Action Step: Verify independently through the organization's published phone number or web portal. Report to Social Security OIG →
Week 42: New hotel booking phishing scam targets TWINT accounts.
The NCSC has previously reported on several phishing campaigns in which scammers exploited hotel bookings to obtain payment information.
While these scams primarily targeted credit card details, recent cases show that methods are evolving. In the latest scams, the cybercriminals are attempting to gain control of victims’ TWINT and e-banking accounts as well.[1]
What the Scam Looks Like
How it reaches you: Website
What Admin reports scammers do
The NCSC has previously reported on several phishing campaigns in which scammers exploited hotel bookings to obtain payment information.
While these scams primarily targeted credit card details, recent cases show that methods are evolving.
In the latest scams, the cybercriminals are attempting to gain control of victims' TWINT and e-banking accounts as well.
This approach is similar to phishing scams involving online classified ads.
In recent years, the NCSC has observed a shift away from large-scale phishing campaigns towards more targeted and personalised scams, although mass campaigns are still common.
Phishing attempts involving hotel bookings are part of this trend and have been reported to the NCSC on several occasions.
What stands out in these cases is that the scammers have detailed information about hotel stays, including guests' names, email addresses, booking dates and hotel details.
Asks for money
Admin does not publish the exact wording of the website, so none is shown. The sentences above are the source’s own description, not a transcript.
How the scam works, step by step, in the alert’s own words. The source did not publish the actual message, so this is a description, not a screenshot or transcript. Tap the animation to enlarge it.
How to Protect Yourself
Do not send money because of an unexpected call, text, or email. Hang up and contact the agency or person yourself using a number you look up independently.
How to Verify This Yourself
Read the original alert directly at Admin — that page is the primary source for everything above.
Investigative methodology: this update was produced by scripts/scam_monitor.py from a real Admin alert — not a language model. The quoted text above is verbatim from the source; any message or description shown in the illustration is quoted or copied from the source itself (see its caption); when the source does not publish the scam’s wording, none is shown or invented. Protection tips are matched from a fixed keyword list, not generated per story.
Kemetic Minds Editorial Desk
Verified Newsroom
Primary-sourced investigative intelligence on civil rights, voting rights, federal policy, and consumer protection. Sourced from primary legal filings, government statistics, and direct field reporting.