Australian travellers targeted in sophisticated hotel booking scam after RMS Cloud cyberattack
‘I did click on it just to see where it took me and it took me to the picture of the hotel that I booked and the exact room.’
Australian travellers have been targeted by a sophisticated hotel booking scam after hackers accessed customer information held by an accommodation software provider.
Scammers have been using reservation details to send fraudulent messages threatening to cancel bookings unless travellers reconfirm their payment information.
WATCH THE VIDEO ABOVE: Thousands of Australians caught in booking platform hack
Sign up to The Nightly's newsletters.
Get the first look at the digital newspaper, curated daily stories and breaking headlines delivered to your inbox.
By continuing you agree to our Terms and Privacy Policy.RMS Cloud, a property management software provider used by hotels, motels, holiday parks, campgrounds and serviced apartments, confirmed on Tuesday it was investigating the phishing messages.
The company said guest names, contact information and booking details had been accessed, but that credit card and payment details were not compromised.
“RMS is also aware of phishing communications sent by an unknown entity claiming to be RMS or one of RMS’ customers,” the company said in an updated statement on Wednesday.
“The communications quote reservation information, request confirmation of payment details, and may be received via email, text message or WhatsApp.
“We are treating this matter with the utmost urgency, and recognise the concern and disruption this has caused our customers and their guests.
“We are working closely with affected customers to make sure their guests have clear information and practical guidance while our investigation continues.”
RMS customers, including Reflections, BIG4 and G’day Parks, have issued warnings to guests following the incident.
“We are contacting you as a past guest to make you aware our third-party booking system provider, RMS Cloud, has confirmed a global incident,” Reflections said in an email.
“Please do not click any links, open attachments, or share payment or personal information.”
Convincing scam
Similar scam messages have also been reported by travellers who booked accommodation through Booking.com, Agoda and Trip.com.
Perth man Wayne Garrard, 68, told 7NEWS.com.au one of his friends “nearly fell for it”.
The friend, who had booked accommodation through Booking.com, received a WhatsApp message asking him to reconfirm his payment details or risk having his reservation cancelled.
“He actually clicked on the link, and it takes you to the room that you bought on booking.com,” Garrard said.
The friend entered his credit card details, but was alerted by his credit card when the scammers attempted to charge him €400.
He rejected the transaction before posting a warning on Facebook.
Another friend responded to the post, saying he had received a similar WhatsApp message despite booking through Agoda.
What shocked Garrard the most is that, about 30 minutes after seeing the initial warning on Saturday, he received a suspicious message himself.
Garrard, who was holidaying in Vietnam, had booked accommodation through Trip.com and was due to move to another hotel a few days later.
The WhatsApp message appeared to come from a business account and contained details of his upcoming reservation.
“Please ensure the confirmation is done within 24 hours; otherwise, the room may be offered to other guests,” the message read.
It included his hotel details, booking dates and reservation reference number.
“I knew straight away that it was a scam, but I did click on it just to see where it took me and it took me to the picture of the hotel that I booked and the exact room,” Garrard said.
“It looked perfect — the booking.com website with the hotel room and everything.”
He said a chat window then opened, instructing him not to close the page and to follow further directions.
However, Garrard stopped before providing any information.
“I felt lucky that my friend had warned me,” he said.
“It’s like, how did they get all this information?”
“If this happened to three of us, it could be a massive scam.”
South Australian woman Diane McAskill also received a similar WhatsApp message.
“I knew straight away something wasn’t right,” she told 7NEWS.
“I didn’t click on any links so I didn’t give them any information. But what information they do have is still uncertain.”
More victims feared
The Australian Competition and Consumer Commission (ACCC) said 62 reports of the scam had been received over the past three days, with one victim losing more than $300.
The consumer watchdog warned there could be more cases that had not been reported.
South Australia’s Consumer and Business Services Commissioner Brett Humphrey urged travellers to remain vigilant.
“If it doesn’t quite feel right, stop! Don’t give your details,” he said.
7NEWS.com.au has contacted booking.com, Agoda, and trip.com for comment.
Originally published on 7NEWS
