Sneaky travel booking scams are on the rise - here's how to avoid them like a pro

As booking accommodation and travel online becomes more commonplace, so do booking scams. Consumers' association CHOICE says criminals have been known to create fake accounts on booking platforms such as Airbnb and Booking.com, or hack into legitimate profiles on these sites to steal from holidaymakers. So how can you stay safe when booking travel online?

Cybersecurity firm Sophos's field chief information security officer for Australia, Pacific and Japan, Aaron Bugal, says anything we do online has the potential to be exploited, so he's not surprised to see fraudsters targeting travellers booking their holidays.

"And unfortunately, a lot of that initial effort to defend against those risks is going to come back to the user of those systems," Bugal told Explore.

He said scammers will usually take the "path of least resistance", and one of the most common scams is gaining access to email communications through a booking platform. In one scenario, you will think you are emailing back and forth with a hotel, but it's actually a scammer who has gained control of the hotel's account.

Alternatively, a scammer will set up their own account mimicking the hotel's account. In both scenarios, the scammer will ask you for payment. If they ask you to move communications to another messaging platform such as WhatsApp, Signal or Facebook Messenger, "that should be the first sign that something isn't quite right", Bugal says.

University of NSW senior lecturer at the School of Computer Science and Engineering Dr Rahat Masood says there are several red flags to watch out for. First, check the terms and conditions, including the cancellation and refund policy, which can be "very vague" if it's a scam.

If they are asking for full payment in advance, or asking you to book and pay through another website, those are also red flags. Other warning signs include asking for payment via a bank transfer, in cryptocurrency, or another way where "there's no way to trace back the payment", Masood says.

A sense of urgency - such as continually messaging you saying you will miss out if you don't act quickly - is another red flag.

Do not pay for anything online if the browser address does not begin with "https". The "s" stands for "secure" - if it's just "http", be wary as it is not verified. And if something has an extremely low price, and therefore seems too good to be true, it probably is.