The holiday season is here – but beware, hackers are launching more phishing scams and attacks than ever before

Check Point Research warns that summer holiday fraud is on the rise, with hospitality/travel companies hit by 2,291 weekly attacks in May 2026 alone
Attack volume doubled compared to May 2023; 47k+ new travel domains registered, 1 in 112 already flagged as malicious
Booking, Airbnb and Skyscanner faked; travelers are encouraged to verify domains before entering personal or payment data

Scams targeting people looking to book their summer holidays are on the rise, researchers have claimed – and not only that, but the scale of attacks is significantly greater than last year or the year before, indicating a growing problem.

Security experts Check Point Research found that in May 2026 alone, the hospitality, travel and leisure sector recorded 2,291 average weekly cyber attacks per organization. Attacks increased 24% month-over-month, while volume more than doubled compared to May 2023.

Overall, over the past three years, the company has found that there has been a 122% increase in attacks on the industry.

Fake website

At the same time, the global year-on-year increase across all industries was just 2%, which, CPR claims, means criminals are specifically targeting holidaymakers:

“This is not a general increase in cybercrime that happens to affect travel. It is a deliberate, seasonal intensification targeting an industry that processes vast amounts of personal and financial data, precisely when people are distracted, in a hurry and eager to secure a bargain.”

A large proportion of these scams are phishing emails and fraudulent fake websites, and these have increased significantly. In May 2026 alone, CPR says there were 47,318 new travel-related domains registered, which is a 33% increase from April and a 19% increase compared to May last year.

To make matters worse, among these domains, one out of every 112 is already classified as either malicious or suspicious. This does not mean that the other 111 are legitimate, it just means that many others are dormant for now, waiting to be activated when summer traffic peaks.

If you’re looking to book a flight or accommodation anytime soon, make sure to double check the domain you’re visiting as major platforms like Booking, Airbnb and Skyscanner have already been spoofed thousands of times with fake sites stealing sensitive data and even money.