Hotel phishing with a 7.5 per cent «cashback» targets TWINT accounts – Switzerland's NCSC warns

It starts not with the guest but with the hotel: according to the NCSC, the attackers gain access to a hotel's booking or email system. Using the data stored there, they then write to former and current guests – in the hotel's name, with the correct name, the correct email address, the right booking date and the right hotel. Anyone reading the message therefore has no immediate reason to doubt that it is genuine.

The message promises a cashback of 7.5 per cent on the room price paid. To receive it, the guest is asked to click a link. According to the NCSC, this leads to an almost identical copy of the hotel website, registered under a similar-sounding domain name. There, the guest is offered the TWINT account as the payout method. As soon as the guest selects their bank, a convincingly recreated login page of that bank appears.

If the guest enters their e-banking credentials there, the attackers – according to the NCSC – use them immediately for a real login at the bank. While the victim is being guided through a supposed refund process on the fake page, the attack runs in the background. When the bank requests confirmation via the second factor for the login, the victim is asked under a pretext to grant that approval. In some cases, the NCSC reports, victims were asked to generate a code with their card reader and pass it on to supposed support staff. In reality, that code is what authorises the attackers' login.

The NCSC places the scam within a development it has been observing for several years: away from broadly scattered mass campaigns, towards more targeted and more personalised forms of fraud. Phishing in connection with hotel bookings has been reported to the centre several times before; the variant with a cashback promise, a cloned hotel website and an attack on the e-banking is what the NCSC classes as new.

The decisive difference from classic phishing is the data behind it. The attackers are not guessing: they know who stayed where and when. According to the NCSC, this information presumably comes from compromised booking systems. Anyone who receives an email containing their own travel details is less likely to examine it critically – and that is exactly what the scam relies on.

The approach itself is not new. As early as November 2023, the NCSC described how criminals attack hotels with malware to obtain the login details for their accounts on booking platforms. Guests then received messages that looked like notifications from Booking.com: the booking would be cancelled unless the credit card was «verified» via a link within 24 hours. In March 2024, the NCSC reported the same scam again: the emails were sent through the platform itself in the name of the booked hotel, the booking details were correct, and only the link led to a personalised phishing page.

In June 2026 came a further step. The NCSC reported WhatsApp messages supposedly from Booking.com customer service or from the booked hotel, promising a refund for an earlier booking. The link led first to a fake TWINT page and then to a fake bank page where credit card details were to be entered. At the time, the NCSC linked the precise booking data to a data leak connected with Booking.com in April 2026.

The variant now reported continues along this line: instead of credit card details, the attackers now want the e-banking credentials and the second factor directly. Booking.com itself states on its safety page that attacks on traveller data affect the whole industry and are used for phishing via WhatsApp, phone or email – and that the company will never ask you to share credit card details by email, over the phone, through text or WhatsApp.

The cashback is only the bait. The real aim, according to the NCSC, is to move the TWINT account linked to the bank account to a different phone number. If that succeeds, the payment app remains connected to the victim's bank account but runs on a device belonging to the attackers. The NCSC also mentions the possibility of triggering fraudulent payments directly from the hijacked e-banking.

For this, the attackers need two things: the e-banking credentials and approval of the second factor. They obtain both in the same conversation. The fake bank page delivers the login details; the approval is obtained by getting the victim, under a pretext, to confirm in the banking app or to enter a code on the card reader. That the code actually confirms someone else's login is not recognisable to the victim at that moment.

According to the NCSC, the method is the same as in classified-ad phishing on online marketplaces, where the attacks are aimed at sellers: there, the attackers feign interest in buying, claim they will settle the payment through a postal service, and send a QR code or link that leads to the same phishing pages. The entry scenario changes, the goal stays the same: the victims' bank login details.

The clearest warning sign is the procedure itself: according to the NCSC, you never have to enter login details or scan QR codes to receive a refund. Nobody has to log in to their bank, read out a code from a card reader or grant an approval in their banking app in order to get money back.

A second warning sign is the offer itself. A cashback that arrives unsolicited by email after your stay and has to be «activated» via a link is unusual – even when all the booking details are correct. The NCSC explicitly advises being extremely suspicious of unsolicited refunds or credit card verifications, even if the sender knows the booking details.

Third, the address: according to the NCSC, the attackers register similar-sounding domain names and copy the hotel website. Check the address in the address bar letter by letter and compare it with the website in your booking confirmation. Safer still is not to use the link at all: log in to your booking account directly via the official app or website, or call the hotel on a phone number you have looked up yourself – not the number from the message.

Fourth, the conversation with «support»: as soon as someone asks for an SMS code, a code from your card reader or an approval in your banking app, it is fraud. The NCSC puts it plainly: never pass on codes you receive by SMS. TWINT says the same about its own service on its security page: its staff never ask for passwords, login details or the security code, and TWINT SMS codes are never to be shared with anyone.

TWINT's «Current Security Issues» page does not list this hotel scam; it names phishing emails, fraudulent calls and forged letters with a QR code (last updated 5 June 2026). The basic rules there nevertheless fit the current case exactly: TWINT never asks for passwords or personal data by email or through partners, does not request sensitive data over the phone, and never asks you to authorise or block payments on request. TWINT QR codes should only ever be scanned with the TWINT app, and your personal TWINT SMS codes are never to be shared with anyone.

On protection, TWINT points out that the app is secured with a fingerprint sensor or facial recognition, advises rejecting any request for login details as a matter of principle, and recommends checking that the address of QR codes or payment links begins with go.twint.ch. TWINT also advises checking the default app and the linked account regularly, especially if you use several TWINT apps or accounts.

If the worst happens, the order of steps is clear: in the event of financial loss, call your own bank immediately and describe the incident as precisely as possible – for the banks' TWINT apps, blocking is handled by the customer service of the respective bank; for TWINT Prepaid, by TWINT customer service or, outside opening hours, via an online form. Phishing emails in TWINT's name can be forwarded to abuse@twint.ch, and phishing websites can be reported to the NCSC via antiphishing.ch.

This report shows where phishing is heading. For years the NCSC has described a shift from mass campaigns to personalised attacks, and the hotel industry provides ideal material for it: booking systems store the names, travel dates and contact details of thousands of guests, and a single compromised hotel account is enough to write to all of them convincingly. The fact that the attackers are no longer after just credit card details but the complete e-banking access including the second factor raises the potential damage considerably.

It also needs saying honestly what does not help here. A VPN does not protect you from this scam: it encrypts your data on its way through the network, but changes nothing about the fact that you are entering it voluntarily on a fake page. If you want to know what a VPN is actually good for, you will find the honest assessment in (→ Do you really need a VPN in 2026? The honest guide) and the set-up in (→ How to set up a VPN on your iPhone – with an app or by hand).

What does help is a password manager, and for a technical reason: it only fills in credentials on the domain they were saved for. On a copy of the bank website under a similar-sounding address, the field stays empty – a quiet but reliable sign that something is wrong. Which programs we recommend is in (→ Best password managers 2026: 1Password, NordPass, Bitwarden and Proton Pass compared). It does not replace the second factor, but it takes the first step away from the scam.

The most important defence remains a simple rule the NCSC has repeated for years and which applies to this variant too: if you are supposed to receive money, you do not have to confirm anything, approve anything or log in anywhere. The moment a «refund» requires an action from you, it is not one.