Weekly Scam Alert: Fake Travel-Booking Messages Could Cost You $500 (or More)

As summer travel season arrives, scammers are trying to make a quick buck at the expense of you and your getaway plans. A new survey from cybersecurity company McAfee found that 38% Americans have encountered a travel-related scam. Among those who did, 41% lost money — and nearly half of that group lost more than $500.

Fake booking confirmations and travel updates were among the most common scams identified in the survey of 1,000 people. The messages can look surprisingly real, using familiar brand names and design cues from airlines, hotels and booking sites. Research from McAfee Labs also shows that popular travel brands like Tripadvisor are being impersonated at scale, making it harder for consumers to tell what's real from what's fake.

The goal for fraudsters is to panic travelers just enough to make them click before they think. Ninety percent of travelers say they feel pressure to book quickly. Naturally, scammers engineer their messages to amplify that pressure, pushing consumers to act before they miss out on a deal. McAfee also found that 41% of travelers trust messages that appear to come from airlines or hotels without double-checking them first.

The safest way to avoid booking scams is to never act directly based on a text message or email, even a convincing one. Open your airline, hotel or booking app separately and check your reservation there. If something is actually wrong, it will show up in your account.

If you need customer service, look up the number through the official website or app. Scammers may impersonate airline or hotel support and ask for payment details or login information.

Where People Are Protecting Their Privacy Online Right Now

• NordVPN: Hide Your IP and Location Every Time You Surf the Web
• Surfshark VPN: Bundle All Your Devices Into One Low-Price Plan
• Lifelock by Norton: Identity Theft Protection That Defends Against Scams and More Online Theft Attempts

Other current scams to watch out for

Fake AI hostage

AI voice cloning has given scammers the ability to make a stranger sound exactly like someone you know. A recent incident showed how quickly it can work, when it led a Bay Area mother to wire $5,400 in exchange for her daughter’s freedom — except her daughter was never in danger to begin with.

Deborah Del Mastro received a call from an unknown number one morning earlier this month. An unknown man's voice said her 37-year-old daughter had been kidnapped by a Mexican drug cartel. Then he played what Del Mastro believed was proof: her daughter's voice, panicked and crying, saying she was scared and loved her.

But it wasn't real. Scammers had used AI to clone her daughter's voice. Del Mastro spent hours following the caller's instructions before wiring the requested $5,400 to an account in Mexico. But when she arrived at the location where she was told her daughter would be released, she couldn’t find her.

Del Mastro then called her daughter, who picked up the phone and said she was at her workplace.

Erin West, who works on these cases with global nonprofit Operation Shamrock, says scammers can clone voices using only a few seconds of audio, often pulled from social media or phone calls. She also told a local news station that this type of scam is accelerating. "It's only getting worse, and it will only continue to get worse with the use of AI and deepfake technology."

Her advice is to establish a family code word that only you and your loved ones know, so you can verify a caller's identity in moments of panic. If you receive a call like this, resist the urge to act immediately. The pressure to move fast is a scammer's primary weapon.

Bogus bill and invoices

In March, federal prosecutors in New York announced that a Florida man was sentenced to more than six years in prison for sending small businesses what looked like routine web-hosting bills. The invoices were usually for around $180 — low enough that a busy office might pay without asking many questions. But prosecutors said Robert W. Lederhilger III mailed nearly 3 million of them over several years, ultimately defrauding tens of thousands of victims out of a total of $9 million.

The case shows why the FTC recently warned small businesses to slow down before paying an unexpected bill. Fake invoices may arrive by mail or email, and they often claim to cover vague services such as tech support, domain registration, web hosting or search engine optimization. Some are designed to collect money directly, while others are phishing attempts meant to break into company systems.

Before paying, match every invoice to an approved purchase order or vendor record. If the company name is unfamiliar, look it up separately and search for complaints. And if an invoice includes a phone number or payment link, do not use it until you have verified the company through an official source. Suspicious invoices can be reported to ReportFraud.ftc.gov.

Where People Are Protecting Their Privacy Online Right Now

• NordVPN: Hide Your IP and Location Every Time You Surf the Web
• Surfshark VPN: Bundle All Your Devices Into One Low-Price Plan
• Lifelock by Norton: Identity Theft Protection That Defends Against Scams and More Online Theft Attempts

Protect your digital life: See Lifelock's current identity theft plans and get your first year of the standard plan for just $7.99 a month

The most common types of scam you should know

Scammers are constantly upping their game, coming up with new and exciting ways (for them) of fooling their targets. AI-powered scams are one example of this; the technology is being used to reach a larger number of people with increasingly more convincing schemes

But some tricks never run out of style. Most scams fall into a handful of familiar patterns, and many long-standing schemes are still a threat today. They’ve just evolved to better fit today’s digital landscape

1. Imposter scams: Scammers often pose as trusted figures such as government agencies, banks, employers and even friends or family to pressure victims into sending money or sharing personal information
2. Phishing and spoofing scams:
 These scams use emails, texts or phone calls that look like they’re from legitimate organizations. The goal is to trick you into clicking a malicious link, downloading malware or handing over sensitive information
3. Online shopping scams: Fraudsters can create fake online stores or listings with hard-to-find items at unusually low prices. After you pay for an article, what you end up getting might be counterfeit — or it may never arrive in the first place
4. Investment scams: This type of scam often arrives with promises of high returns from crypto, forex or other “exclusive” opportunities. Many involve long-term grooming tactics in which victims are encouraged to invest more over time before losing everything
5. Romance scams: Some scammers try to get into your pocket through the heart. They build a relationship with you on dating apps or social media, then convince you to give up money and assets by fabricating emergencies or investment opportunities

Plans for everyone: Check out Aura's identity theft options for you and your family, starting at $9 a month when you pay annually

What to do if you’re the target — or victim — of a scam

No one is immune to scams or fraud, but a few consistent habits can reduce their danger and the damage they cause

For starters, be skeptical of unsolicited messages, especially those creating fear or urgency. This might look like an email from your bank threatening to close an account, a text from an online marketplace saying you’ll lose a discount or a call from the IRS claiming they’ll report you to the authorities unless you “act now.”

Scammers love to use this sort of language because it puts you on the spot, which they expect will move you to action

Always verify any requests from an organization by cross-checking with its official phone numbers, email or website. And don’t click any links, download attachments or respond to messages you suspect may be fraudulent. A legitimate organization will not pressure you for instant action or secrecy

Now, if you’ve already sent financial information or money to someone you suspect is a scammer, you’ll need to take a few steps to protect your data and possibly get your money reimbursed. Contact your bank, credit card issuer or payment platform immediately and attempt to stop or reverse the transactions. Make sure to change any relevant passwords and enable multi-factor authentication to safeguard your accounts, too.

Reporting a scam might also help protect others. You can file a report with the Federal Trade Commission and with local authorities at your nearby police department or sheriff’s office. Identity theft victims should also consider temporarily freezing their credit

Lastly, review your financial statements and credit reports regularly, keep your software updated and limit how much personal information you share online. Scammers often rely on publicly available details to make their schemes more convincing

More from Money

How to Protect Yourself From Card Skimmers at ATMs and Gas Pumps

Best Identity Theft Protection Services

Best Credit Monitoring Services