Email security for hotels and hospitality: the real risks and how to stop them

A hotel's email inbox is open to the world by design. Guests, travel agents, booking platforms, wedding planners and suppliers all write to the front desk, and the staff reading those messages are trained to be helpful and fast. Criminals use that. This guide covers the email threats specific to hotels and hospitality groups, what the evidence says about them, and a checklist that fits a busy property.

Why are hotels targeted by email attacks?

Hotels are targeted because their staff must open unsolicited email, attachments and links from strangers as part of the job, and because those mailboxes connect to valuable systems: booking platform extranets, the property management system (PMS) and payment tools. One successful click at the front desk can expose guest reservations and card payments.

Several features of hospitality make it worse:

• Strangers are normal. A message from an unknown "guest" with a photo, a PDF or a link is routine, so the usual "do I know this sender?" test doesn't work.
• Shared inboxes and turnover. Reservations, sales and front desk addresses are often shared logins, used across shifts by seasonal and part-time staff.
• Platform accounts. An online travel agency (OTA) extranet login, such as a Booking.com partner account, gives access to guest names, dates and messages.
• Large deposits. Group sales, weddings and events involve deposits and supplier payments arranged by email.

What is the Booking.com phishing campaign against hotels?

It's a long-running phishing campaign, documented by Microsoft Threat Intelligence in March 2025, that impersonates Booking.com to infect hospitality staff with password-stealing malware. Microsoft tracks the group as Storm-1865 and says the campaign started in December 2024 and was "ongoing" as of February 2025 (Microsoft Threat Intelligence).

According to Microsoft, the campaign:

• targets people at hospitality organizations in North America, Oceania, South and Southeast Asia and Europe who are "most likely to work with Booking.com"
• uses lures that "vary greatly", including negative guest reviews, requests from prospective guests, online promotion opportunities and account verification
• includes "a link, or a PDF attachment containing one, claiming to take recipients to Booking.com"
• leads to a fake CAPTCHA page over a background that mimics Booking.com, which tells the user to open the Windows Run window, paste a command and run it
• delivers malware families including XWorm, Lumma stealer, VenomRAT, AsyncRAT, Danabot and NetSupport RAT, all of which, Microsoft says, "include capabilities to steal financial data and credentials for fraudulent use"

That copy-and-paste trick is called ClickFix: the page convinces you to run the attacker's command yourself, which gets around many controls that would block a downloaded file. Our ClickFix fake CAPTCHA guide explains it step by step.

Here's an example of the kind of message to treat with suspicion:

Example: "Subject: Guest complaint about your property. A guest has left a 1-star review mentioning a serious hygiene issue in their room. Please review the comment and respond within 24 hours to avoid the review being published: [View review]"

Check the claim inside the extranet instead. If you open the extranet from a bookmark and the message isn't there, treat the email as fake.

What other email threats do hotels face?

Beyond platform impersonation, hotels see invoice fraud, card data exposure, account takeover and the general phishing every business gets.

Card numbers sent by email

Guests still email card numbers, and staff sometimes ask for them. Don't. The PCI Security Standards Council says "PCI DSS Requirement 4.2.2. prohibits the sending of unprotected primary account numbers (PANs)" through end-user messaging, and names email, instant messaging, SMS and chat (PCI SSC FAQ 1085). A mailbox full of old card numbers also turns one stolen password into a much bigger incident. Our ecommerce email security guide covers handling card data that arrives by email anyway. This isn't compliance advice; ask your payment provider or a qualified assessor what applies to you.

Event deposits and supplier payments

Weddings, conferences and group bookings move real money by email, which makes them a fit for business email compromise (BEC): fraud where a criminal impersonates, or takes over, a trusted email account to redirect a payment. The FBI's IC3 recorded 24,768 BEC complaints in 2025, with $3,046,598,558 in reported losses across all industries (IC3 2025 report). The FBI's advice is to "use secondary channels and/or two-factor authentication to verify requests for changes in account information" (IC3 PSA I-091124-PSA). See vendor invoice fraud for a call-back procedure.

How do you train front desk staff to spot fake guest emails?

Train front desk staff with a short rule set they can apply in seconds: check the real sender address, never sign in from an email link, and never run anything a web page tells you to paste. Microsoft's own advice for this campaign is to check the sender's address, "hover over links to observe the full URL", contact the service provider directly, be wary of urgent calls to action, and look for typos and lookalike domains.

