As travellers more and more depend on digital platforms to e-book flights, lodging and transport, cybercriminals are exploiting the urgency and belief constructed into the trendy journey journey.
Journey planning has develop into more and more digital. Flights are booked via airline web sites and apps, lodging is reserved on-line, funds are made electronically and travellers typically handle their complete journey from a smartphone.
That comfort additionally creates alternatives for cybercriminals.
In line with analysis shared by Kaspersky, its safety options recorded 262,663 detections related to main transport manufacturers between Q2 2025 and Q1 2026. The exercise concerned cyberthreats distributed underneath the guise of well-known airways, ride-hailing companies and different transport corporations.
Emirates accounted for 61% of the detections related to the transport manufacturers analysed by Kaspersky, whereas Uber represented 37%. Trojans have been the commonest menace sort amongst recordsdata and objects related to transport manufacturers, accounting for 30.5% of detections, adopted by Trojan-Bankers at 22.5%.
The findings illustrate a broader downside: criminals don’t essentially have to compromise a real airline or reserving platform. As a substitute, they’ll exploit the status of a trusted model to steer travellers to reveal credentials, fee info or different delicate knowledge.
Why journey is a pretty goal
Journey creates a very efficient setting for social engineering.
Folks typically make bookings underneath time stress, examine costs throughout a number of web sites and reply rapidly to messages about reservations, flight modifications or particular gives. A message claiming {that a} reserving has been cancelled or {that a} traveller is entitled to compensation can due to this fact seem credible at exactly the second when the recipient is almost certainly to click on.
Kaspersky researchers recognized, for instance, a phishing scheme impersonating Ryanair by which victims have been advised they have been eligible for flight compensation. They have been then directed in direction of a course of requiring account info or a small fee.
Picture credit score: Kaspersky
The obvious urgency was a part of the deception.
An identical scheme recognized by researchers impersonated Reserving.com. Victims have been directed to a fraudulent reserving web page designed to resemble a respectable checkout course of and have been requested to offer private and fee info. The supposed reservation didn’t exist.
Picture credit score: Kaspersky
These methods are usually not restricted to 1 airline, reserving service or nation. They exploit a typical weak spot throughout the journey ecosystem: belief mixed with urgency.
Africa faces a wider cybercrime problem
For African travellers and tourism companies, the problem must be seen towards a broader enhance in cyber-enabled crime throughout the continent.
INTERPOL’s 2025 Africa Cyberthreat Evaluation Report discovered that two-thirds of surveyed African member nations reported that cyber-related offences represented a medium-to-high share of all crime. In Western and Japanese Africa, cybercrime accounted for greater than 30% of reported crime, in keeping with the evaluation. On-line scams, phishing, ransomware and enterprise e-mail compromise have been among the many most ceaselessly reported threats.
The report additionally highlights the rising use of social engineering, synthetic intelligence and on the spot messaging platforms by legal networks. That is notably related to journey as a result of many interactions between travellers and repair suppliers now happen via digital channels.
Africa’s cybersecurity capability can also be growing, though vital variations stay between nations.
The Worldwide Telecommunication Union’s World Cybersecurity Index 2024 reported that Africa’s common cybersecurity rating elevated to 57, a 22-point enchancment in contrast with the earlier version. The index assesses nations throughout authorized, technical, organisational, capacity-development and cooperation measures.
The ITU evaluation additionally locations a number of African nations amongst its highest-performing cybersecurity group, together with Ghana, Kenya, Mauritius, Rwanda and Tanzania, whereas different nations stay at earlier levels of cybersecurity improvement. This variation issues for companies working throughout borders as a result of digital dangers and nationwide capabilities are usually not uniform throughout the continent.
The danger extends past travellers
The implications are usually not restricted to particular person vacationers.
Journey corporations maintain priceless info together with buyer names, contact particulars, reserving histories, fee info and communications. Airways, lodges, on-line journey companies, tour operators and transport corporations are due to this fact enticing targets for criminals looking for both direct monetary acquire or entry to buyer accounts.
For companies, a fraudulent reserving web page can even injury one thing that’s troublesome to rebuild: buyer belief.
INTERPOL has repeatedly harassed the significance of cross-border cooperation as a result of cybercrime doesn’t cease at nationwide borders. In an Africa-wide operation in 2025, authorities in 18 African nations and the UK arrested 1,209 suspected cybercriminals, recognized practically 88,000 victims and dismantled greater than 11,000 malicious infrastructures.
The size of such operations demonstrates why cybersecurity ought to more and more be handled as a part of enterprise resilience reasonably than solely as an IT perform.
What travellers ought to do
The simplest safety typically begins with easy choices.
Guide via official web sites and purposes. Travellers ought to keep away from accessing reserving or fee pages via unsolicited hyperlinks in emails, textual content messages or social media posts. As a substitute, they need to open the official web site or app independently.
Examine the net tackle fastidiously. Fraudulent web sites can imitate respectable journey platforms, generally with solely small variations within the area identify or web page design.
Deal with pressing gives with warning. Messages demanding instant fee, threatening cancellation or promising unusually giant compensation needs to be independently verified.
Use distinctive passwords and multi-factor authentication. Journey accounts can comprise private info and fee particulars, making them priceless targets.
Obtain purposes solely from trusted sources. Customers ought to examine the writer, critiques and requested permissions earlier than putting in an unfamiliar journey utility.
Monitor fee accounts after making bookings. Unrecognised transactions needs to be reported to the related monetary establishment as quickly as doable.
Watch out with QR codes. A QR code can direct a traveller to a malicious web site simply as simply as a traditional hyperlink. The vacation spot needs to be checked earlier than credentials or fee info are entered.
What tourism companies ought to do
Companies can scale back the chance by making safe digital practices a part of the client expertise.
Journey corporations ought to clearly talk their official fee channels and domains, present prospects with a dependable approach to confirm reserving messages and prepare staff to recognise phishing and impersonation makes an attempt.
They need to additionally shield buyer accounts with sturdy authentication, monitor uncommon exercise and preserve clear procedures for responding to fraudulent bookings or compromised accounts.
For companies working throughout African markets, cybersecurity consciousness is especially necessary as a result of travellers could transfer between nations with totally different digital infrastructures, regulatory environments and ranges of cybersecurity maturity.
The target mustn’t merely be to stop each fraudulent message from reaching a buyer. It must also be to make it troublesome for a buyer to mistake a fraudulent communication for a respectable one.
Digital belief is turning into a part of the journey expertise
The expansion of on-line journey has made journeys simpler to plan, but it surely has additionally moved extra of the traveller’s relationship with airways, lodges, transport suppliers and tour operators into the digital setting.
Kaspersky’s journey analysis exhibits how criminals are exploiting acquainted manufacturers and the stress surrounding bookings and funds. INTERPOL’s evaluation demonstrates that phishing and on-line scams are already amongst Africa’s most important cyberthreats.
For African tourism companies, the lesson is broader than merely warning prospects about phishing.
As journey turns into extra digital, cybersecurity is more and more a part of customer support, enterprise continuity and model status. Defending travellers’ info and serving to them recognise respectable communications can due to this fact develop into an necessary a part of sustaining belief in Africa’s rising digital journey economic system.
Sources
Kaspersky — Secure Journey Insights: Kaspersky analysis cited on this article covers cyberthreat detections related to transport and travel-service manufacturers from Q2 2025 to Q1 2026.
INTERPOL — 2025 Africa Cyberthreat Evaluation
INTERPOL — New report warns of sharp rise in cybercrime in Africa
