GUEST INFORMATION BOARD
The inn uses this page as an information distribution board to provide updates for guests during major events or for changes to services, outages and times when a large group of guests are affected by road closures or emergency situations.
URGENT NOTIFICATION FOR Booking.com USERS – PHISHING SCAM.
----
BRIEF INFORMATION NOTICE:
We are aware of a phishing scam affecting users of booking.com.
Guests may receive a legitimate looking email and response masked to look like it has come from the Ben Cruachan Inn and other hotels and accommodation providers you have booked with.
The message may appear in booking.com's platform or in your email inbox.
Ben Cruachan Inn has ceased communication via the Booking.com platform.
Please see an information notice provided by HOP PMS, the booking provider that the Ben Cruachan Inn uses to manage room reservations.
We know the following:
• The issue stems from a security vulnerability in Booking.com’s alias email system (e.g., @guest.booking.com). It appears that the algorithm used to generate these guest alias emails has been compromised, allowing third parties to send messages that appear legitimate via the Booking.com system.
• Booking.com has not officially acknowledged this but they have introduced a safeguard to mitigate the issue.
Additionally, we have received confirmation from Booking.com that:
• There has been no breach of any accounts used within Hop.
• No messages were sent to guests through Ben Cruachan Inn's Hop systems.
• The issue is entirely contained within Booking.com’s own infrastructure.
While Booking.com has not disclosed the full technical details of the breach, they have made it clear that our booking agent HOP is not implicated.
----
ACTION TO TAKE
Contact Booking.com immediately via customer services and report the Phishing Scam.
You will need your booking number.
Do not click on any links.
The inn has not and will not collect payment from you until the day of arrival.
Booking.com will collect payment from you and will handle this securely.
We do not have any data relating to your email address (this is masked by Booking.com or you Payment Details again masked by Booking.com)
We will not cancel your booking, but it is advisable for you to check bookings with other hotels and venues.
----
A MESSAGE FROM US
Unfortunately, for small businesses and their customers to be victims of scams like these is becoming more commonplace. I am glad to report, however, that we do have protocols in place for such events, swift action and response was taken on the advice of our Booking System provider (fortunately they have been more helpful than Booking.com).
It is confirmed that this issue has been known about for multiple months and does not seem to be a priority for booking.com, they have provided a mitigation plan for hotels to implement but as yet have not communicated this to us. Our booking system provider have been diligent in fielding our concerns and our guests providing feeback and up to date information.
For guidance on how to spot Phishing Scams and Online Fraud, please visit the National Cyber Security Centre:
www.ncsc.gov.uk
The inn has no way to assist with 3rd party bookings in this instance and you should contact booking.com directly. If you have been victim of this scam or have lost money or your personal data is compromised, I can only suggest trying to claim this back from booking.com, as a global business with tens of thousands of employees and millions of customers they should have robust Cyber insurance and protections in place for their customers.
I would like to reiterate that booking.com's messaging system has a security issue and they are liable to fix this.
Booking.com collect your payment - we do not.
If you have fallen victim to this scam, you should report it to the National Cyber Crimes agency and try to claim back any lost funds from Booking.com
I empathise with guests in this situation but encourage you to book directly in the future.
Mike Lindsay
Inn and Operations Manager.