Booking accommodation in Luxembourg can be risky
Jae Park, Unsplash
No sooner has the holiday booking and hotel room confirmation process been completed than a message arrives on the customer’s personal mobile number via WhatsApp, demanding that they verify the booking or face its cancellation. The text specifies the exact dates of the upcoming trip, the recipient’s first and last name, and a link to enter their details. Because the scammers refer to the details of a genuine booking, such messages appear extremely convincing and are aimed at people who are actually planning to check in soon.
However, a closer examination of the situation reveals signs of cybercrime. In particular, the messages are often sent from UK telephone numbers, and the hyperlink leads to an unknown third-party website that has no connection to the hotel’s official site or the Booking.com platform. The Luxembourg National Federation of Hoteliers and Restaurateurs (Horesca) has already recorded 15 official cases of fraud at local hotels.
The attackers are posing as administration staff and attempting to obtain bank card details. The affected hotels have confirmed that these incidents involve the Lighthouse / Cubilis online booking system, which manages the flow of bookings from hotel websites and aggregators such as Booking.com and Expedia. A direct technical vulnerability in the platform has not yet been proven, but the incidents have forced the federation to report the matter to the police.
The high effectiveness of this phishing campaign is due precisely to its highly targeted approach, based on genuine data. In addition to WhatsApp, the criminals use SMS messages, email and even the internal chat features of legitimate booking services. Horesca Secretary General Steve Martinelli emphasises that the main signs of a scam remain the sender creating a false sense of urgency and requests for confidential financial information. Experts strongly advise users to ignore such notifications, not to click on any embedded links, and to contact hotel management exclusively via official, verified channels.
