The Reservation Hijack: How Criminals Use Your OTA Extranet to Defraud Your Guests

The most convincing scam message a guest will ever receive is one that knows their name, their dates, their room type and their booking reference.

That’s exactly what criminals have been sending to hotel guests around the world for the past two years, and 2026 has been the worst year yet. The data doesn’t come from the guest. It comes from the hotel. More precisely, it comes from a hotel’s OTA extranet (the partner portal you use to manage rates, availability and reservations), after a member of staff has been tricked into handing over access.

I want to explain how this scam works, because once you understand the sequence, most of it can be stopped with a few straightforward habits.

How the Reservation Hijack Works

The pattern security researchers have documented is remarkably consistent. It usually unfolds in three stages.

Stage one: the bait. A message arrives in your reservations or front office inbox. It looks like a guest complaint, a question about a booking, or a request to review a negative review. It’s polite, plausible and slightly urgent. It contains a link.

Stage two: the hook. The link leads to a page that looks like a booking platform login, or to a fake “verify you are human” check. The second version is particularly clever. It asks the member of staff to copy a short piece of text and paste it into their computer to complete the check. That text is actually a command that installs remote access software, giving the criminal control of the machine. Security researchers call this technique ClickFix. Microsoft has tracked one group running exactly this campaign against hotel staff across Europe, North America and South and Southeast Asia.

Stage three: the payday. With access to the computer or the extranet password, the criminal logs in as your hotel. They can see every upcoming reservation. They then message your guests, sometimes through the platform itself and sometimes by WhatsApp, explaining that a payment has failed or that the card needs to be “verified” within 24 hours or the booking will be cancelled. The guest sees their real booking details and pays.

The guest believes the hotel took their money. The hotel often doesn’t know anything has happened until the guest arrives, or complains.

This Is No Longer a Small Problem

Earlier this year, one of the major booking platforms notified customers that unauthorised third parties had accessed reservation details, including names, contact details and booking information. Reporting at the time linked the access to compromised hotel partner accounts, which is precisely the weakness this scam is built to find.

Japan has been hit particularly hard. From early May, Japanese hotels saw a surge of phishing attacks on guests who had booked through a major OTA, and the Japan Hotel Association issued a formal warning in June. More than 40 hotel groups and properties posted public notices, including some of the country’s best-known names. One listed hotel operator disclosed that criminals had accessed its group account and changed the bank details used to pay out its revenue. At a single property, roughly nine million yen was diverted before anyone noticed.

That last detail matters. The criminals are not only stealing from your guests. Once inside, they can redirect your own payouts.

Thailand is not immune. Our hotels use the same platforms, the same extranets and, in many cases, the same shared front office computers that make this attack easy.

Why Hotels Are Such an Easy Target

This isn’t written to criticise front office teams. As a former hotelier, I know how much pressure reservations staff are under. They answer guest messages all day, they’re trained to resolve complaints quickly, and a message about an unhappy guest is precisely the kind of thing they’re meant to act on. The criminals know that. They’ve designed the bait around the job.

Add to that a few habits that are common across independent hotels in Southeast Asia:

• one extranet login shared by several staff, sometimes written on a note by the screen
• former employees who still know the password
• two-factor authentication switched off because it’s “inconvenient” on night shift
• the same computer used for reservations, personal browsing and email
• nobody regularly checking the bank account details held on the extranet

None of these feels dangerous on an ordinary day. Together, they make a hotel very easy to impersonate.

The Habits That Stop It

The good news is that the defences are not technical or expensive. They’re mostly about discipline.

Give each person their own login and turn on two-factor authentication. Two-factor authentication means a password alone isn’t enough to log in; a code from a phone app is also needed. It’s the single most effective protection against a stolen password. The major OTAs all support individual user accounts, so use them, and remove access the day someone leaves.

Never paste anything into your computer because a website asked you to. A genuine login page or human-verification check will never ask you to copy and run a command. Make this a simple rule for everyone on the team, and repeat it until it’s second nature.

Treat guest complaints arriving by email with a link as suspicious. If a message refers to a booking, go to the extranet directly in your browser and check it there, rather than clicking through from the email.

Check your payout bank details every month. It takes two minutes. If they’ve changed and you didn’t change them, contact the platform immediately.

Tell your guests what you will never do. Add a short line to your confirmation emails and pre-arrival messages: we will never ask you to send card details by chat or WhatsApp, and we will never threaten to cancel your booking over a payment by message. It’s a small thing, but guests who’ve read it are far harder to fool.

A Point About Owning the Relationship

There’s a wider commercial point here, and it’s one I come back to often. When a guest books through an OTA, the OTA sits between you and that guest. You don’t fully control the channel through which they hear from you. When that channel is compromised, your reputation suffers even though the breach may not have started on your side.

Guests who book directly, and who receive their communication from your own systems on your own domain, are easier to protect and easier to warn. That’s not a reason to abandon the OTAs, which remain an important part of most hotels’ distribution. But it is another reason why the direct relationship with your guests is worth investing in.

If You Think It’s Already Happened

If a guest tells you they received a payment request you didn’t send, act on it as an emergency, not a customer service query. Change the extranet password, check which users have access, review the payout bank details, and contact the platform’s partner support straight away. Then check every computer that staff use for reservations. If malware has been installed, changing the password alone won’t fix it, because the criminal can simply watch you type the new one.

I’ll cover the first hour of a suspected incident in more detail in a later post in this series.

At The Percentage Company, we work with hotels across Thailand on their distribution, booking systems and the technology that holds them together. If you’d like to discuss your cyber security, get in touch with us today!