{"id":51753,"date":"2025-10-03T11:32:36","date_gmt":"2025-10-03T11:32:36","guid":{"rendered":"https:\/\/www.cyberguru.it\/2025\/10\/03\/the-digital-shadow-over-hospitality-vcc-scams\/"},"modified":"2025-10-06T14:42:11","modified_gmt":"2025-10-06T14:42:11","slug":"the-digital-shadow-over-hospitality-vcc-scams","status":"publish","type":"post","link":"https:\/\/www.cyberguru.it\/en\/2025\/10\/03\/the-digital-shadow-over-hospitality-vcc-scams\/","title":{"rendered":"The Digital Shadow over Hospitality: VCC Scams"},"content":{"rendered":"\n

In Italy\u2019s hospitality world, behind the convenience of online bookings lurks an increasingly sophisticated threat: scams carried out through virtual credit cards (VCCs) issued by booking portals<\/strong>. This phenomenon is hitting Italian accommodations hard, from small family-run inns to luxury hotels. <\/p>\n\n\n\n

Although precise statistics are hard to quantify because these scams often go unreported, industry associations are recording a worrying rise in cases. Reports to law enforcement have surged dramatically over the past two years, with financial losses estimated in the tens of millions of euros per year. <\/p>\n\n\n\n

The most affected regions are the most popular tourist destinations: Veneto, Tuscany, Campania, and Sicily top the list of reports, but the phenomenon is quickly spreading to other destinations as well.<\/p>\n\n\n\n

What VCCs are and why They\u2019Re Vulnerable<\/strong><\/h2>\n\n\n\n

Virtual credit cards are a technology paradoxically designed to increase security: they are single-use digital cards automatically generated by portals like Booking.com, Expedia, or Airbnb to process guest payments<\/strong>. Each VCC contains a temporary card number, an expiration date, and a security code, just like a physical card, but with a crucial difference: they\u2019re intended for one-time use and for a specific amount. All VCCs must be charged within 12 months from the check-out date<\/strong>, as specified by Booking.com. A time window that can become an opportunity for scammers. <\/p>\n\n\n\n

Virtual credit cards are used to scam both hoteliers and customers.<\/strong><\/p>\n\n\n\n

Scams Targeting Properties<\/h2>\n\n\n\n

A classic scam against a property involves the front desk agent receiving a call from someone posing, for example, as a software maintenance technician who needs to update the program. They ask for remote access and claim that without immediate action the ability to receive bookings will be blocked. The call usually comes in the evening and catches the victim off guard, and they often fall into the trap, opening the door to the criminal. <\/p>\n\n\n\n

In other cases, criminals obtain virtual card details by bypassing staff through a Trojan horse\u2014malware that masquerades as legitimate software and tricks the user, gaining access to the IT system. It still stems from human error, since Trojans are installed by people, perhaps by clicking a link in an email or downloading files from unsafe sites. <\/p>\n\n\n\n

ASAT<\/strong> (Hotel Association<\/a>) reports that it regularly receives notices of fake bookings made with credit cards that are likely cloned or stolen. In this scheme, criminals use stolen credit card data to generate fake bookings through the portals, creating seemingly legitimate VCCs that the hotel attempts to charge, only to later discover their fraudulent origin. <\/p>\n\n\n\n

A more sophisticated mechanism exploits the fact that VCCs have specific time windows for charging. Scammers create legitimate bookings but then manipulate systems to let the cards expire before the hotel can charge them<\/strong>, leaving the property unpaid for services rendered. <\/p>\n\n\n\n

Scams Targeting Guests<\/h2>\n\n\n\n

The most widespread involves fraudulent communications that appear to come directly from the property. Impersonating hotel staff, scammers contact guests requesting a second payment for supposed \u201csecurity checks\u201d or \u201cbooking confirmations.\u201d <\/p>\n\n\n\n

Beyond this type of message, there have also been cases where the guest is contacted via WhatsApp. Payment isn\u2019t requested, only the entry of credit card credentials for verification purposes and to keep the booking active. It\u2019s a way to obtain the customer\u2019s card data, presenting the request as a simple technical procedure. <\/p>\n\n\n\n

More skilled criminals combine phishing and social engineering techniques<\/strong>, creating fake websites that perfectly mimic booking portal interfaces. Through these sites, they collect sensitive data from both guests and properties, which they then use to generate fraudulent VCCs. <\/p>\n\n\n\n

Naturally, even when the theft targets the guest, the property is hit hard because it has suffered the system breach and data leak from which names, addresses, and contacts of guests or prospective guests were stolen. This reputational damage quickly turns into financial loss. <\/p>\n\n\n\n

How to Spot a VCC Scam<\/h2>\n\n\n\n

Warning Signs for Properties<\/strong><\/h3>\n\n\n\n

Suspicious Bookings:<\/strong><\/h4>\n\n\n\n