Hospitality Industry Faces Rising Threat of Phishing Attacks

Image generated with Ai

The hospitality sector is facing an unprecedented surge in cybercrime, with phishing attacks becoming increasingly targeted and sophisticated. Hotels, resorts, and booking platforms are being urged to enhance cybersecurity measures as cybercriminals actively exploit property management systems, booking channels, and staff email accounts.

Experts from leading hospitality technology providers, including Guestline (part of Access Hospitality), Mews, HotelTime, and Planet, have shared insights on the current threat landscape and outlined practical steps businesses can take to safeguard sensitive data.

Surge in Phishing Attacks

Cybersecurity specialists across the industry have noted a sharp rise in phishing attempts directed at hotel staff and systems. These attacks aim to steal credentials, gain unauthorized access, and ultimately compromise both guest and organizational information.

Nicola Longfield, General Manager for Accommodation at Access Hospitality, explains:

“Cybercriminals are increasingly targeting hotel property management systems, email platforms, and booking channels. They send emails that appear to come from trusted sources, including OTA platforms or internal systems, designed to deceive employees into revealing login information or installing malware.”

She adds that attackers often create nearly identical replicas of legitimate system login pages and even register similar domain names to trick unsuspecting staff. Sophisticated methods, such as using Google Ads to boost fraudulent websites’ visibility, are also employed.

“Once attackers gain access through stolen credentials, they can send fake reservation confirmations or phishing emails to guests, compromising trust and exposing sensitive information.”

Jan Hejny, CEO of Hotel Time, highlights that these phishing attempts are becoming increasingly contextual and targeted.

“Fraudsters often impersonate well-known brands, including hotels, booking platforms, and technology providers. They mimic realistic payment or booking scenarios and exploit urgency, such as failed payments or imminent cancellations, to pressure staff into taking immediate action without proper verification.”

How the Hospitality Sector is Responding

Security teams across the industry are taking proactive measures to reduce risk. Richard Johnson, Chief Information Security Officer at Planet, emphasizes collaboration:

“We work closely with hospitality teams to manage and minimize risk. Planet partners with security firms and authorities to identify, disrupt, and shut down fraudulent activity, including websites impersonating legitimate businesses. Fraud is a constant threat, but rapid intelligence sharing and awareness make it harder for criminals to succeed.”

These insights underline that combating phishing requires a combination of advanced technology, staff awareness, and industry-wide cooperation.

Key Recommendations to Strengthen Cybersecurity

Leading cybersecurity experts in hospitality have outlined several steps that hotels and resorts can implement to protect their systems and data.

1. Upgrade to Phishing-Resistant Multi-Factor Authentication

Diego Baldini, Chief Information Security Officer of The Access Group, stresses the importance of modern authentication methods:

“Phishing attacks can compromise hotel accounts, result in fraudulent communications sent to guests, and inflict serious reputational or financial damage if not detected and mitigated promptly.”

Access Hospitality recommends adopting passkey-based multi-factor authentication (MFA), which offers robust protection against phishing attempts. Unlike traditional one-time password codes, passkeys create a cryptographic link between a user’s account and the legitimate login page.

Key advantages of passkeys include:

• Phishing resistance: Passkeys only function on verified login pages and do not respond to fake or cloned websites.
• Credential safety: No passwords or codes are typed, reducing the risk of accidental sharing. The secret key remains on the user’s device and cannot be copied.
• User convenience: Authentication is faster through physical security keys (e.g., YubiKey, Google Titan Security Key, SoloKeys) or device-based biometrics, such as fingerprints or PINs.
• Cross-device support: Passkeys can be stored and used on mobile devices, laptops, and tablets across Android and iOS systems.

“Even organizations with existing MFA systems remain vulnerable unless they adopt phishing-resistant passkey technology,” Diego notes.

2. Promote Safe Login Practices

Training staff to recognize and avoid phishing attempts is critical. Organizations should encourage employees to:

• Bookmark official login pages instead of navigating via search engines, which can lead to look-alike phishing sites.
• Remain vigilant for suspicious emails, including unusual sender addresses, urgent language, unexpected attachments, or requests to share credentials.
• Immediately report suspected phishing attempts so that IT teams can quickly investigate and respond.

A strong culture of security awareness ensures that potential threats are identified and neutralized before causing harm.

3. Enforce Strong Password Policies

Even in an age of advanced authentication, strong password hygiene remains essential. Hotels should:

• Use long, unique passwords for all accounts and avoid reusing them across multiple platforms.
• Eliminate shared logins (e.g., [email protected]) for critical systems, assigning individual accounts with role-based access instead.
• Regularly review and update passwords to maintain protection against credential theft.

These measures significantly reduce the risk of unauthorized access and limit the potential damage of a successful breach.

4. Keep Software and Systems Up to Date

Outdated software is a major vulnerability in hospitality operations. To mitigate risks, hotels should:

• Install updates and security patches promptly on all systems.
• Deploy reputable antivirus software, malware protection, and firewalls to detect and block malicious activity.
• Maintain regular data backups and test recovery procedures to ensure rapid restoration if systems are compromised.

Keeping technology current and monitored helps prevent attackers from exploiting known weaknesses.

5. Foster an Ongoing Security Mindset

Beyond technical solutions, a culture of vigilance is essential. Security should be an ongoing priority across all levels of an organization, including management, staff, and partners. Regular training, awareness campaigns, and collaboration with industry security networks ensure that everyone remains alert to evolving threats.

Phishing Technology Awaits A Triumph For The Hospitality Industr

The hospitality industry is facing an urgent cybersecurity challenge as phishing attacks grow more frequent, targeted, and sophisticated. Threat actors aim to steal credentials, compromise systems, and exploit sensitive guest information, creating reputational and financial risks for businesses.

By adopting phishing-resistant technologies such as passkey-based MFA, promoting secure login practices, enforcing strong password policies, keeping systems updated, and fostering a culture of awareness, hotels and resorts can significantly strengthen their cybersecurity posture. Collaborative efforts across the sector, including information sharing and engagement with security experts, are also critical in staying ahead of cybercriminals.

Access Hospitality and its industry partners continue to guide hotels in adopting these best practices, enabling businesses to operate securely while providing exceptional guest experiences. With proactive cybersecurity measures, the hospitality sector can mitigate risk, protect guest trust, and safeguard operational continuity.

About Access Hospitality

Access Hospitality empowers hotels to streamline operations, increase revenue, and deliver exceptional guest experiences. Thousands of hoteliers rely on its cloud-based management platform to simplify daily operations while driving growth. From property management (PMS) and EPOS to staff scheduling, guest engagement, and event management, Access Hospitality’s comprehensive software solutions equip hotels with the tools needed to thrive in today’s competitive landscape.