Impersonation Scams Are Rising in Hospitality—Your Guest Data May Be at Risk

The hospitality industry thrives on trust. Guests hand over personal and payment information with the expectation of a secure, seamless experience. But behind the scenes, cybercriminals are exploiting this trust through a growing wave of impersonation scams, often targeting undertrained seasonal employees during peak travel seasons.

What Is an Impersonation Scam?

Impersonation scams—also known as social engineering attacks—occur when a hacker pretends to be someone else: a manager, vendor, or even a guest. These scams may come in the form of:

• Emails asking for updated credit card information

• Fake calls from “IT support” asking for login credentials

• Messages appearing to come from a supervisor asking for a wire transfer or guest data

In busy, fast-paced hospitality environments, it’s easy for staff—especially seasonal workers—to fall for these schemes.

Why Hospitality Is a Prime Target

The hospitality industry handles a high volume of sensitive customer data daily, including:

• Credit card information

• Passport and ID numbers

• Email addresses and personal preferences

• Reservation history and travel details

Combine this with frequent turnover, thin IT teams, and a surge in seasonal hires—and you’ve got the perfect storm for cybercrime.

According to the Identity Theft Resource Center, impersonation scams have surged by 148%, becoming the most-reported scam category in the U.S. In the hospitality sector, these attacks are escalating even faster—industry reports indicate social engineering scams against hotels rose nearly 300% in the first half of 2024, including phone-based “vishing” that mimics staff voices to extract sensitive data (Blueprint RF).

What’s at Stake?

A single impersonation attack can result in:

• Data breaches that violate privacy regulations like PCI-DSS or GDPR

• Financial loss from fraudulent payments or fake vendor payouts

• Reputation damage, especially with review-driven platforms like Google or TripAdvisor

• Legal consequences due to negligence in data protection

And it doesn’t just impact large hotels—small inns, rental companies, and boutique resorts are just as vulnerable.

Why Staff Training Is Your First Line of Defense

Seasonal employees often lack deep familiarity with internal systems or phishing red flags. That’s why training is critical—especially in high season when the stakes (and distractions) are high.

Effective training should include:

• Spotting fake emails, texts, and calls

• Verifying internal requests through proper channels

• Understanding why guest data must be protected

• Knowing when and how to escalate suspicious activity

As a hospitality business, you deserve simple, engaging security awareness programs—even for short-term or temporary hires.

5 Ways to Protect Guest Data Year-Round

1. Use multi-factor authentication (MFA) on all systems

2. Create role-based access so staff only see what they need

3. Implement a formal guest data retention policy

4. Partner with a managed IT team for 24/7 security support

5. Run phishing simulations to train your team against real-world attacks

Security Is a Guest Service, Too

Protecting customer data isn’t just a backend IT concern. It’s part of your guest experience. When people feel secure with your brand, they return, recommend, and review it positively.

Want to safeguard your guest data and train your seasonal staff?

Let’s talk about how SNH Technologies can help your hospitality business stay secure all year long.