Travel scams have grown far more sophisticated, with fraudsters harnessing new artificial intelligence tools to build deceptive websites and exploit stolen data, according to Florent Silve, an executive at corporate travel management platform Engine.
"What used to look like a fake website now becomes much harder to spot by consumers," Silve said.
A Federal Trade Commission report released in June showed that Americans reported losing $3.5 billion last year to scams where impostors contacted them via text, email, phone, social media and search engines, though not all were travel-related. Impostor fraud accounted for nearly one in three reports, making it the single most common category of fraud.
Reservation hijacking has emerged as a frequent travel scam, according to Iskander Sanchez-Rola, a scam expert for cybersecurity firm Norton. Impostors send an email or text message pretending to represent your hotel, claiming an urgent issue such as a failed payment requires immediate action. Criminals often incorporate genuine details, including actual stay dates or the exact cost of your room, to appear legitimate.
"The main thing is that this isn't a fake booking confirmation, it's a real reservation that is weaponized against you," Sanchez-Rola said. He recommends avoiding any rush to pay using a provided link and instead calling the accommodation directly using the number listed on the official hotel website, not the one in the message.
Another widespread scheme centres on flight cancellations, with scammers sending urgent alerts stating a flight is delayed or cancelled and offering to assist with rebooking for an extra fee. Sanchez-Rola advises checking flight status directly on the airline's portal and rebooking only through the airline or the original booking provider. He also warned against sharing images of plane tickets or travel records on social media, as QR codes or barcodes can include information such as returning flights.
Alissa Abdullah, Mastercard's deputy chief security officer, said scammers place stickers over restaurant QR codes to redirect customers to fraudulent payment portals. If a payment page seems suspicious or a sticker is spotted over another code, she suggests speaking with staff and choosing a different payment method such as cash or a credit card.
Brian Cute, chief executive officer and director of the capacity and resilience program at Global Cyber Alliance, said cyber criminals sometimes create networks that look close to the name of a legitimate network to dupe users into logging on. If public Wi-Fi is necessary, he advises limiting use to basic tasks such as looking up directions rather than visiting sensitive sites like banking portals or email accounts.