The holiday season is here, but beware, hackers are launching more scams and phishing attacks than ever.

Check Point Research warns that summer holiday scams are on the rise, with hotel and travel businesses hit by 2,291 weekly attacks in May 2026 alone.
The volume of attacks doubled compared to May 2023; More than 47,000 new travel domains registered, 1 in 112 already marked as malicious
Counterfeit Booking, Airbnb and Skyscanner; Travelers are urged to verify domains before entering personal or payment details.

Researchers have stated that scams targeting people looking to book their summer vacations are increasing, and not only that, but the volume of attacks is significantly higher than last year, or the year before, indicating a growing problem.

Security experts Check Point Research found that in May 2026 alone, the hospitality, travel and recreation sector saw an average of 2,291 weekly cyberattacks per organization. Attacks increased 24% month over month, while volume more than doubled compared to May 2023.

Overall, over the past three years, the company found that there has been a 122% increase in attacks on the industry.

Counterfeit website

At the same time, the overall year-over-year increase across all industries was just 2%, which, according to CPR, means criminals are specifically targeting tourists:

“This is not a general increase in cybercrime affecting travel. It is a deliberate seasonal intensification targeting an industry that processes enormous volumes of personal and financial data precisely when people are distracted, in a hurry and eager to get a good deal.”

A significant portion of these scams are phishing emails and fraudulent and spoofed websites, and these have spiked significantly. In May 2026 alone, CPR says 47,318 new travel-related domains were registered, representing an increase of 33% from April and 19% from May of last year.

To make matters worse, among these domains one in 112 is already classified as malicious or suspicious. That doesn’t mean the other 111s are legitimate, it just means that many others are dormant for now, waiting to be activated when traffic picks up in the summer.

If you’re looking to book a flight or accommodation anytime soon, be sure to double-check the domain you’re visiting, as major platforms like Booking, Airbnb and Skyscanner have already been spoofed thousands of times with fake websites that steal sensitive data and even money.