Holiday scams and how to beat them

School’s out for the summer and the heatwave has hit! As we start to think about holidaying, many of us will turn to online travel agents (OTA) to book that last-minute deal. As OTAs have grown in popularity, so too has the opportunity for scammers to target a new breed of online consumers. We should all be aware of the wave of digital scams that will accompany this trend.

In 2018, more than 5,000 tourists fell victim to holiday scams, resulting in average losses of £1,380 and a total of £7 million, according to Action Fraud. And of course, it’s not just down to financial strain. The emotional distress travelers experience at the hands of fraudsters can be equally damaging. 

From fake plane tickets to accommodation spoofs, online holiday booking has become both incredibly convenient and risky at the same time as fraudsters become increasingly more sophisticated.

Let’s take a look at a few of the biggest scams and how to avoid them:

1. Watch out for fake websites

It won’t surprise you that over half of reported online holidays scams were down to fake airline ticket sales. ABTA’s 2018 report noted that 53% of tourists were lured into booking a flight on a fake website for a nonexistent flight.

If you stumble across a website that offers you too-good-to-be-true flights, there’s probably a reason, so do your due diligence and learn to spot these fake sites. They may be previously unknown domains such as ‘’ – an OTA you probably haven’t heard of before so check whether it uses ‘https’ which offers more validity than ‘http’, or if it’s a more popular OTA such as Expedia, use your search engine if you’re not sure whether ‘’ is the real site. 

To avoid booking accommodation via a fake site, consider calling the owner or agent directly, and asking for the full address of the property to cross-reference with Google Maps.

Research, research, and research again – the key to online research lies in both the quality and quantity of the reviews. Look for the quality of images on the sites, and check if the companies are members of professional associations such as ABTA or ATOL. 

2. Beware the airport WiFi

With free WiFi pretty much a modern essential, it’s easy for tourists to connect when travelling whether it’s at the airport, hotel or local cafe. But, tourists need to look out for those unsecured networks that allow you to connect without a login and with no stated user terms. The problem with these networks is that your personal and private data can be easily exposed and thus, sharing bank details, financial information or any other sensitive data over these networks is incredibly risky.

If you really need to connect to unsecured wifi networks, make sure you keep your browsing to very dull searches – don’t check work email, don’t bank online, don’t purchase anything using your credit card details! If you’re travelling and need to work, speak to your IT teams about VPNs and logging into corporate networks securely. 

3. Double-check those deals

Let’s be honest, we all love a deal! However, as fraudsters increasingly look for new ways to con tourists out of money, we need to be extra cautious of those unsolicited emails that all too often seem perfectly legitimate but that may in fact harbor fake scams.

Phishing emails are in abundance, especially in the financial services, retail and travel sectors, so be aware that hackers can easily impersonate a brand’s primary domain. You may click on a link in an email that says you’re visiting “” assuming it’s a legitimate site, but that domain may well have been hijacked and then used to harvest your data. As a user, there’s not much you can do about this apart from to avoid clicking these links.

Check the site’s authenticity and use trusted websites rather than clicking on links that take you through to competitions and last-minute deals or that redirect you to a new website altogether. 

We all work hard year-round and our holidays are there to enjoy stress-free with family and friends. But with so much fraud clouding our every day, it’s often hard to make that a reality. Yet, with a few simple steps, you can ensure you’re on your way to out-scamming the scammers before they’ve had a chance to make your holiday a washout.

If you work within the travel industry and want to ensure you’re protecting your customers from email scams being carried out in your name, then get in touch with the Red Sift team or check your DMARC status online, for free.

Check email DMARC setup


Red Sift

31 Jul. 2019



Recent Posts


Preventing certificate related violations in cybersecurity frameworks:  A guide to certificate monitoring…

Rebecca Warren

TLS is one of the most widely adopted security protocols in the world allowing for unprecedented levels of commerce across the internet.  At the core of the TLS protocol is TLS certificates. Organizations must deploy TLS certificates and corresponding private keys to their systems to provide them with unique identities that can be reliably…

Read more

Red Sift ASM & Red Sift Certificates: the missing link in your…

Billy McDiarmid

According to Gartner, Attack Surface Management (ASM) refers to the “processes, technology and managed services deployed to discover internet-facing enterprise assets and systems and associated exposures which include misconfigured public cloud services and servers.” This broad category of tooling is used within Continuous Threat Exposure Management (CTEM) programs, with many vendors within it having…

Read more

The best tools to protect yourself from SubdoMailing

Francesca Rünger-Field

In late February 2024, ‘SubdoMailing’ became a trending search term overnight. Research by Guardio Labs uncovered a massive-scale phishing campaign that had been going on since at least 2022. At the time of reporting, the campaign had sent 5 million emails a day from more than 8,000 compromised domains and 13,000 subdomains with several…

Read more
Product Release

Red Sift’s Spring 2024 Quarterly Product Release

Francesca Rünger-Field

This early into 2024, the cybersecurity space is already buzzing with activity. Emerging standards, such as Google and Yahoo’s bulk sender requirements, mark a new era of compliance for businesses reliant on email communication. At the same time, the prevalence of sophisticated cyber threats, such as the SubdoMailing campaign, emphasizes the continual hurdles posed…

Read more