Walk into a 3D lesson.Watch a learner go through the bar scenario, step by step.- Industries
- Hospitality
Security awareness training for hospitality, from front desk to back office.
Hotel teams answer guests on every channel, around the clock, and attackers copy the booking platforms they depend on. Cyberfrog trains front desk, reservations, night audit and finance with the lures they really see, and gives you the PCI DSS training evidence your assessor asks for.
- Booking-platform phishing tests
- ClickFix and front-desk vishing
- Lessons for every shift and season
- PCI DSS 12.6 evidence
A guest staying from 14 to 16 November reports a serious hygiene problem in their room and has attached photos. Reply in the extranet within 24 hours to avoid a ranking penalty and an automatic refund. You will be asked to confirm you are not a robot before the photos open.
View guest photos- The platform name sits on a domain the platform does not own
- A threat to your ranking and payout within 24 hours
- A 'not a robot' check, the start of the ClickFix trick that asks you to paste a command
What attackers send to hotels.
Hotel staff are paid to be helpful, answer quickly and keep guests happy. A message about an angry guest or a frozen payout is built to switch off the instinct to check.
- Fake guest messages from a booking platform
From December 2024, the group Microsoft tracks as Storm-1865 sent fake Booking.com emails about guest reviews and account verification to hospitality staff. They led to fake CAPTCHA pages, the ClickFix trick, that install credential-stealing malware. Microsoft Threat Intelligence, March 2025
- ClickFix is spreading
Fake-CAPTCHA ClickFix lures gained momentum in the first quarter of 2025 and are used by both criminal and state-aligned actors. ENISA Threat Landscape 2025
- Calls to the IT help desk
Scattered Spider targets the commercial facilities sector, calling IT help desks to have passwords and MFA reset. CISA/FBI advisory, July 2025
- Phone calls for CRM data
Hospitality organisations were among the victims of a vishing campaign, tracked as UNC6040, that went after companies' Salesforce data. The Register, on Google threat intelligence findings, June 2025
Every shift, its own training.
A receptionist on the late shift, a reservations agent in the extranet and a sales manager taking event deposits meet different scams. Cyberfrog gives each role short lessons and simulations on the lures aimed at them.
- Front desk and reception
Callers who ask to change a card, re-send a folio or confirm another guest's room number, plus the card-terminal checks PCI DSS asks for.
- Reservations and revenue
Booking-platform messages about complaints, reviews and payouts, and the extranet and channel-manager logins they are after.
- Night audit and duty managers
Calls from 'head office IT' when nobody else is around to check, and requests to approve a sign-in or start remote support.
- Sales, events and finance
Group-booking deposits sent to new bank details, fake supplier invoices and look-alike domains of event clients.
- General managers and IT
Help-desk reset requests across properties, and the AI literacy staff need when they use AI tools for guest chat.
The guest messages, practised safely.
Simulations copy the platforms, guests and suppliers your teams deal with every day. Every mistake leads to a short lesson on exactly that trick.
- ClickFixThe guest complaint with photos
A booking-platform message about an angry guest links to a 'verify you are human' page that asks staff to paste a command.
- WebExtranet account verification
A cloned partner-extranet sign-in page asks reservations staff to confirm their login to keep the listing online.
- SMSPayout on hold
A text says the channel manager has paused this week's payout until the bank details are confirmed.
- VoiceNight audit, 02:00
An AI caller from 'head office IT' asks the night auditor to approve a sign-in prompt on their phone.
- EmailEvent deposit to a new account
A 'corporate client' asks sales to refund an event deposit to a new account after a cancelled booking.
Find the logins a stealer already took.
The malware in the booking-platform campaigns is built to steal credentials, and a shared front-desk PC is often signed in to the extranet, the channel manager and email at once. Stolen logins end up in infostealer logs, which Darknetsearch collects and Cyberfrog checks against your domains.
Exposed staff get a personal notice and a lesson on what was found and what to do. Passwords are shown only as much as your privacy settings allow. Darknetsearch also watches for look-alike domains of your hotel, so you can reserve or monitor them before guests receive mail from them.
What the rules ask of hotels.
Hotels take cards and passports, and they are not a NIS2 sector as such, so PCI DSS and data-protection law set most of the bar. Cyberfrog keeps training records per person and per team.
| Rule | What it asks for | How Cyberfrog helps |
|---|---|---|
| PCI DSS v4.0.1, Req. 12.6Mapped in Cyberfrog | Security awareness training at hire and at least every 12 months, covering phishing and social engineering. | Programme mapped to PCI DSS 4, with front-desk and reservations paths and records per person. |
| PCI DSS v4.0.1, Req. 9.5.1.3 | Staff at card terminals trained to detect tampering with, or replacement of, the devices. | Physical-security lessons and posters for the front desk, restaurant and bar. |
| GDPR, Art. 32 | Appropriate security for guest personal data, including passport details. | Data-handling lessons for everyone who sees registration cards or guest profiles. |
| Swiss FADP (revDSG), Art. 8 | Appropriate data security through technical and organisational measures. Training counts as an organisational measure. | Records that show staff training as part of your organisational measures. |
| EU AI Act, Art. 4 | Sufficient AI literacy for staff who use AI tools, such as booking and guest-chat assistants, from 2 February 2025. | The Using AI safely lesson for teams that work with AI tools. |
Summaries for orientation, not legal advice. Cyberfrog provides training records and coverage reports; it does not certify compliance.
Questions from hotel teams.
What is hotel phishing?
Phishing aimed at hotel staff, usually disguised as a booking platform, a guest or a supplier. Typical messages report a complaint, a bad review or a payout problem, and lead to a fake login page or a page that installs malware.
How do booking-platform phishing scams target hotels?
Microsoft described a campaign that began in December 2024: fake Booking.com emails about guest reviews and account verification were sent to hospitality staff and led to ClickFix pages that installed credential-stealing malware.
What is a ClickFix attack?
A fake error or 'verify you are human' page tells the visitor to copy a command and run it, for example by pressing Windows+R and pasting. Doing so installs malware. ENISA reports that ClickFix lures gained momentum in early 2025. Cyberfrog simulates the whole sequence safely.
Does PCI DSS require security training for hotel staff?
Yes, if the hotel accepts cards. Requirement 12.6 asks for awareness training at hire and at least every 12 months, including phishing and social engineering, and Requirement 9.5.1.3 asks for training for staff at card terminals.
How do you train front-desk staff against phone scams?
With practice calls. An AI voice plays a guest, a manager or IT support and holds a real conversation in 28 languages, so staff learn to verify who is calling before they change a booking, a card or a password.
Related industries.
- IndustryRetail
Service-desk calls that end in ransomware, seasonal staff on shared tills and QR codes that copy trusted brands.
Read more - IndustryLogistics
Fake load-board listings, remote-access tools that end in stolen cargo, and ransomware that stops transport.
Read more - IndustryFinancial services
Payment-diversion emails, deepfake executives and phone calls that push staff to release a transfer or reset an account.
Read more
Training that works on every shift.
In a 30-minute demo we show the booking-platform, ClickFix and front-desk simulations and the lessons for hotel teams, on your own domain.