Guests of hotels and holiday parks around Australia have been receiving scam emails, texts and WhatsApp messages that look completely genuine. They quote the guest’s real booking number, room type and check-in dates, then claim the card used to book has been blocked and ask the guest to click a link to “verify” their payment details.
The messages did not come from the hotels. According to the ABC, guest names, contact details and booking information were stolen in a breach of RMS, an Australian booking software provider used by more than 6,000 hotels, holiday parks and serviced apartments. Operators named in ABC reporting include BIG4, Reflections, G’day Parks, Discovery Parks and Wrest Point in Hobart. RMS says no credit card or payment details were accessed.
Why this matters beyond hospitality
None of these businesses was hacked directly, yet it is their name on the scam. One Victorian holiday park manager told the ABC: “Our details are being used, which reflects on us as a business.”
Most small businesses now rely on outside software for bookings, invoicing, payroll or customer records. That is usually a sensible choice, because a specialist provider can afford better security than you could build yourself. But as one expert put it to the ABC, it also means placing your risk somewhere you are not fully in control of, and one provider’s bad day becomes bad for many businesses at once.
Four practical steps
- Know what your suppliers hold. List the cloud services that store your customers’ names, contact details or bookings, and who to call at each one if something goes wrong.
- Tell customers how you will contact them. A simple line such as “we will never ask you to update card details via a link” makes scams easier to spot.
- Have a warning message ready. The affected parks that texted guests quickly gave them the best chance of ignoring the fake messages.
- Check your own inbox habits. Messages that use real details are far more convincing, so make sure staff verify payment requests by phone, not by clicking.
If you or a customer did click a link or hand over card details, contact the bank straight away and change any passwords that may have been entered. Scams can be reported to Scamwatch.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.