Cyber criminals conned holidaymakers out of £7 million in 2018

More than 5,000 people fell victim to holiday and travel booking scams last year, with their losses totalling £7 million, according to an Action Fraud and NFIB (National Fraud Intelligence Bureau) study.

The scams cost holidaymakers £1,380 on average, although this only accounts for money paid directly to scammers. The actual cost is much higher when you factor in the additional expenses victims faced, such as making new travel plans or cancelling their holidays.

Airline ticket scams

More than half (53%) of the scams related to the sale of airline tickets, with Spain, France, Africa and India among the destinations most commonly affected.

The report suggests that scammers are taking advantage of people’s lack of knowledge about the UK’s strict regulations concerning the sale of airline tickets. Organisations must be given permission by an airline to sell seats on its flights.

You can generally tell if that’s the case, at least if you’re booking through a ticket agent, if it holds an ATOL (Air Travel Organiser’s Licence) or is part of an ATOL-accredited body.

The problem is that many people, even those who are reasonably computer savvy, wouldn’t think to check. The best course of action is to either stick with sites that you know are genuine or, if a site is unfamiliar, search for reviews on travel and consumer forums. People are very vocal online when it comes to scams, so if a site or agent is bogus there’s a good chance you’ll be able to find out.

Lastly, you should never follow a direct link from a third-party site. Many of the victims cited in the report said that they found their flights and accommodation through a Facebook advert or other social media site.

Such adverts are a great way to launch phishing attacks. Scammers create a post that mimics a reputable airline or travel site, complete with the organisation’s logo, but links to a facsimile of the legitimate site. Often the web address will differ only slightly from its genuine counterpart, which can be hard to spot; for example, the address might read ‘’ instead of ‘’, or use an uppercase ‘i’ instead of an ‘l’ in ‘’.

Accommodation scams

The same advice applies for accommodation scams, which the report says account for 25% of scams targeting holidaymakers. Although less money goes into crooks’ hands, the schemes can end up costing victims a lot more in the long run. Consider this example from the study:

Angus and his family were booked on a trip to Mallorca over Easter. They found a dream villa online with a company that also arranged transfers and a special welcome pack on arrival. Alarm bells began to ring at Palma airport when no transfer driver was waiting for them.

After hours waiting, the family booked two taxis and headed off to their villa. This was everything they had hoped for, with one exception. The very friendly German host was actually the owner of the property, which he did not rent out, so he clearly had no knowledge of their booking.

Very generously, he allowed the Kennedys to stay overnight, but this still left them with nowhere to stay for the rest of the trip. After paying out more money that the family could ill afford, Angus found another villa but the family is now out of pocket of almost £8,000.

This story is far from the exception. Anyone who arrives at their destination only to discover their accommodation is either non-existent or unavailable has no choice but to find somewhere else to stay or pay for a flight home. At the height of tourist season, it can be incredibly hard to find anywhere, and even if you do, you’ll pay a premium on prices and may have to rethink the rest of your holiday itinerary.

How to stay safe

Action Fraud, ABTA (the Association of British Travel Agents) and Get Safe Online say holidaymakers can stay safe by following these tips:

  • Check the web address is legitimate and has not been altered by slight changes to a domain name – such as going from ‘’ to ‘.org’.
  • Don’t rely on just one review; do a thorough online search to check the company’s credentials. If a company is defrauding people, there’s a good chance that consumers will post details of their experiences.
  • Determine whether the company is a member of a recognised trade body by looking it up on the ABTA website.
  • Wherever possible, pay by credit card, and be wary about paying directly into a private individual’s bank account.
  • Study receipts, invoices and terms and conditions. Be very wary of any companies that don’t provide this information. When booking through a holiday club or timeshare, get the contract thoroughly vetted by a solicitor before signing up.
  • If something sounds too good to be true, it probably is.
  • Victims should report any scams to Action Fraud.

Subscribe to the GRC Weekly for all the latest cyber security news and advice >>