Apr 24, 2026
We all get itchy feet as the climate begins to warm. For many Canadians coming out of a long winter, that means getting ready to travel.
But a recent data breach at one of the world's largest accommodation and reservations sites is putting travellers at increased risk for phishing attacks.
Advertisement
The travel site Booking.com, based in Amsterdam (1), confirmed with CBC News that it was the target of a data breach and has been informing its customers of the issue (2). The travel site told CBC that no banking information was compromised as a result — only booking details and contact information were accessed — but the spokesperson did not disclose how many users were impacted by the event. However, the lack of financial data hasn't stopped bad actors from using the information for nefarious ends.
Mert Aktas, a resident of Istanbul, Turkey, who used the site to book a hotel in Greece months ago, told the news outlet that he received an odd WhatsApp message from an unknown number asking him to click on a link to complete his check-in. After discussing the issue with Booking.com for "days", Aktas was finally told there was a data breach, confirming his information was compromised.
"I was very actually upset for those people who will be getting scammed," he told the outlet. "Also, I was just a bit upset because my information has been stolen."
CBC reported that other clients of the site have received odd communications asking them to re-confirm their bookings, and some users have stated they've noticed large, unauthorized transactions on their credit cards.
In response to the breach, a spokesperson for Booking.com told CBC in an email that, "Booking.com will never ask guests to share credit card details by email, over the phone, Whatsapp or text, and it won't ask for a bank transfer."
A new twist on a familiar fraud
This recent wave of booking scams resulting from the data breach is a subset of phishing, and it's particularly dangerous.
Advertisement
Phishing scams use socially-engineered emails or texts to ask consumers for private information, often masquerading as legitimate companies (3). They'll use urgent "act now" language such as informing a customer their account has an issue and that they need to access a link to fix the problem.
Once sensitive information is shared with the scammer, such as credit card details or banking information, they'll use it to access bank accounts or make unauthorized transactions (4). If these transactions go unnoticed, users could end up with a damaged credit score.
The scams resulting from the Booking.com data breach are much more effective than typical phishing scams because of the travel-specific information the bad actors now have. This type is particularly valuable to scammers, as it allows them to craft messages that closely resemble legitimate booking communications.
Experts are dubbing these frauds "reservation hijacking scams".
"Reservation hijack scams have been around for some time, but this new data makes them much more dangerous because it gives criminals precision as they can reference the real property, the real travel dates, the right contact details to make the scam feel like routine customer service," Luis Corrons, security evangelist at Norton told the BBC (5).
Advertisement
This isn't the first time a reservation hijacking scam wave has appeared — the BBC has reported on multiple instances since 2023 (5), and phishing is one of the top 10 types of fraud in Canada based on the number of reported incidents.
According to the Canadian Anti-Fraud Centre's (CAFC) 2024 Annual Statistical Report, there were over 3,500 reports of phishing sent to the agency and over 1,000 targets (6). Phishing was one of two fraud types that increased in victimization. However, the CAFC also notes that reported fraud likely only accounts for five to 10 percent of all fraud in Canada (7).
Must Read
- Stop the leak: 5 costs Canadians (still) overpay for every single month. How many are sabotaging your 2026 budget?
- What's your worth? Here are the 3 net worth milestones that change everything for Canadians (and what they say about you)
- Dave Ramsey says this 7-step plan ‘works every single time’ to kill debt, get rich — and that ‘anyone’ can do it
Join 19,000+ readers and get Money.ca’s best stories and exclusive interviews first — clear insights curated and delivered weekly. Subscribe now.
How to spot reservation hijacking red flags
If you're one of 72% of Canadians planning to travel this year (8), you need to be on the lookout if you've made any reservations with Booking.com. Here are some expert tips to help you notice any signs of potential fraud (9).
- Be wary of external links. If you receive an email, text message or direct message with an external link, always exercise caution. Even if it appears to be legitimate, verify it by contacting the company you booked with first. Never click on a link you aren't certain is legitimate.
- Watch for urgent language. Be skeptical of language that prompts you to act quickly or immediately, especially if it is asking for personal information. Take special note of any threats in the email that seem out of character for the company, such as a warning your account will be closed if you don't confirm your booking information.
- Check for inconsistencies. While fraudsters can create compelling emails and other online traps, their efforts are not always impeccable. Review the email address or website link to see if there are any spelling mistakes or slightly odd phrasing (e.g. bookingsite.com instead of booking.com). These are strong warning signs.
Stop leaving money on the table with high fees and low interest. View our top-rated Canadian banks and switch to a better account today.
What to do if your information is compromised in a data breach
Hearing that your data has been compromised due to a breach can send you into a panic. Thankfully, there's a simple protocol for Canadians to follow if their information has been compromised (10).
- Contact your service provider and financial institutions. As soon as you are aware that your data is compromised, alert any companies where that account information was used, as well as your bank.
- Flag the issue to credit bureaus. The next step is to contact Equifax and TransUnion, Canada's main credit bureaus. Ask them to place a fraud alert on your credit report. Doing this prevents anyone from borrowing money on your behalf — lenders will need to contact you personally before approving any credit applications.
- Report the issue to the authorities. Even if no fraud has occurred following the breach, reporting the incident to your local police and the CAFC is good practice.
- Take precautionary measures. You can never be too careful with your online identity following a data breach. Don’t just change your password for the compromised account, do so for your email, online shopping profiles, banking accounts, etc. It's also critical to review your banking and credit card statements on a regular basis going forward to catch any odd transactions you didn’t authorize. Ordering a copy of your credit report and reviewing it is also a prudent choice.
Article Sources
We rely only on vetted sources and credible third-party reporting. For details, see our ethics and guidelines.
Booking.com (1); CBC News (2); Government of Canada (3); Cloudflare (4); BBC (5); CAFC (6); Competition Bureau Canada (7); Ipsos (8); Norton (9); Financial Consumer Agency of Canada (10)
You May Also Like
- Here are 6 simple ways to avoid the stress of living paycheque to paycheque, according to Suze Orman
- If you’re still feeling the pinch this month — don’t panic. Here are 5 easy ways to fix your finances without a total overhaul
- How Warren Buffett’s simple buy-and-hold real estate approach offers a lesson for Canadian homeowners and long-term investors
- Approaching retirement with no savings? Don’t panic, you're not alone. Here are easy ways you can catch up (and fast)
Brett Surbey is a corporate paralegal with KMSC Law LLP and freelance writer who has written for Yahoo Finance Canada, Success Magazine, Publishers Weekly, U.S. News & World Report, Forbes Advisor and multiple academic journals. He and his family live in northern Alberta, Canada.
