Scammers target holiday travelers using leaked travel data from companies

Holiday travel is stressful enough with crowded airports, expensive flights, and last-minute itinerary changes. But there is a hidden part of the travel industry that most people don’t know about: Your personal data It’s collected, packaged, and sold every time you book a flight, book a hotel room, or check a travel app.

Whether you’re traveling for Christmas or booking early for New Year’s, the companies you trust with your most sensitive data – full name, home address, passport information, travel dates and device data – are sharing and selling a lot more than you think.

During the holiday rush, this data becomes a goldmine for scammers.

Let’s explain how this works, which companies collect the most information and what you can do before you travel to keep your personal information out of the wrong hands.

Sign up for my free CyberGuy report
Get the best tech tips, breaking security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – for free when you join my site CYBERGUY.COM Newsletter.

Protect your data before holiday shopping scams happen

Holiday travel brings more than just stress because every booking and check-in quietly generates personal data that you may not even realize you’re giving up. (Istock)

Why holiday travel puts your data at risk

The holiday season is the peak period for collecting travel-related data. Airlines, hotels, booking platforms, loyalty programs and Travel apps All are seeing huge spikes in traffic, as millions of Americans search for deals, compare prices, check for gate changes, and rebook delayed flights.

Each of these actions creates trackable data points, including:

• Email address
• Phone number
• Full name and date of birth
• Title history
• Travel itineraries
• Passport or identity data
• Device fingerprint
• IP address and location
• Shopping habits and spending patterns.

You might assume that this data stays with the airline or hotel. no.

Most companies share it with advertisers, analytics companies, data brokers, and dozens of unnamed “partners.” Some even use your data to build a profile about you, such as how often you travel, how much you’re likely to spend, and whether you’re a “high-value” target.

This information can easily leak into scammers’ databases, which is why holiday travelers are suddenly seeing:

• Fake “Your flight has been cancelled” text messages.
• Phishing emails that appear to match hotel confirmations
• Fake baggage fee claims
• Fake TSA PreCheck renewal notices
• “Urgent re-verification required” messages.

Scammers rely on the fact that you are stressed, in a hurry, and anticipating travel updates. And because they already have your personal data, their attacks are frighteningly convincing.

Stop foreign-owned apps from collecting your personal data

Airlines, hotels, apps and booking platforms collect much more information than most travelers know, and this data is often shared with advertisers and data brokers. (AP Photo/Ryan Sun)

Examples of what major travel companies collect

Here are real-life examples of how holiday travel platforms collect and share your data:

1) Airlines (Delta, American, United, Southwest)

Major US airlines collect not only your name, phone number and email, but also your travel companions, payment details, geo-location data, device data and loyalty program activity.

They share this with:

• “Marketing Partners”
• Analytics platforms
• Third Party Advertisers
• Data enrichment companies.

Over time, many of these partners become part of the data broker ecosystem.

2) Booking platforms (Expedia, Booking.com, Hotels.com)

Each booking platform details what it collects in its privacy policy. Often, these sites track:

• Search history
• Price opinions
• Device fingerprint
• Click Behavior
• Location based on IP
• Payment attempts – even abandoned carts.

This is used to create profiles that determine which deals you are offered and how aggressively you are targeted.

3) Hotel chains (Marriott, Hilton, IHG)

Marriott’s Privacy Policy and other privacy statements list more than 60 categories of data it collects. Some chains have been caught sharing guest data with:

• Ad networks
• Social media platforms
• Third-party Guest Experience tools
• Affiliate networks
• Data brokers for cross-device tracking.

Cybercriminals use the information of more than 500 million Marriott guests, exposed during a four-year hack that began in 2014, to formulate and execute travel-related scams to this day.

4) Travel apps (Airbnb, Hopper, KAYAK, TripIt)

These are some of the most aggressive data collectors because they work non-stop on your phone. Many people collect:

• Location in real time
• communication
• Clipboard data
• Behavioral analytics
• Device ID
• In-app browsing.

