Cybercriminals are taking advantage of travelers as they increasingly rely on digital platforms at every stage of their journey. Over the past year, Kaspersky solutions recorded nearly 270,000 attack attempts distributed under the guise of popular travel-related brands. To help people explore the world with greater confidence, Kaspersky presents Kaspersky Safe Travel Insights — a handbook for eventful, yet safe travel.
Scattered across the globe, Kaspersky employees from 20+ countries share first-hand perspectives on the places and experiences that make their home destinations worth discovering, as well as perspectives on what digital risks travelers should be cautious about when traveling to these locations.
Transport brands: the biggest target
Booking a trip today means juggling ride-sharing apps, airlines, and online travel agencies — often across multiple tabs and devices, and frequently under time pressure to grab a good deal. This mix of urgency, trust in familiar brands, and constant switching between platforms creates fertile ground for cybercriminals, who disguise phishing pages, fake apps, and fraudulent offers abusing legitimate transport and travel services.
Kaspersky researchers analyzed cyberthreats distributed under the guise of major transport brands*. From Q2 2025 to Q1 2026, Kaspersky solutions recorded 262,663 detections associated with these brands. Attacks masquerading as Emirates accounted for the largest share, representing 61% of all detections associated with transport brands, followed by Uber with 37%. The overwhelming majority of activity observed in this category involved leveraging the appearance of two leading brands, demonstrating how attackers can concentrate their efforts around widely recognized services with large audiences and frequent payment activity.
Trojans were the most common threat type detected among files and objects associated with transport brands, accounting for 30.5% of detections, with Trojan-Bankers following at 22.5%. This type of malware is designed to steal banking credentials and payment information. In other words, cybercriminals impersonating transport brands aren’t just after a traveler's booking details — in the majority of cases, they’re going straight for the traveler’s bank account.
An example of a phishing page impersonating the Irish airline “Ryanair”
Among the schemes uncovered by Kaspersky researchers is a classic “you're entitled to compensation” scam impersonating Ryanair. Victims receive a message claiming they qualify for a flight compensation payout, then are pushed to either enter their account credentials or pay a small “processing fee” to release the funds. The scam relies heavily on manufactured urgency, giving victims only a matter of seconds to act before the supposed offer expires. This kind of extreme time pressure is a major red flag: legitimate compensation claims are never time-limited to the point of forcing a decision within seconds, and airlines never require an upfront fee to process a refund.
Booking platforms and travel services: a smaller, but real risk
Beyond transport brands, Kaspersky also studied threats disguised as travel and accommodation services**. From Q2 2025 to Q1 2026, Kaspersky solutions recorded 5,414 attack attempts associated with these brands. The threats most frequently distributed under their guise were Trojans, which accounted for 54.6% of detections.
Travel service accounts can contain payment details, personal information, booking histories and conversations with accommodation or activity providers, making them attractive targets for cybercriminals. Malicious files or pages imitating familiar platforms may be designed to steal credentials, compromise payment information, install additional malware or provide attackers with access to the victim’s device.
An example of a phishing page impersonating Booking.com
In another scheme impersonating Booking.com, victims land on a convincing fake booking page, and are asked to enter their personal and payment details to complete what looks like a successful reservation — only to receive nothing in return. No confirmation email arrives, no room is actually booked, and the money goes straight to the scammers. Because the fraudulent page mirrors the real Booking.com checkout flow so closely, victims often only realize something is wrong once they arrive at their destination and find no reservation on record.
“Travel brands sit at a unique intersection of trust, urgency and payment activity, which makes them extremely attractive to cybercriminals seeking to appear legitimate. People booking a flight or a ride are often moving quickly, comparing prices across several tabs, and are primed to click on anything that looks like a good deal or an account issue. What's striking in our transport data is that the most-targeted brands span completely different services — from ride-sharing to full-service airlines — which tells us that attackers are casting a wide net rather than focusing on one niche,” said Evgeny Kuskov, Lead Security Researcher at Kaspersky.
For more travel inspiration, visit Kaspersky Safe Travel Insights, where Kaspersky employees share first-hand perspectives on the places, food and experiences worth discovering in their home countries. The project also highlights the digital threats travelers may encounter in different destinations — from travel-related phishing and payment scams to unsafe public Wi-Fi — and provides practical advice on staying protected while planning, booking and enjoying a trip.
To avoid falling victim to travel-related scams, Kaspersky recommends:
- Book directly through official websites or apps. Avoid clicking on booking or “your reservation” links from emails, texts, or social media messages — go to the airline, ride-sharing, or booking platform directly instead.
- Double-check the URL before entering payment details. Phishing pages disguised as airline, transport, or booking sites often use lookalike domains that are easy to miss at a glance.
- Be wary of “too good to be true” deals, especially those requiring urgent action or unusual payment methods like wire transfers or gift cards.
- Use strong, unique passwords for travel and transport accounts, and enable multi-factor authentication (MFA) wherever it's offered.
- Only download travel and transport apps from official app stores, and check reviews and permissions before installing.
- Monitor bank and card statements after booking travel, and report any unrecognized charges immediately.
- Only scan QR codes from trusted and verified sources. Carefully check website addresses and payment details before proceeding, and avoid downloading applications or files from QR code links unless their legitimacy has been confirmed. In Kaspersky Premium, you can use our Secure QR Scanner feature. The scanner checks links to websites encrypted in QR codes and will notify you when a link to a malicious or phishing website is detected.
- Kaspersky Premium uses AI‑powered scam protection to identify phishing websites and fraudulent payment pages before you share sensitive data. Combines machine learning, real‑time monitoring, and identity theft checks.
- If you need to use public Wi-Fi, the VPN included with Kaspersky Premium helps encrypt your internet connection, providing additional protection while accessing travel services, email or online accounts.
* Emirates, Uber, BlaBlaCar, Expedia, Bolt, Qatar Airways, Air France, Lufthansa, Kayak, Singapore Airlines, Turkish Airlines, British Airways, Wizz Air, Trip.com, Skyscanner, Ryanair.
** Booking.com, TripAdvisor, Agoda, Airbnb, Viator.
