Telekopye Booking Scam: How Travelers Can Spot and Stop Phishing
In late 2024, security researchers at ESET documented a troubling shift in an international phishing operation. The Telekopye scamming toolkit, often described as the 'Swiss army knife of phishing,' moved its attention toward travel booking platforms such as Booking.com and Airbnb. By 2026, the campaign remains a textbook example of how automated fraud can borrow the trust of legitimate travel brands. The scheme does not rely on random spam alone. It uses compromised hotel accounts, believable messages, and polished fake pages to pressure travelers into handing over personal and financial information.
Telekopye is an automated scamming toolkit that has been used to steal millions of dollars across online marketplaces worldwide. According to ESET research, attackers have posed as buyers or sellers to deceive victims based mainly in Europe and North America. The toolkit automates much of the criminal work by generating phishing websites, SMS messages, and emails. It also includes an interactive chatbot with automatic language translation and DDoS protection for phishing domains, which helps the operators ward off attacks from rival groups. In the travel-booking variant, the toolkit helps attackers exploit stolen credentials from legitimate hotels and reach specific users rather than spraying messages at everyone.
How the Booking Scam Works
The attackers behind the Telekopye booking scam buy credentials belonging to compromised accounts of legitimate hotels. Those accounts become a bridge to real customers. Instead of a broad spray-and-pray approach, the criminals target two groups: travelers who have recently booked a stay but have not yet paid, and travelers who have recently completed a booking. The attackers then send email messages claiming that something is wrong with the reservation. The message may threaten to cancel the booking or place the traveler's funds on hold unless immediate action is taken.
The email includes a link to a phishing site that looks remarkably close to a legitimate travel platform. The fake page pre-populates some fields using information from the target's real booking, including check-in and check-out dates, price, and destination details. That personalization makes the page feel more credible. A chatbot in the lower right corner can guide the target through the process, and its messages are automatically translated. The chatbot helps convince the traveler to rebook and provide financial details. After the victim fills in the first phishing form, the site moves them to a payment page where their financial information is stolen.
The deception depends on urgency and familiarity. A traveler sees a known brand, a real reservation date, and a warning about cancellation. The combination can override caution. Yet the fake site usually exposes itself in small details. The URL on the phishing page does not match the URL of the legitimate hotel or booking site. That mismatch is a telltale sign that the hackers have taken the traveler outside the legitimate platform. The initial email may also come from an address whose domain does not exactly match the platform or hotel. Grammar errors, misspelled words, and awkward phrases are additional warning signs. Requests to use unconventional payment methods are a major red flag. Threatening and urgent language is another. The goal is to create panic so the victim acts before thinking.
Red Flags at a Glance
| Warning sign | What it suggests |
|---|---|
| The URL does not match the official booking or hotel site | The traveler has been moved to a phishing page |
| The sender domain is slightly wrong | The email is not from the real platform or hotel |
| The message threatens cancellation or frozen funds | The attacker is manufacturing panic and urgency |
| The page asks for card details after a booking issue | Financial information is the likely target |
| The message contains grammar errors or odd phrasing | The content may be generated or translated by criminals |
| The sender requests an unusual payment method | Normal platform protections are being bypassed |
| A chatbot pushes a rebooking and payment | The interaction is designed to guide the victim |
Practical Protection Steps
Travelers can reduce the risk by verifying the source of any booking message. If a notification claims that a reservation has a problem, the safest response is to close the app or site and use another browser or the platform's official app to contact customer support. A traveler should always check the URL, especially on pages that ask for personally identifiable information and bank or credit card details. Checking domain age and ownership can provide another layer of assurance. Anti-malware software can also alert users when attackers redirect them to a phishing site.
If financial information has already been shared, the victim should call their bank immediately. The bank can place a hold on accounts so hackers cannot access funds. Regular monitoring of financial statements helps catch suspicious transactions. Stronger passwords and multifactor authentication for online bank accounts add important protection. If personally identifiable information has been exposed, contacting TransUnion, Experian, and Equifax to freeze credit can prevent criminals from taking out loans or credit cards in the victim's name.
The Telekopye booking scam preys on panic around a legitimate reservation, which is why it can feel so believable. In 2026, the core lesson remains unchanged: verifying the sender and taking a moment to double-check the URL can keep a traveler and a holiday safe. 🛡️✈️