The Swiss Federal Office for Cyber Security reports a new phishing variant: emails sent in a hotel's name, containing real booking details, promise a 7.5% refund and lead to fake bank and TWINT pages. How it works, what accommodation providers should do and what the Swiss data protection act requires.
On 20 October 2026 the Federal Office for Cyber Security (FOCS) described a new phishing variant linked to hotel bookings in its weekly review. Guests receive an email that appears to come from the hotel where they stayed or are about to stay, with their correct name, dates and booking details. The message promises a refund, but its purpose is to gain access to the victim's e-banking and TWINT account.
For a tourist region like Ticino this concerns hotels, holiday flats, B&Bs and anyone who manages bookings for them. The starting point is not the guest: it is the hotel's system.
How the scam works
According to the FOCS, in the current cases the fraudsters first compromised a hotel's booking system or email. This gave them the data of past and current guests. They then contact those guests in the hotel's name, from web addresses that closely resemble the real one and with an almost identical copy of the official website.
The message offers an alleged 7.5% cashback on the price already paid. On the fake site the guest can "claim" the refund and choose to receive it in their TWINT account. After selecting their bank, they are taken to a counterfeit login page where they enter their e-banking credentials. While the victim is kept busy in the refund process, the fraudsters use those details to log in to the real e-banking and, under a pretext, ask the victim to confirm the second factor or pass on a code. The aim described by the FOCS is to move the linked TWINT account to another phone number; direct payments from e-banking are also possible.
The scheme is not new: the FOCS has long known it from scams on classified ad platforms, where sellers are the target. The entry scenario has changed, the goal has not.
Why this matters for SMEs too
What makes the message credible is the real booking data. Without a compromised system, the scam loses most of its force. For the hotel the damage is twofold: its own guests are defrauded in its name, and it is almost always a personal data security breach with legal consequences. The same mechanism can hit any SME that keeps customer data in a management system, an online shop or a shared mailbox.
What to do if you run an accommodation business
- Protect logins. Turn on multi-factor authentication, or better passkeys, for email, booking portals, channel manager and property management system. The differences between methods are explained in our article on the FOCS five levels.
- Limit who sees the data. Personal accounts instead of shared ones, immediate removal of access for former staff and suppliers, regular checks on who can export guest data.
- Keep the website and systems up to date. Website, plugins and booking software must be kept current: earlier this year the FOCS already reported an increase in compromised Swiss websites, most of them running WordPress.
- Tell guests what you never ask for. In booking confirmations and on the website, one clear sentence: the hotel never asks for bank credentials, SMS codes or a QR code scan for a refund. And an official phone number that is easy to find.
- Watch for look-alike domains. Technical protection of your own email domain (SPF, DKIM, DMARC) stops others from sending in the name of your real domain, but it does not stop an almost identical domain registered by someone else. It helps to know who can monitor such domains and have them taken down.
- Prepare the response. Who to call, who changes the passwords, who informs guests: deciding this in advance saves precious hours. The "SME Cybersecurity 2026" study points to organisational preparation as the weak spot of many SMEs.
If the system has already been compromised
First, cut off the fraudsters' access: change passwords, end active sessions, check email forwarding rules and contact the booking system provider. Then warn guests, because fake messages may keep arriving even after the clean-up.
The Federal Act on Data Protection requires appropriate security measures (Art. 8 FADP). If a data security breach is likely to result in a high risk for the data subjects, the controller must report it as soon as possible to the Federal Data Protection and Information Commissioner (FDPIC), which provides a reporting portal, and must inform the data subjects if this is necessary for their protection (Art. 24 FADP). Booking data used to defraud guests is a case where the risk must be assessed carefully.
The obligation to report a cyberattack to the FOCS within 24 hours applies to operators of critical infrastructure. Other companies can report an incident voluntarily through the FOCS reporting form. In case of financial loss, the FOCS recommends filing a complaint with the police; Suisse ePolice lists the nearest police station.
What the FOCS recommends to guests
- Be very suspicious of unsolicited contact about refunds or urgent card verifications, even if the sender knows your booking details.
- Never pass on codes received by SMS.
- Do not click links in suspicious messages and never enter data on pages opened from them.
- If in doubt, log in to your booking account through the official app or website, or call the hotel on a number you looked up yourself.
- A refund never requires credentials or scanning a QR code.
- Anyone who has already entered card details should contact their bank or card issuer immediately to block the card.
The same rules apply to staff: a message that looks credible because it contains real data is still a message to verify. Another recent example is WhatsApp accounts hijacked through fake voting requests.
Frequently asked questions
A guest reports a suspicious email in our name: what should we do?
Confirm to the guest that the message did not come from you and ask them not to use the link. Then immediately check logins and forwarding rules for email and the booking system, and warn other guests with upcoming stays.
We use an external booking platform: is it their responsibility?
It depends on where the compromise happened. Access often goes through the hotel's own credentials, for example a mailbox or a portal account. In any case, involve the provider straight away and clarify who is the controller for the data concerned.
Is DMARC enough to stop these emails?
No. DMARC protects your domain from misuse and is recommended anyway. The fraudsters described by the FOCS, however, use similar but different domains, which your domain's DMARC does not cover.
Our approach
ElaraTeq Sagl builds and runs websites, booking systems and mailboxes for SMEs and accommodation providers in Ticino, with hosting in Switzerland, protected logins and scheduled updates. For a review of your email setup, website or access controls, you can contact us.
Sources
- FOCS, Week 42: New hotel booking phishing scam targets TWINT accounts, 20 October 2026
- FOCS, Increase in compromised websites with fake CAPTCHAs, 7 August 2026
- FOCS, reporting form; reporting obligation for cyberattacks on critical infrastructure
- FDPIC, data security breach reporting portal
- Fedlex, Federal Act on Data Protection (FADP), SR 235.1, Art. 8 and 24
- Suisse ePolice, police station search