Some of these companies then “share the information with partners to improve marketing,” which is usually code for selling data.

Discarded luggage tags are worth money to scammers

Fraudsters use leaked travel details to send fake flight alerts, hotel messages and urgent push notifications that look real because they actually contain your personal information. (Istock)

How scammers use your travel data

Once your information enters the ecosystem, fraudsters build travel-themed attacks designed to hit you at the worst possible time. Some common examples include:

• Fake flight notifications: (For example, “Your flight has been cancelled, click here to rebook”)
• Urgent hotel “Payment Failed” emails: Scammers use leaked address and reservation data to send emails that look exactly like they’re from Hilton or Marriott
• Counterfeit baggage fees: (For example, “Pay $24.90 to edit your selected bag”)
• TSA and Global Entry Renewal Scams.

This is not a guess. They already have your name, flight, hotel, location and travel dates, because data partners in the travel industry sold or leaked them.

How to protect yourself before traveling

Here are my top steps to staying private this holiday season:

1) Check the data the travel companies already have

Hotels, airlines, and booking sites have options to remove data, although it’s buried in their privacy settings.

2) Stop apps from tracking your location

Turn off location permissions for apps like:

• Hopper
• Airbnb
• Expedia
• Hotel tonight.

Many track you even when not in use. Here’s how to do it for iPhone and Android:

On iPhone: It opens Settingshandle Privacy and securitythen press Location servicesscroll down to Application And click Every applicationand set site access to “While using the app” or “never,” And off “Share my location” If you don’t want them to see exactly where you are.

On Android: It opens Settingshandle location, Then choose App location permissions or app permissions, finds application and click on it, Change each one to “Allow only while using the app” or “Don’t allow” So they can’t track you in the background. (SSettings may vary depending on your Android phone manufacturer.)

3) Remove your personal data from data broker websites

This is the most important step. Even if you prevent airlines and hotels from collecting new data, your existing data is already circulating through dozens of data brokers, and that’s what scammers use to target travelers.

Data brokers maintain:

• Your travel patterns
• Title history
• Email and phone details
• Income level
• Home information
• Names of your family members.

You can manually request removal from hundreds of sites, but it takes months. That’s why I recommend a data removal service. While no service can guarantee complete removal of your data from the Internet, a data removal service is truly a smart choice. It’s not cheap, and neither is your privacy. These services do all the work for you by systematically monitoring and scraping your personal information from hundreds of websites. This gives me peace of mind and has proven to be the most effective way to clear your personal data from the Internet. By limiting the information available, you reduce the risk of fraudsters cross-referencing data from breaches to information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free check to see if your personal information really exists on the web by visiting Cyberguy.com

Get a free check to see if your personal information is already on the web: Cyberguy.com

4) Use an email alias for reservations

Alias ​​email It reduces the amount of spam and phishing attempts you will receive. By creating email aliases, you can also protect your information. These aliases forward messages to your primary address, making it easier to manage incoming connections and avoid data breaches.

For recommendations on Private and secure email service providers That offer aliases, visit Cyberguy.com

5) Avoid airport Wi-Fi for anything related to payments

Scammers often operate fake hotspots. So, avoid the airport Public Wi-Fi service When accessing financial information.

Click here to download the FOX NEWS app

Key takeaways for Kurt

The holiday season is here, and many of us are preparing to travel to see family and friends. As travel increases, so does the collection and sharing of personal data. Airlines, hotels, and travel apps often share your information with unknown third parties, which scammers can use to target you during your trip. Before you pack your bags, take a few minutes to remove your personal data from online brokers. Doing so helps protect your identity and allows you to travel with peace of mind.

How do you protect your personal information when traveling during holidays? Let us know by writing to us at Cyberguy.com

Sign up for my free CyberGuy report
Get the best tech tips, breaking security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – for free when you join my site CYBERGUY.COM Newsletter.

Copyright 2025 CyberGuy.com. All rights reserved.