The scams to know about
The “guest” with an attachment
A message arrives through your booking platform or by email from someone who says they are a guest. There is a complaint, a question about accessibility, or photos of a problem from their last stay, with a link or a file to open. Opening it installs software that steals the passwords saved in your browser, including your booking account. The scammers then use your account to message your real guests.
The fake warning from the platform
An email that looks like it is from Booking.com, Airbnb or a similar site says your account will be suspended, a payment has failed, or you need to confirm your details. The link goes to a copy of the login page. Anything you type there goes to the scammer.
Your guests asked to pay again
Once scammers are in your account, they message guests with upcoming bookings saying the payment did not go through, with a link to pay again. The guest loses money and blames you. Most platforms say clearly that they never ask guests to pay through a link in a message.
The overpayment
A direct booking pays more than the price “by mistake” and asks you to send back the difference. Later the original payment is reversed, and the money you sent back is gone.
The changed bank details
An email that seems to come from your cleaner, laundry or another supplier says their bank details have changed. The next payment goes to the scammer.
How to protect your business
- Switch on two-step verification for your booking platforms and your email. It is the single best protection: a stolen password is not enough on its own.
- Never log in from a link in an email.Open the app, or type the platform’s address yourself, and check for messages there. If a warning is real, it will be there too.
- Do not open files from people you have not hosted.Ask guests to describe the problem in the platform’s own messages instead. Be most careful with anything that asks you to download, enable, or copy and paste something to “see” a file.
- Keep payments on the platform. Tell guests in your welcome message that you will never ask them to pay through a link.
- Check changes by phone. If a supplier’s bank details change, ring them on the number you already have, not one in the email.
- Refund only to the original payment, and only once it has fully cleared.
- Use a password manager rather than saving passwords in your browser, so stolen browser data gives less away.
- Make sure anyone who helps with bookings, such as family or a changeover team, knows these rules too.
If it has already happened
- Change your booking platform and email passwords from a different, trusted device, and switch on two-step verification.
- Contact the platform’s partner or host support straight away so they can lock the account and warn your guests.
- Message your upcoming guests yourself to say they should ignore any request to pay through a link.
- If money has been taken, call your bank immediately.
- Forward scam emails to report@phishing.gov.uk.
Want a second pair of eyes? We work with holiday lets and guest houses across Swanage, Purbeck and Dorset. Our cybersecurity support includes checking your email and accounts, setting up two-step verification, and a short, practical session for you and anyone who helps with bookings.