Payments, Impersonation & AI Scams: Protecting Your Front Desk & Finance Team

The most expensive cyber attack most hotels will ever suffer won’t involve a hacker breaking into anything. It will involve a member of staff doing exactly what they were asked to do, by someone who wasn’t who they claimed to be.

We tend to picture cyber crime as something technical: hooded figures, lines of code, servers under siege. Some of it is. But across Thailand’s hospitality sector, the losses I hear about most often come from something far simpler. A supplier’s bank details “change”. The owner sends an urgent WhatsApp asking for a transfer. A guest sends a photo of their credit card over LINE to secure a booking. Nobody’s systems were breached. Somebody was persuaded.

That kind of persuasion has just become much easier, and the reason is artificial intelligence.

What Has Changed

For years, the advice for spotting a scam email was to look for poor spelling, odd grammar and generic greetings. That advice is now out of date.

Generative AI (tools that can write text, create images and imitate voices on request) lets criminals produce messages that are fluent, polite and tailored to the person receiving them, in any language, at almost no cost. Email security firm Hornetsecurity, which analyses around 72 billion emails a year, found that emails carrying malware rose by 131% in 2025 compared with the year before, with scam emails up around 35% and phishing up 21%. More than three quarters of the security chiefs it surveyed now regard AI-generated phishing as a serious threat.

It isn’t only email. Verizon’s 2026 Data Breach Investigations Report noted that social engineering by phone and text message is becoming more successful than traditional phishing emails. And voice cloning has moved from science fiction to something that can be done from a short recording of someone speaking.

A message that looks professional, comes from a familiar name and contains no mistakes is no longer evidence that it’s genuine.

Here in Thailand, the scale of the problem is already visible. According to SCB EIC, Thais lost around ฿39 billion to technology-related crime in 2024 and around ฿32 billion in 2025. In the first seven months of 2026 alone, more than 190,000 cases were reported, with losses above ฿9.3 billion. Thailand’s Anti Cyber Scam Center has said that impersonation fraud causes the heaviest losses per case. Most of those victims are individuals rather than businesses, but the techniques are identical, and hotels move far more money than most households.

Card Details: The Habit That Has to Stop

I’ll start with the one I see most often, because it’s the easiest to fix.

In many hotels, it’s still normal for reservations staff to ask a guest to email or message their card details to guarantee a booking. Sometimes the guest sends a photo of the front and back of the card. That photo then sits in an inbox, a LINE chat and a phone’s camera roll indefinitely, often alongside hundreds of others.

This is a genuine risk, and it also falls foul of the card industry’s security rules (known as PCI DSS), which prohibit storing the three-digit security code at all once a payment has been authorised. If one staff phone or one shared inbox is compromised, every card in it is exposed.

The fix is straightforward:

• never ask guests to send full card numbers or security codes by email, LINE, WhatsApp or any chat
• use secure payment links generated by your booking engine, PMS or payment provider instead
• never keep card details in spreadsheets, documents or email folders
• delete any card images you already hold, from inboxes, chats and phones

Most modern booking systems can send a secure payment link in seconds. If yours can’t, that’s worth raising with your provider.

The Fake Supplier and the Urgent Boss

The second pattern is what security professionals call business email compromise. In plain terms, a criminal pretends to be someone your finance team trusts.

It usually takes one of a few forms. A long-standing supplier emails to say their bank account has changed and asks that the next invoice be paid to the new details. The owner or general manager messages the accountant late in the evening asking for an urgent transfer, explaining they’re in a meeting and can’t talk. A “guest” requests a refund to a different card or bank account from the one they paid with.

Sometimes the email genuinely comes from the supplier’s real address, because the supplier’s own email account has been hacked. That’s what makes these scams so effective. The usual signals look fine.

The only reliable defence is to verify the request through a different channel you already trust. That means picking up the phone and calling the person on a number you already hold, not one provided in the message. It takes two minutes, and it’s the single most effective habit I know of.

A few rules make this stick:

• any change to a supplier’s bank details is confirmed by phone on a known number before a single baht moves
• transfers above an agreed amount need approval from two people
• refunds go back to the original payment method only, without exception
• owners and senior managers agree with finance that urgent payment requests by chat will always be checked, and nobody will be offended when they are

That last point is cultural, and it matters. In many Thai businesses, junior staff feel uncomfortable questioning an instruction that appears to come from the owner. Criminals rely on that deference. Owners need to tell their teams, explicitly, that checking is expected and will never be punished.

When the Voice on the Phone Sounds Right

AI voice cloning deserves a specific mention, because it removes the safeguard most people instinctively trust. If it sounds like the boss, surely it is the boss?

Not any more. Short recordings from social media, a podcast or a voicemail greeting can be enough to create a convincing imitation. The practical answer is a simple one: agree a code word or question between owners and finance staff that must be used for any unusual payment request by phone. If the caller can’t answer it, the payment doesn’t happen. It feels slightly theatrical the first time. It stops working as a joke the first time it saves you a million baht.

The same applies to video calls. Thailand’s own authorities have warned that genuine officials do not conduct interrogations by video call and never ask people to transfer money to prove their innocence. The same logic applies to your business. A real partner will never object to you calling them back.

Training Beats Technology Here

Good email filtering, two-factor authentication and up-to-date software all help, and I’d recommend every hotel has them. But none of them can stop a member of staff who has been convinced to make a payment.

What stops that is a team that knows these scams exist, recognises the patterns, and has clear, simple rules that remove the need for judgement under pressure. Fifteen minutes in a monthly team meeting is enough. Walk through a real example. Ask who would have spotted it. Remind everyone of the call-back rule.

My message to every hotel team is the same one I’ve been sending to our own clients: stop, check and verify before sharing sensitive information, approving a payment or clicking on something unexpected. A few seconds of checking can make all the difference.

At The Percentage Company, we help hotels set up booking engines, payment links and guest communication that keep card details out of inboxes and chats altogether. If you’d like to review how payments and guest data move through your property, get in touch with our team today!