AI Agents Now Automate Attacks on Booking Logins

Security researchers are warning that AI agents - software capable of carrying out multi-step tasks without a human at the keyboard - are now being deployed to run cyberattacks, and the hospitality sector is a stated target because of the volume of payment data and guest personal information that flows through booking systems.

For a short-term rental operator, the practical shift is speed and scale, not novelty. Phishing emails impersonating Airbnb, Booking.com or Vrbo support desks have circulated for years. What is changing is that an AI agent can now draft, personalize and send thousands of convincing variants of those messages in minutes, adjust the wording if a filter blocks it, and probe multiple logins - property management system, channel manager, payment processor - in the same run. Security teams describe this as attacks that used to need a small crew now running on autopilot.

Where rental businesses are exposed

The weak points are familiar ones, just hit harder and faster. Shared logins to channel managers, guest-messaging inboxes left open across a team, and payment or payout details stored in spreadsheets are the targets most often cited. A convincing message asking a host to "confirm" a reservation by clicking through to a fake OTA login page is the most common entry route, followed by fraudulent payment-redirect requests that mimic a cleaning contractor or maintenance vendor asking for a change of bank details.

Voice and message impersonation is the newer risk. AI tools can now generate a passable imitation of a guest's or supplier's writing style, or even a short voice clip, making a request to change payout information or release a guest's personal data harder to spot as fraudulent on a quick read.

What operators can do now

None of the standard defenses have changed, only their urgency. Multi-factor authentication on every channel manager, PMS and payment account is the baseline; a stolen password alone should not be enough to reach a calendar or a payout. Teams should verify any request to change bank or payout details through a second channel - a phone call to a known number, not a reply to the email that made the request. Staff handling guest messages should be told explicitly that OTAs do not ask hosts to re-enter login credentials through an emailed link, and any message that does should be treated as fraudulent by default.

Property managers running multiple listings across platforms carry more exposure simply because more accounts and more staff have access. Restricting who can change payment or payout settings, logging out shared devices, and reviewing account access every quarter costs little and closes the most commonly abused gap. None of this requires new software; it requires treating a message that looks routine with the same suspicion as one that looks obviously fake.