3 ms·

The messaging system is full of disclaimers ("The content of the message from Malmaison was not generated by Booking.com") and, looking at a message I've receiv

by lol768 3y ago

The messaging system is full of disclaimers ("The content of the message from Malmaison was not generated by Booking.com") and, looking at a message I've received, it doesn't even support links. Anyone getting phished would have to manually type in a URL in their address bar if this was the vector used.

daveoc64 3y ago
I don't think the scams use links. They post bank account details for the customer to send a payment to. Manually typing a link may not seem suspicious to many customers anyway. Edit: Looks like the scam may involve credit/debit cards and links. The messages may be sent to customers via email, and the links are clickable that way. Not sure if that's an email client thing or if Booking.com makes them clickable in HTML.
- lol768 3y ago
  > They post bank account details for the customer to send a payment to. This is even less credible to me than a phishing site set-up to take card details. As soon as you try to make a payment to a scammer's bank account, confirmation of payee will fail because the bank details won't match the hotel's. It should also raise alarm bells because it's a completely out-of-character thing to be asked to do prior to a stay with a hotel.
  - insomniacity 3y ago
    Does Confirmation of Payee even exist outside the UK? Even if it did exist within other countries, I highly doubt there is international integration.
    - lol768 3y ago
      PSD3 covers international IBAN verification and will, thanks to regulation, ensure that this works cross-border. I think the technical aspects are fairly similar to CoP as we have it in the UK. Even in its absence though, the international payment flow puts enough friction into the process it would probably ring some alarm bells for a potential victim.
- Celmfire 3y ago
  I have received one of these scam messages in the app - they do indeed contain clickable links which go to a replica of the real website, where customers are asked to input credit card details to "confirm their booking". In my case the message promised "your card will not be charged at this time". I must say it's a clever approach; generally poor English in messages is a red flag for scams, but you tend to forgive that when you know it's coming from a hotel in another country.

by lol768 3y ago

daveoc64 3y ago

I don't think the scams use links. They post bank account details for the customer to send a payment to. Manually typing a link may not seem suspicious to many customers anyway. Edit: Looks like the scam may involve credit/debit cards and links. The messages may be sent to customers via email, and the links are clickable that way. Not sure if that's an email client thing or if Booking.com makes them clickable in HTML.

lol768 3y ago
> They post bank account details for the customer to send a payment to. This is even less credible to me than a phishing site set-up to take card details. As soon as you try to make a payment to a scammer's bank account, confirmation of payee will fail because the bank details won't match the hotel's. It should also raise alarm bells because it's a completely out-of-character thing to be asked to do prior to a stay with a hotel.
- insomniacity 3y ago
  Does Confirmation of Payee even exist outside the UK? Even if it did exist within other countries, I highly doubt there is international integration.
  - lol768 3y ago
    PSD3 covers international IBAN verification and will, thanks to regulation, ensure that this works cross-border. I think the technical aspects are fairly similar to CoP as we have it in the UK. Even in its absence though, the international payment flow puts enough friction into the process it would probably ring some alarm bells for a potential victim.
Celmfire 3y ago
I have received one of these scam messages in the app - they do indeed contain clickable links which go to a replica of the real website, where customers are asked to input credit card details to "confirm their booking". In my case the message promised "your card will not be charged at this time". I must say it's a clever approach; generally poor English in messages is a red flag for scams, but you tend to forgive that when you know it's coming from a hotel in another country.