Phishing at the Front Desk: Usable Security in Luxury Hotels

Luxury hotel staff work in some of the world’s most stunning locations. They maintain immaculate properties and provide outstanding service. However, behind the warm greeting, they contend with the same operational demands and vulnerabilities as hotel teams everywhere, only more intensely.

The latest incident began with a familiar pattern. On Monday, the General Manager contacted HR and IT after Finance identified several refunds issued to guests who never requested them. The payments had gone to fraudulent accounts, and the evidence pointed to another cyber breach.

As the investigation progressed, IT confirmed that attackers had targeted the hotel again. This time the entry point was a phishing email designed to look exactly like a booking request, the type of message the hotel receives every day. In most industries, an email from a stranger is a warning sign. In hotels, that is part of the job. A new booking starts with an email from someone we have never met.

We suspect a colleague opened the email and clicked the link, unknowingly giving the attackers access to the reservations shared inbox. For two weeks, it went unnoticed.

During that time, the attackers went in and out of the inbox, copying previous refund requests. They then sent several refund requests to the manager, and because they looked exactly like the real thing, the manager approved them.

This incident cannot be classed as simple user error, nor separated from the fast-paced and demanding environment hotel employees work in daily.

Why Luxury Hotels Collect So Much Personal Data

Luxury hotels operate in a world where guest expectations are extravagant, personalised and almost limitless. Service is paramount. As one General Manager (GM) once told me, the only real boundary is illegality. Guest requests range from the ordinary to the extraordinary. Midnight in-room massages, specific wellness rituals and bespoke gastronomic experiences are routine. A colleague once flew more than 1,300 miles to collect a guest’s preferred toiletry bag. Another guest requested honey and goat’s milk for daily baths. These requests are not unusually eccentric; they are normal and frequent.

Meeting these expectations requires coordination across multiple departments, external partners and specialist suppliers, all relying on detailed and sensitive guest information. Butler teams curate personal routines using preferences, allergies, health notes and lifestyle details. Culinary, nutrition, spa and wellness teams use dietary and health information to tailor meals and treatments.

Security teams manage access requirements and guest movements. Front desk and reservations teams handle booking histories, loyalty profiles, communication records and operational updates. External suppliers such as chauffeurs, private jet and yacht companies and restaurants also receive guest details to deliver services. Luxury hospitality depends on a constant flow of personal, behavioural and operational data to deliver the experience guests expect.

Why Standard Security Guidance Does Not Fit Luxury Hotels

To meet the demands of discerning guests and support the level of service they expect, hotels have embedded technology into every part of their operation. It drives efficiency, attracts guests and encourages repeat stays. However, technology is not what makes hotels such appealing targets for cyber-attacks. It is the data.

Hotels have become data hubs, holding guests’ personal details, payment information, employee records, CCTV footage and operational data. This is especially true in luxury hotels and resorts that cater to A-list celebrities, politicians, business travellers, royalty and the ultra-wealthy. Even non-resident guests leave a digital footprint when they use the facilities.

More technology means more data. More data means greater value to attackers, and it does not take much to compromise it.

Protecting this data depends on the people who use hotel systems every day. This is where the challenge begins. Much of the security guidance hotels rely on assumes a working environment that simply does not exist in hospitality. It assumes quiet periods for training and system updates, predictable staffing levels, downtime to reset for the next business day and a business that focuses on one core activity. For instance, a bank sells financial products. It does not also serve dinner, run a spa and host a wedding at the same time. It does not have to manage a VIP whose expectations can stretch the service experience far beyond standard operating procedures (SOPs).

Hotels do not have that advantage. They operate around the clock. Guests never fully leave, and staff turnover is constant. By the nature of the industry, hotels’ third-party partners are widely known, making it easy for attackers to exploit hotels with this information. The hotel business model relies on delivering many services at once, enabled by modern technology, all within a single location. Each new venue, vendor or system, along with growing dependence on IoT, AI and other digital tools, adds another possible access point for attackers.

The differences go further.

