KR

They knew your hotel and check-in date. That didn't make the payment request real. A hotel reservation contains details that can make a scam convincing: your name, where you're staying, when you arrive and sometimes your booking reference, email or phone number. Those details help a hotel prepare for your stay. In the wrong hands, they help someone impersonate it. This isn't only a hypothetical risk. On March 12, 2024, Switzerland's National Cyber Security Centre described criminals taking over hotels' @bookingcom accounts. Guests received messages containing correct reservation information. Links led to fake pages that displayed those details and asked for card information. On July 16, the centre warned about the pattern again. Access to current bookings allowed attackers to send requests that looked like genuine hotel communications. The message could arrive through a channel the guest already trusted. It could name the right hotel and the right dates. Those details made the request persuasive, not legitimate. UK Action Fraud documented the financial consequences. Between June 2023 and September 2024, it received 532 reports involving these hotel-account scams, with reported losses totalling £370,000. An important distinction: these warnings concern compromised hotel accounts on a booking platform. They do not establish that Bookingcom's central systems were breached. But for the traveller receiving a convincing payment demand, the immediate problem is the same. Someone has enough information to pretend they are handling the reservation. WHY BOOKING PRIVACY MATTERS Privacy isn't only about keeping a card number secret. An itinerary reveals where you expect to be and when. Contact details give someone a way to reach you. A reservation reference can make a fraudulent message sound informed. Put those details together and an urgent “update your payment or lose your room” message becomes harder to dismiss. That is why the amount of information collected matters, along with how it is secured, shared and retained. The UK's Information Commissioner's Office describes data minimisation as keeping personal data adequate, relevant and limited to what is necessary. For travel, that means asking a straightforward question: does this booking actually need this information? Some information is necessary. Hotels need guest details to fulfil a stay. Payment providers need information to process a transaction. Legal requirements can also apply. The issue is unnecessary collection and retention beyond those purposes. Information that was never collected cannot later be exposed from that system. Information that must be collected still needs proper protection. WHAT TO LOOK FOR BEFORE BOOKING → a clear explanation of what personal data is collected and why → information about which hotels, suppliers and payment providers receive it → a retention policy explaining how long information is kept → choices about optional marketing and profiling → a clear way to ask about your data and exercise applicable privacy rights “No account required” can remove an extra registration step. It does not mean the reservation is anonymous or that no personal data is retained. Paying with crypto also does not erase a hotel reservation. Public blockchain transactions can leave their own trace. WHAT TO DO WHEN A PAYMENT MESSAGE ARRIVES → open your booking through the official app or a website address you enter yourself → compare the request with the payment terms on your original confirmation → verify unexpected demands using contact details from the hotel's official website → don't treat correct hotel names, dates or references as proof that a message is genuine Hotels can legitimately require deposits or payment guarantees. The warning sign is an unexpected demand that you cannot verify, especially one pressuring you to act through a new link. This is why we believe privacy matters in travel. A booking should collect what the stay requires, explain where that information goes and avoid keeping unnecessary details. Privacy-conscious booking is not a promise that no hotel or supplier can ever be hacked. It is a reason to ask better questions before handing over your information.

48 hours until Mumbai 🇮🇳 Still no room near BKC? You're not the only one, and you've still got time. → hotels across Mumbai, paid in crypto or card → DEVCON50 takes $50 off stays over $250 See you at Devcon 🫡

You can now book on Flyfi using Grok Bot. Think about the night before a trip. Ten tabs open, card in hand, still no room. → Tell Grok Bot where you're going → It books the hotel on Flyfi → Your travel cards stay safe in its Vault Then you get to just pack and look forward to it.

Travel should be about feeling free, not feeling watched. Where you stay, how you pay, and what you choose to keep private should be yours to decide. No unnecessary questions. No judgment. Just your next destination, on your terms. Your wallet | Your room | None of our business. Book your next stay with crypto on Flyfi.