Week 42: New hotel booking phishing scam targets TWINT accounts
The NCSC has previously reported on several phishing campaigns in which scammers exploited hotel bookings to obtain payment information. While these scams primarily targeted credit card details, recent cases show that methods are evolving. In the latest scams, the cybercriminals are attempting to gain control of victims' TWINT and e-banking accounts as well. This approach is similar to phishing scams involving online classified ads.
In recent years, the NCSC has observed a shift away from large-scale phishing campaigns towards more targeted and personalised scams, although mass campaigns are still common. Phishing attempts involving hotel bookings are part of this trend and have been reported to the NCSC on several occasions. What stands out in these cases is that the scammers have detailed information about hotel stays, including guests' names, email addresses, booking dates and hotel details. This information is believed to come from compromised booking systems and enables scammers to send highly convincing, targeted messages. As these messages fit seamlessly into the normal booking process and appear legitimate at first glance, they are much harder to recognise as scams.
Cloned websites and lookalike domain names
In the latest cases, the scam begins with the compromise of a hotel's booking or email system, as before. This gives the scammers access to customer information belonging to former and current guests, whom they then contact while posing as the hotel. To make the scam more convincing, they register lookalike domain names and create an almost identical copy of the hotel's official website. Victims are promised a 7.5% cashback payment on the accommodation they have already paid for. To receive the money, they are instructed to click a link in the email that supposedly takes them to the hotel's website, where they can claim their cashback.
On the fake hotel website, victims are invited to "claim" the supposed cashback payment. They are then given the option of having the refund paid directly into their TWINT account. However, after selecting their bank, they are redirected to a convincing imitation of the bank's login page. There, they are asked to enter their login details, which the scammers can then steal. The refund is therefore just a pretext for obtaining sensitive online banking credentials.
If victims enter their login credentials, the scammers will immediately attempt to use them to log in to their e-banking accounts. However, because online banking requires a second authentication factor, the scammers also need to bypass this additional security measure. To do so, they keep victims occupied with the supposed refund process on the fake website for as long as possible. Meanwhile, the scammers attempt to log in to the victims' e-banking accounts in the background. When the bank requests the second authentication factor, the victims are prompted to approve the login or enter the required confirmation code under false pretences. This allows the scammers to complete the authentication process and gain control of the e-banking account. In some cases, victims are also instructed to generate a code using a card reader and pass it on to supposed support staff. In reality, these codes are for the scammers' own login attempts.
The scammers' main aim is to change the phone number associated with the TWINT account. However, they could also use their access to make fraudulent payments directly through e-banking.
New scenario, same objective
The NCSC has been familiar with this approach for some time, having seen it used in scams involving online classified ad platforms. These scams primarily target sellers. The scammers pretend to be interested in buying an item and then claim they want to pay using a service provided by Swiss Post. They send the seller a QR code or link, supposedly allowing them to receive the payment directly into their TWINT account. In reality, however, these links lead to the same fraudulent phishing pages, where victims are tricked into entering their e-banking credentials.
The phishing attempts now being observed in connection with hotel bookings show that the scammers are expanding their activities into other areas. While the initial approach has changed, the ultimate objective remains the same: to trick victims into revealing their online banking credentials through fake TWINT and e-banking processes.
Recommendations
- Always be extremely suspicious of unsolicited messages regarding refunds or urgent requests to verify your credit card details, even if the sender appears to know your exact booking information.
- Never share codes you’ve received by text message.
- Don’t click on links in suspicious messages. Never enter personal information on websites you've reached via a link in a suspicious email or text message.
- If you are unsure whether a message is legitimate, log in directly to your booking account directly via the official app or website (without using any links from the message) or call the hotel using the official phone number that you have looked up yourself.
- You will never be asked to provide login details or scan QR codes to receive a refund.
- If you have already entered your card details on such a page, contact your bank or credit card company immediately to block the card.
- If you have suffered financial loss, the NCSC recommends reporting the incident to your local police. You can find your nearest police station on the Suisse ePolice website (available in German, French and Italian).