Travelling soon? Scammers are impersonating booking sites to steal your money

Dubai: Travellers booking flights, rides and hotels are increasingly being targeted by cybercriminals impersonating familiar travel brands, with nearly 270,000 attack attempts detected by Kaspersky over a 12-month period.

The cybersecurity company recorded 262,663 detections linked to attacks masquerading as major transport brands between the second quarter of 2025 and the first quarter of 2026.

Attacks using the appearance of Emirates accounted for 61% of detections associated with the transport brands analysed, while those masquerading as Uber represented 37%.

The findings do not indicate that the companies themselves were compromised. Cybercriminals were using the appearance and names of established brands to make phishing pages, fake applications and fraudulent offers look legitimate.

Trojans were the most commonly detected threat among files and objects associated with transport brands, accounting for 30.5% of detections, followed by Trojan-Bankers at 22.5%.

Trojan-Bankers are designed to steal banking credentials and payment information, meaning travellers responding to a fraudulent booking or account message could expose more than their travel details.

One scam identified by cybersecurity firm impersonated Ryanair and told travellers that they were entitled to flight compensation.

Victims were directed to enter their account credentials or pay a small processing fee to receive the supposed payout, while a countdown created pressure to complete the process quickly.

Kaspersky said extreme time pressure should be treated as a warning sign, with legitimate airline compensation claims not requiring travellers to make decisions within seconds or pay upfront fees to receive refunds.

Travel and accommodation platforms were also impersonated, although the number of detected attacks was considerably smaller than those involving transport brands.

Kaspersky recorded 5,414 attack attempts associated with travel and accommodation service brands between the second quarter of 2025 and the first quarter of 2026.

Trojans accounted for 54.6% of detections in this category.

One scheme copied the appearance of Booking.com and directed victims to a fake reservation page where they were asked to enter personal and payment information.

Travellers completing the process received no genuine reservation, with some potentially discovering the fraud only after failing to receive a confirmation or arriving at their destination without a valid booking.

Kaspersky advised travellers to make reservations directly through official websites or applications instead of following booking links received through emails, text messages or social media.

Website addresses should be checked carefully before payment information is entered because fraudulent pages can use domains that closely resemble genuine airline and booking websites.

Travellers should also be cautious about unusually cheap deals accompanied by demands for immediate payment, particularly when payment through wire transfers or gift cards is requested.

Strong and unique passwords, multi-factor authentication and applications downloaded only through official app stores can provide additional protection.

Bank and credit card statements should also be monitored after travel purchases so unfamiliar transactions can be reported quickly.

The cybersecurity firm advised people using QR codes while travelling to check that they come from trusted sources and verify website and payment details before proceeding.

Public Wi-Fi can create another point of exposure, particularly when travellers access email, payment services or online accounts through unsecured networks.