Fake booking messages and extranet takeovers: protecting the hotel and its guests

Hotel extranet phishing is an attack on the hotel's login to a booking site's back office, not on the guest's card. A staff member opens a fake message or file, the login is stolen, and the attacker then messages guests through the platform's own channel asking for card details or a payment. Two-step sign-in, one account per person and a clean device break the chain.

A front desk agent opens an attachment that looks like a new reservation, signs in when the page asks, and thinks nothing more of it. An hour later guests start receiving messages inside the booking platform's own thread, in the hotel's name, asking them to confirm a card to keep their room. This guide explains how the attack works, how to spot it, which protections actually stop it, what to tell guests before arrival, and what to do in the first hour after a suspected takeover.

What is hotel extranet phishing?#

It is an attack on the hotel's login to a booking site's back office, not on the guest's card. The attacker imitates something the hotel already trusts, gets a staff member to type a password into a fake page or open a hostile file, and then acts as the hotel.

The extranet is the private back office a booking site gives the hotel. From it, staff manage rates, availability, reservations, guest contact details and messages to guests. Phishing is a message, page or file that imitates a trusted sender in order to get a click, an opened attachment or a typed password. Account takeover is what follows: the attacker signs in with the stolen credentials and operates the account as if they were the hotel.

Hotels are worth attacking because one login reaches many reservations at once, plus guest names, arrival dates and a messaging channel guests already believe. The attack has three links: the lure, the credential capture, and the abuse. Breaking any one link stops the attack, which is why the protections later in this guide are grouped by link rather than by product.

For example, common lures include a document that claims to be a new reservation, a link to a guest complaint, a notice that the account will be suspended unless the hotel signs in again, and a file shared as an invoice. None of these are real; they exist only to get one click or one password.

This article describes the pattern in general terms, names no hotels and quotes no loss figures, because reported cases vary and the point is prevention.

How does an extranet takeover reach the hotel's guests?#

The attacker writes to guests through the booking platform's own messaging, so the message arrives in the thread the guest already trusts, with the platform's branding around it. That is what makes it convincing.

The ask is usually one of three things: card details to confirm the reservation, a small payment to secure the rate, or a link to a payment page that copies the platform's look. The message is personalized, because the attacker reads the reservation record first. It can carry the guest's name, arrival date and room type, which makes it far harder to dismiss than a generic email.

Before any guest is contacted, the attacker may make quiet changes: payout bank details, the hotel's contact email address, rate and availability edits, cancellations and modifications. Some of these harm the hotel before a single guest is messaged, which is why payout and contact settings deserve the protection described below.

Guests believe the message because it is inside the platform, not in an email inbox, and it appears to come from the property they booked. When the truth comes out, the guest blames the hotel, not the attacker, and often cancels or disputes the charge.

There is an honest limit here. The hotel cannot stop a guest from receiving messages on the platform. It can only make the real pattern known before arrival, so the fake one stands out.

How do you spot a fake message or a fake login page?#

Judge the message by where its link goes and what the page asks for, not by how polished it looks. A page that wants a password, reached from a link in a message, is the single most reliable warning sign.

Open the extranet from a bookmark you saved yourself. Never sign in from a link inside a message, even one that looks internal. When you do reach the sign-in page, read the address bar character by character: lookalike spellings, an extra word before the platform's name, a hyphenated subdomain, or a different ending such as .net where you expect .com.

Use a password manager. It will not fill a password into the wrong domain, so a missing autofill is itself a signal to stop and check the address. Treat unexpected attachments as hostile until proven otherwise, especially anything that asks you to enable content or to sign in again to view it.

Notice pressure. Account suspension, a missed reservation, a complaint deadline: urgency exists to shorten the time you spend checking. Finally, check the sender. The display name can be right while the address is wrong, and a message that arrives in the extranet inbox rather than by email deserves a second look.

Any no, or any hesitation, means stop and verify by phone.

Which protections actually stop an extranet takeover?#

Two-step sign-in and one named account per person remove most of the value of a stolen password. Everything else limits what a stolen session can change before someone notices.

