Why a guest message is the risk that hurts
Hotel associations have warned for years about the same pattern. Someone gets hold of an extranet login, often through malware on a staff computer, and then messages guests with a new payment link. The guest sees a familiar channel and a real reservation, so the message looks genuine.
The login is usually the way in, so that's where to start: personal accounts, MFA on every account, and a clear list of who has access.
Already happening? Read Booking.com account hacked? What a hotel should do first.
What a review can cover for a hotel
| Category | For a hotel | What it can't show |
|---|---|---|
| C06 Email | SPF, DKIM and DMARC for your domain | Whether mail is truly protected |
| C08 Login and accounts | Supplied MFA and account settings | Whether MFA is enforced in practice |
| C09 Booking and ordering | Which providers you depend on | Whether those providers are secure |
| C07 Privacy indicators | What your notice says | Whether you comply with the GDPR |
We review supplied evidence. We don't test or log in to your booking platform, and third-party systems aren't tested through this website.
Questions from hotels
Why are hotels a target?
A hotel holds guest contact details, takes payments and depends on a few shared logins, often on a busy front desk computer. A taken-over booking extranet account lets someone write to guests from a channel they trust.
Do we need a penetration test?
Often the first question is simpler: who can log in where, and is MFA really on? We don't offer penetration testing. The QuickScan reviews the evidence you supply within an agreed scope.
Our booking account has just been hacked. Can you help?
We don't provide incident response, so contact your IT provider and your booking platform straight away. Our guide lists what hotels are advised to do first.