Make these the house rules:

1. Platforms are opened from bookmarks. Booking.com, other OTAs, the PMS and the channel manager are reached by bookmark, never from an email link.
2. Nobody runs pasted commands. No real CAPTCHA asks you to press Windows+R or open a terminal. If a page asks, close it and report it.
3. Attachments from strangers are opened with care. A "photo of the stain" or "my booking details" can be malware. Guests can paste text into the email body.
4. Payment changes are confirmed by phone on a number you already have, never one in the email.
5. One easy report button. Give staff a single way to report a suspicious email, and thank them when they use it. See how to report phishing email.
6. Know what to do after a click. Disconnect the computer, tell the manager, and change platform passwords from a different device. Our guide on what to do after clicking a phishing link covers the full sequence.

How should a hotel set up its email accounts?

Set up email so that every person who touches a platform, payment tool or guest data has their own account with multi-factor authentication (MFA), a second check at sign-in beyond the password. CISA's joint phishing guidance says to prioritize phishing-resistant MFA for administrator and privileged accounts, such as those with "broad access to customer or financial data" (CISA). Reservations and front desk logins that reach guest and card data deserve the same priority.

• Shared addresses as shared mailboxes. Keep reservations@ and frontdesk@ as shared mailboxes that named staff open with their own logins, not as one account with a shared password. See shared mailbox spam protection.
• MFA on the platforms too. Turn on two-factor sign-in for every OTA extranet, PMS and payment portal that offers it.
• Fast offboarding. Seasonal staff leave. Remove access on their last shift, as described in employee offboarding email security.
• Protect your domain. Publish SPF, DKIM and DMARC so criminals can't send email from your exact domain to your guests. CISA asks organizations to "ensure DMARC is set to 'reject' for sent emails". Our DMARC from none to reject guide explains the steps.

A DMARC record at enforcement looks like this (example domain):

_dmarc.example-hotel.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-hotel.com"

DMARC doesn't stop lookalikes such as example-hotel-reservations.com. For those, see lookalike domain phishing.

Is built-in email filtering enough for a hotel?

For a single small property on Microsoft 365 or Google Workspace, the built-in filtering plus MFA, DMARC and staff rules is a reasonable baseline. Both platforms include spam, phishing and malware filtering, and many hotels never need more. Our comparison of Microsoft 365 built-in protection vs a gateway sets out the trade-offs. Be honest about what any filter can do: ClickFix lures are designed to look like ordinary guest mail, so no filter catches every one, and the house rules above still matter.

An MX-level filter in front of your mailboxes helps in specific cases:

• Busy staff need a simple quarantine. Each user gets a personal quarantine with scheduled digest emails, so a held booking request can be found and released without calling IT.
• Several properties or brands. Per-domain pricing with unlimited mailboxes (mailbox count, not message volume) keeps seasonal hiring from changing the bill.
• Attachment and macro rules. Attachment-type filters and a Microsoft Office macro filter block the file types guests never need to send you.
• Outages. If your mail server is down, mail is held for up to 5 days and delivered when it's back, rather than bounced to a guest.

If you're comparing options, our small business solution page explains how iBlockSpam fits in front of Microsoft 365 or Google Workspace.

Hotel email security checklist

1. Turn on MFA for every mailbox, starting with reservations, front desk, sales and accounts.
2. Turn on two-factor sign-in on every OTA extranet, PMS and payment portal.
3. Replace shared logins with shared mailboxes opened by named users.
4. Bookmark every platform and ban signing in from email links.
5. Write a no-card-numbers-by-email rule and send guests a secure payment link instead.
6. Confirm every bank detail change for events and suppliers by phone.
7. Publish SPF, DKIM and DMARC, and move DMARC to enforcement.
8. Block risky attachment types, and filter inbound mail for phishing and malware.
9. Check mailboxes for unexpected forwarding rules. See malicious inbox rules.

Next steps

• Run your domain through the free Email Health Check to see your SPF, DKIM and DMARC status.
• Brief the front desk on the fake guest complaint example above this week.
• Paste the headers of a suspicious "Booking.com" email into the Email Header Analyzer to see where it really came from.
• If you want a filtering layer with per-user quarantine, see how iBlockSpam works for small businesses.

More threat guides are in our phishing and threats topic.