Australian travellers are being targeted in a sophisticated hotel booking scam after hackers accessed customer information held by accommodation software provider RMS Cloud. The company confirmed on Tuesday it was investigating phishing messages that use genuine reservation details to threaten cancellation unless payment is reconfirmed. The Australian Competition and Consumer Commission has received 62 reports in three days, with one victim losing more than $300.
RMS Cloud, a property management software provider used by hotels, motels, holiday parks, campgrounds and serviced apartments, said guest names, contact information and booking details had been accessed, but that credit card and payment details were not compromised.
“RMS is also aware of phishing communications sent by an unknown entity claiming to be RMS or one of RMS’ customers,” the company said in an updated statement on Wednesday. “The communications quote reservation information, request confirmation of payment details, and may be received via email, text message or WhatsApp.”
RMS customers including Reflections, BIG4 and G’day Parks have issued warnings to guests. “We are contacting you as a past guest to make aware our third-party booking system provider, RMS Cloud, has confirmed a global incident,” Reflections said in an email. “Please do not click any links, open attachments, or share payment or personal information.”
Similar scam messages have been reported by travellers who booked through Booking.com, Agoda and Trip.com. Perth man Wayne Garrard, 68, told 7NEWS.com.au a friend “nearly fell for it”. The friend received a WhatsApp message asking him to reconfirm payment details or risk cancellation. “He actually clicked on the link, and it takes you to the room that you bought on booking.com,” Garrard said. The friend entered his credit card details but was alerted by his card when the scammers attempted to charge him €400.
Garrard himself later received a similar WhatsApp message while holidaying in Vietnam, containing his hotel details, booking dates and reservation reference number. “I knew straight away that it was a scam, but I did click on it just to see where it took me and it took me to the picture of the hotel that I booked and the exact room,” he said. “It looked perfect — the booking.com website with the hotel room and everything.”
South Australian woman Diane McAskill also received a WhatsApp message. “I knew straight away something wasn’t right,” she told 7NEWS. “I didn’t click on any links so I didn’t give them any information. But what information they do have is still uncertain.”
The consumer watchdog warned there could be more unreported cases. South Australia’s Consumer and Business Services Commissioner Brett Humphrey urged travellers to remain vigilant. “If it doesn’t quite feel right, stop! Don’t give your details,” he said.
Analysis
Why This Matters
- The breach exposes how easily stolen booking data can be weaponised in convincing phishing scams, putting travellers at financial risk.
- Scammers are using genuine reservation details to make fraudulent messages appear legitimate, lowering victims’ defences.
- With only 62 reports in three days and likely underreporting, the true scale of the scam may be much larger.
Background
RMS Cloud is a property management software provider used by accommodation businesses across Australia, including hotels, holiday parks and serviced apartments. The company detected the breach this week and is investigating. Similar phishing campaigns have targeted users of major booking platforms like Booking.com, Agoda and Trip.com in recent months.
Key Perspectives
RMS Cloud: Says it is investigating the phishing messages and that credit card and payment details were not accessed in the breach.
Wayne Garrard (victim): Describes the scam as highly convincing, noting that a friend almost lost €400 and that the fake booking page looked identical to Booking.com’s site.
ACCC: Reports 62 scam reports in three days, with one confirmed loss of more than $300, and warns more cases may exist.
Commissioner Brett Humphrey (SA Consumer and Business Services): Urges consumers to stop and not provide details if a message feels suspicious.
What to Watch
- Whether RMS Cloud identifies how the attackers gained access and whether any further systems were compromised.
- If the number of consumer reports to the ACCC increases as more travellers become aware of the scam.
- Whether other accommodation software providers face similar attacks or whether this is an isolated incident.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedThe headline says a hotel booking scam is hitting Australians after the RMS Cloud cyberattack.7NEWS: “Australian travellers targeted in sophisticated hotel booking scam after RMS Cloud cyberattack.”
- SupportedScammers use genuine reservation details to trick travellers into sharing payment information.7NEWS: “Scammers have been using reservation details to send fraudulent messages threatening to cancel bookings unless travellers reconfirm their payment information.”
- SupportedHackers accessed customer information held by an accommodation software provider, targeting Australian travellers in a sophisticated scam.7NEWS: “Australian travellers have been targeted by a sophisticated hotel booking scam after hackers accessed customer information held by an accommodation software provider.”
- SupportedRMS Cloud confirmed on Tuesday it was investigating phishing messages that use genuine reservation details to threaten cancellation unless payment is reconfirmed.7NEWS: “RMS, a property management software provider used by hotels, motels, holiday parks, campgrounds and serviced apartments, confirmed on Tuesday it was investigating the phishing messages.”
- SupportedThe ACCC received 62 reports of the scam over three days, and one victim lost more than $300.7NEWS: “The Australian Competition and Consumer Commission (ACCC) said 62 reports of the scam had been received over the past three days, with one victim losing more than $300.”
- SupportedRMS said guest names, contact information and booking details had been accessed, but credit card and payment details were not compromised.7NEWS: “The company said guest names, contact information and booking details had been accessed, but that credit card and payment details were not compromised.”
- Partly supportedThe Reflections email said, “We are contacting you as a past guest to make aware our third-party booking system provider, RMS Cloud, has confirmed a global incident.”7NEWS: ““We are contacting you as a past guest to make you aware our third-party booking system provider, RMS Cloud, has confirmed a global incident,” Reflections said in an email.”
- SupportedRMS said its phishing communications quote reservation information, request payment confirmation and may arrive by email, text message or WhatsApp.7NEWS: ““The communications quote reservation information, request confirmation of payment details, and may be received via email, text message or WhatsApp.””
- SupportedRMS customers including Reflections, BIG4 and G’day Parks issued warnings to guests.7NEWS: “RMS customers, including Reflections, BIG4 and G’day Parks, have issued warnings to guests following the incident.”
- SupportedTravellers who booked through Booking.com, Agoda and Trip.com have reported similar scam messages.7NEWS: “Similar scam messages have also been reported by travellers who booked accommodation through Booking.com, Agoda and Trip.com.”
- SupportedGarrard’s friend entered his credit card details and was alerted when scammers tried to charge him €400.7NEWS: “The friend entered his credit card details, but was alerted by his credit card when the scammers attempted to charge him €400.”
- SupportedThe consumer watchdog warned that more cases may have gone unreported, and Commissioner Brett Humphrey urged travellers to remain vigilant.7NEWS: “The consumer watchdog warned there could be more cases that had not been reported. South Australia’s Consumer and Business Services Commissioner Brett Humphrey urged travellers to remain vigilant.”
