The holiday season is here, but beware, hackers are launching more scams and phishing attacks than ever before.

Check Point Research warns that summer holiday scams are on the rise, with hospitality and travel businesses hit by 2,291 weekly attacks in May 2026 alone.
Attack volume doubled compared to May 2023; Over 47,000 new travel domains registered, 1 in 112 already flagged as malicious
Booking, Airbnb and Skyscanner usurped; Travelers are advised to verify domains before entering personal or payment details

Scams targeting people looking to book summer holidays are on the rise, researchers have claimed – and not only that, but the volume of attacks is significantly higher than last year, or the year before, indicating a growing problem.

Security experts Check Point Research found that in May 2026 alone, the hospitality, travel and leisure sector saw an average of 2,291 weekly cyberattacks per organization. Attacks increased 24% month-over-month, while their volume more than doubled compared to May 2023.

In total, over the past three years, the company has seen a 122% increase in attacks against the industry.

Falsified website

At the same time, the global year-on-year increase across all sectors was just 2%, which CPR says means criminals are specifically targeting holidaymakers:

“This is not a general rise in cybercrime affecting travel. This is a deliberate, seasonal escalation targeting an industry that processes enormous volumes of personal and financial data precisely when people are distracted, in a hurry and eager to score a good deal.”

A large portion of these scams are phishing emails and fraudulent and spoofed websites, and these have increased significantly. In May 2026 alone, CPR reports that 47,318 new travel-related domains were registered, an increase of 33% from April and 19% from May last year.

Worse still, among these domains, one in 112 is already classified as malicious or suspicious. That doesn’t mean the other 111 are legitimate, it just means that many more are dormant at the moment, waiting to be activated during summer traffic peaks.

If you’re looking to book a flight or accommodation in the near future, be sure to check the area you’re visiting, as major platforms like Booking, Airbnb, and Skyscanner have already been spoofed thousands of times with fake websites stealing sensitive data and even money.