp message from an unknown number asking him to click on a link to complete his check-in. After discussing the issue with Booking.com for “days”, Aktas was finally told there was a data breach, confirming his information was compromised.<\/p>\n
“I was very actually upset for those people who will be getting scammed,” he told the outlet. “Also, I was just a bit upset because my information has been stolen.”<\/p>\n
CBC reported that other clients of the site have received odd communications asking them to re-confirm their bookings, and some users have stated they’ve noticed large, unauthorized transactions on their credit cards.<\/p>\n
In response to the breach, a spokesperson for Booking.com told CBC in an email that, “Booking.com will never ask guests to share credit card details by email, over the phone, Whatsapp or text, and it won’t ask for a bank transfer.”<\/p>\n
A new twist on a familiar fraud <\/p>\n
This recent wave of booking scams resulting from the data breach is a subset of phishing, and it’s particularly dangerous.<\/p>\n
Phishing scams use socially-engineered emails or texts to ask consumers for private information, often masquerading as legitimate companies (3). They’ll use urgent “act now” language such as informing a customer their account has an issue and that they need to access a link to fix the problem.<\/p>\n
Story Continues <\/p>\n
Once sensitive information is shared with the scammer, such as credit card details or banking information, they’ll use it to access bank accounts or make unauthorized transactions (4). If these transactions go unnoticed, users could end up with a damaged credit score.<\/p>\n
The scams resulting from the Booking.com data breach are much more effective than typical phishing scams because of the travel-specific information the bad actors now have. This type is particularly valuable to scammers, as it allows them to craft messages that closely resemble legitimate booking communications.<\/p>\n
Experts are dubbing these frauds “reservation hijacking scams”.<\/p>\n
“Reservation hijack scams have been around for some time, but this new data makes them much more dangerous because it gives criminals precision as they can reference the real property, the real travel dates, the right contact details to make the scam feel like routine customer service,” Luis Corrons, security evangelist at Norton told the BBC (5).<\/p>\n
This isn’t the first time a reservation hijacking scam wave has appeared \u2014 the BBC has reported on multiple instances since 2023 (5), and phishing is one of the top 10 types of fraud in Canada based on the number of reported incidents.<\/p>\n
According to the Canadian Anti-Fraud Centre’s (CAFC) 2024 Annual Statistical Report, there were over 3,500 reports of phishing sent to the agency and over 1,000 targets (6). Phishing was one of two fraud types that increased in victimization. However, the CAFC also notes that reported fraud likely only accounts for five to 10 percent of all fraud in Canada (7).<\/p>\n
Read more: Here are the 3 net worth milestones that change everything for Canadians<\/a> (and what they say about you)<\/p>\n How to spot reservation hijacking red flags <\/p>\n If you’re one of 72% of Canadians planning to travel this year (8), you need to be on the lookout if you’ve made any reservations with Booking.com. Here are some expert tips to help you notice any signs of potential fraud (9).<\/p>\n Be wary of external links. If you receive an email, text message or direct message with an external link, always exercise caution. Even if it appears to be legitimate, verify it by contacting the company you booked with first. Never click on a link you aren’t certain is legitimate.<\/p>\n Watch for urgent language. Be skeptical of language that prompts you to act quickly or immediately, especially if it is asking for personal information. Take special note of any threats in the email that seem out of character for the company, such as a warning your account will be closed if you don’t confirm your booking information.<\/p>\n Check for inconsistencies. While fraudsters can create compelling emails and other online traps, their efforts are not always impeccable. Review the email address or website link to see if there are any spelling mistakes or slightly odd phrasing (e.g. bookingsite.com instead of booking.com). These are strong warning signs.<\/p>\n Stop leaving money on the table with high fees and low interest. View our top-rated Canadian banks and switch to a better account today<\/a>.<\/p>\n What to do if your information is compromised in a data breach <\/p>\n Hearing that your data has been compromised due to a breach can send you into a panic. Thankfully, there’s a simple protocol for Canadians to follow if their information has been compromised (10).<\/p>\n Contact your service provider and financial institutions. As soon as you are aware that your data is compromised, alert any companies where that account information was used, as well as your bank.<\/p>\n Flag the issue to credit bureaus. The next step is to contact Equifax and TransUnion, Canada’s main credit bureaus. Ask them to place a fraud alert on your credit report. Doing this prevents anyone from borrowing money on your behalf \u2014 lenders will need to contact you personally before approving any credit applications.<\/p>\n Report the issue to the authorities. Even if no fraud has occurred following the breach, reporting the incident to your local police and the CAFC is good practice.<\/p>\n Take precautionary measures. You can never be too careful with your online identity following a data breach. Don\u2019t just change your password for the compromised account, do so for your email, online shopping profiles, banking accounts, etc. It’s also critical to review your banking and credit card statements on a regular basis going forward to catch any odd transactions you didn\u2019t authorize. Ordering a copy of your credit report and reviewing it is also a prudent choice.<\/p>\n What To Read Next <\/p>\n Join 19,000+ readers and get Money.ca\u2019s best stories and exclusive interviews first \u2014 clear insights curated and delivered weekly. Subscribe now.<\/a><\/p>\n Article Sources <\/p>\n We rely only on vetted sources and credible third-party reporting. For details, see our ethics and guidelines<\/a>.<\/p>\n Booking.com (1<\/a>); CBC News (2<\/a>); Government of Canada (3<\/a>); Cloudflare (4<\/a>); BBC (5<\/a>); CAFC (6<\/a>); Competition Bureau Canada (7<\/a>); Ipsos (8<\/a>); Norton (9<\/a>); Financial Consumer Agency of Canada (10<\/a>)<\/p>\n This article originally appeared on Money.ca<\/a> under the title: Booking.com data breach puts Canadian travellers at risk \u2014 how to spot the scam<\/a><\/p>\n This article provides information only and should not be construed as advice. It is provided without warranty of any kind.<\/p>\n","protected":false},"excerpt":{"rendered":"Booking.com screen We all get itchy feet as the climate begins to warm. For many Canadians coming out…\n","protected":false},"author":2,"featured_media":29208,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[13607,17,13608,7145,811,10212,7049],"class_list":["post-29207","post","type-post","status-publish","format-standard","has-post-thumbnail","category-canada","tag-banking-information","tag-canada","tag-credit-cards","tag-data-breach","tag-dave-ramsey","tag-phishing-attacks","tag-reservation"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/posts\/29207","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/comments?post=29207"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/posts\/29207\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/media\/29208"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/media?parent=29207"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/categories?post=29207"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/canada\/wp-json\/wp\/v2\/tags?post=29207"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}