Turn on two-step sign-in. After the password, the platform asks for a code or an approval on a phone, so a phished password alone stops working. Give every person their own account: a shared front desk login cannot be revoked for one leaver and cannot tell you who did what during an incident. Setting up user roles and permissions properly is the same discipline you need inside your property management system, and the same checklist thinking applies: PMS user roles and permissions: a setup checklist for hotels.

Keep one device or one browser profile for extranet work, with no personal email and no general browsing on it. Use a password manager and a unique password for the extranet, never reused from the hotel's email or the property management system.

Guard the two settings that turn a nuisance into a loss: payout bank details and the hotel's contact email. Require a second person to approve any change, and confirm it by phone on a number you already had. Review the account list monthly and remove departing staff the same day, including seasonal and agency staff.

Accept the trade-off honestly. Two-step sign-in costs a few seconds per shift and is one more thing that can go wrong at 2 a.m. Budget for the reset procedure before you enforce it.

What should the pre-arrival message tell guests?#

One plain sentence, in the same message that carries arrival details: the hotel never asks for card details, a deposit or a verification payment by message or link. Then give one channel the guest can use to check.

State the rule, not the risk. Three sentences are enough: what the hotel never asks for, how to reach the hotel directly, and what to do with a suspicious message. Put it where it will be read: the pre-arrival message the guest already opens for directions and check-in times, not a separate security email nobody reads. If you are building or revising that message anyway, hotel pre-arrival emails: what to send guests and when covers the full sequence.

Give a phone number and an email address the guest can verify against, so a suspicious message has something to be compared with. Ask the guest not to click, to contact the hotel directly, and to keep the message, because a forwarded copy is evidence for the platform and for the hotel's own record.

Do not claim the platform will never contact the guest. It does, legitimately, and a promise you cannot keep destroys the warning. Write it in the guest's language and keep the tone ordinary; a message that reads like an alarm teaches guests to ignore alarms.

What do you do in the first hour after a suspected takeover?#

Assume the login is compromised until proven otherwise. Cut access first, then find out what changed, then talk to guests, in that order.

In the first ten minutes, from a clean device, change the extranet password, confirm two-step sign-in is on, and sign out other sessions if the platform offers it. Contact the platform through its official support channel, using a phone number or address you already had, never one supplied by the suspicious message.

In the next twenty minutes, check payout bank details, the hotel's contact email, rate and availability changes, recent cancellations and modifications, and the sent-message folder. Preserve evidence before cleaning anything: screenshots with timestamps, the suspicious message with its sender details, and the login history if the platform shows it.

Then warn people, not just systems: a short script at the front desk for in-house and arriving guests, plus a message on the hotel's own channels. Escalate to the owner or general manager, then to legal and accounting counsel about any notification duty. Whether a notification duty exists, to whom and by when depends on the hotel's case and jurisdiction; confirm scope, timing and penalties with your adviser rather than acting on a general rule.

What record do you keep afterwards, and what do you review?#

Write a short incident record while memories are fresh, then change the one thing that would have broken the chain. A record nobody reads is paperwork; a review that changes one control is prevention.

The record holds a timeline, who did what, what the attacker changed, what was restored and when, and what guests were told. The review asks four questions: how did the message get through, who had access, was two-step sign-in on, and how long before anyone noticed.

Fix in this order: access, then device hygiene, then approval rules for payout and contact changes, then guest communication. Rehearse rather than file: a one-page card at the front desk with the first-hour steps, tested once a season, beats a policy document in a folder. Keep the guest-facing wording and the internal steps in the same place, so the person handling the incident is not also inventing the message. For the wider picture, including devices, backups and access beyond the extranet, see hotel cybersecurity checklist for owners and general managers.

What to do next#

The chain has three links, and the hotel controls two of them. Today, turn on two-step sign-in for the extranet, give every person their own account, and add the three-sentence warning to the pre-arrival message. Those three changes cost an afternoon and remove most of the value of a stolen password. Everything else in this guide, the checks, the first hour and the record, exists to catch what those three do not.