• A small town under one roof. In addition to guests, some staff live on property, suppliers work on site, and restaurants, bars, gyms and leisure facilities (e.g. tennis, water sports, golf) serve guests and the public. Luxury resorts amplify this complexity, often operating villas and private residences spread across acres or in remote locations.
• Peak periods coincide with holidays. When many businesses are closed, hotels are at their busiest, with higher occupancy, more VIP guests in-house, and employees working longer hours.
• Split responsibility. Hotels are often owned by one company, managed by another and branded by a third, which can leave security ownership unclear.
• Laws from many countries. Hotels market to guests worldwide and share data across borders with owners, brands, suppliers and booking platforms, which can create obligations under several data protection regimes.

Despite these differences, one important question has received very little research attention. What operational realities and colleague challenges are quietly enabling successful cyber-attacks within hotels?

The Real Cost of One Click

Think back to the reservations inbox. Cyber-attacks are more likely to succeed when the frameworks and security rules used to train staff and write SOPs do not align with the operational realities of the hotel sector.

The consequences of a cyber-attack affect the entire operation. Guest and employee data can be compromised; the hotel’s reputation can suffer, and it can lose business.

The financial impact begins immediately. Investigations are expensive. External forensic teams must be hired; systems must be audited and compromised processes rebuilt. Insurance premiums increase. Regulators may impose fines, and legal claims from guests or partners can follow, as some large hotel groups have experienced. Together, the costs can run into the millions.

The operational impact goes far beyond an IT server going down. Systems slow or go offline. Check-in queues grow. Payment terminals fail. Key cards stop working. Guests cannot access their rooms. Employees who were hired to provide service suddenly become crisis managers. The GM becomes the spokesperson, explaining to angry guests why the hotel cannot deliver the experience they paid for or what the breach means for them.

The human impact is often the hardest. Employees must work overtime. Front-desk teams face guests who are shouting or demanding answers. They feel humiliated. No one wants to stand in the lobby and apologise repeatedly for something they did not cause, especially in markets where employees rely on tips to supplement their wages.

Most employees never set out to cause a breach. Research has long supported this. In their paper “Users Are Not the Enemy”, Anne Adams and Angela Sasse found that when security rules clash with how people actually work, people find ways around them. Our inbox is a clear example. Security training tells staff not to trust emails from strangers, yet in reservations, answering strangers is their job. Knowing the rule does not help when the job requires breaking it. How staff feel about security matters too. Research has found that security behaviour depends not only on how well employees understand the risks, but also on how they feel about security policy.

Hotel employees do not deliberately ignore the SOPs. No employee wants to be the one who gets caught out by a phishing attack. The breach is not carelessness. It is the result of relying on guidance that does not match the reality of the industry.

Service and Security Can Share the Same Room

Two things can be true at the same time. Service should not have to take a back seat for cybersecurity to be effective, and cybersecurity should not undermine the service standards that define luxury hospitality. To move forward, we need to appreciate the diversity of luxury hospitality and understand the human and organisational factors that shape daily operations, particularly in properties that serve discerning guests for whom money is no object. These guests expect cutting-edge technology, ultra-fast internet and seamless digital experiences. They expect private in-villa check-ins and check-outs, personalised attention, convenience and absolute discretion.

Employees are trained to put the guest first, with every effort focused on delivering a flawless experience. In that environment, it is easy to use a workaround, miss a small detail in an email address or not report a “meaningless click”.

That is exactly what happened in our reservation’s inbox. The pace of the industry, training and culture, the service mentality of employees and the urge to go above and beyond all create conditions that attackers can exploit.

This is where it becomes clear that luxury hospitality needs a security framework that fits its environment and the guests it serves. Generic rules and standardised training do not match the pace, pressure and service expectations of luxury hospitality.

When security controls are designed for environments that do not reflect the sector, employees are left to bridge the gap themselves. Sometimes it works, and sometimes it does not. Getting it wrong can be costly for luxury hotels. Guest data can be used for identity theft, fraud, extortion and targeted scams. For high-profile guests, a leaked room number or travel itinerary can become a personal safety risk. For a sector built on absolute discretion, protecting this data is part of the service itself.