The convenience of booking holidays and making payments with a single tap has transformed travel. But as Indian travellers go digital, cybersecurity firm Kaspersky warns that this convenience comes with hidden risks that could turn a dream vacation into
a nightmare.
A New Era of Digital Travel Risks
As Indians embrace digital-first travel, the methods for planning and paying for trips have shifted almost entirely online. From booking flights and hotels to paying for local transport and food with UPI, every step is now a digital transaction. This seamless experience, however, has also created a fertile ground for cybercriminals. Security experts at Kaspersky recently highlighted a surge in sophisticated scams specifically targeting travellers. According to their research, travel-related brands are prime targets for impersonation, with attackers creating fake websites and offers designed to steal money and personal information.
The Fake Booking and 'Too Good to be True' Deal
One of the most common threats involves phishing websites that perfectly mimic legitimate booking platforms, airlines, and hotels. A traveller, eager to snag a great deal, might click on a sponsored link or a social media ad that leads to a clone of a popular travel site. Kaspersky warns that these fake pages are designed to harvest credit card details and personal data under the guise of completing a reservation. In many cases, the victim pays for a flight or hotel room only to discover that no booking was ever made, and the money has vanished. These scams often create a sense of urgency, pressuring users into making quick decisions without scrutinising the website's URL or authenticity.
Weaponised QR Codes and Payment Gateway Scams
For Indian travellers who rely heavily on UPI and QR code payments, new threats have emerged. Scammers have been known to physically tamper with QR codes at shops, restaurants, and tourist spots. They might paste a fraudulent QR sticker over the legitimate one, redirecting payments to their own accounts. Kaspersky's team has specifically warned travellers about this risk, noting that since tourists are often in a hurry and unfamiliar with local merchants, they make easy targets. Before confirming any UPI payment, it is crucial to verify that the merchant name on the app screen matches the actual vendor. Any discrepancy should be treated as a major red flag.
Malware Disguised as Travel Apps and Services
Cybercriminals often distribute malicious software, known as Trojans, disguised as helpful travel apps or transport services. Recent Kaspersky findings revealed that between the second quarter of 2025 and the first quarter of 2026, their solutions detected over 260,000 attack attempts linked to major transport brands alone. These malicious apps are designed to steal banking credentials and payment information directly from a user's phone. Another prevalent threat in India is the 'Rewardsteal' Trojan, which masquerades as a rewards app to siphon off sensitive data. Downloading apps only from official sources like the Google Play Store or Apple's App Store is a critical line of defence.
Your Pre-Travel Cybersecurity Checklist
Staying safe doesn't mean giving up digital convenience. It just requires a bit more vigilance. Based on expert recommendations, here is a checklist to follow before and during your trip:
1. Book Directly: Whenever possible, book flights and hotels on the official websites or apps of the providers rather than clicking on links from emails or ads.
2. Verify URLs: Before entering any payment information, double-check the website address. Look for the padlock symbol and ensure the domain is not a 'lookalike' with subtle misspellings.
3. Use Secure Wi-Fi: Avoid making sensitive transactions, like banking or booking, on public Wi-Fi at airports or cafes. Use your mobile data instead, or a trusted VPN service to encrypt your connection.
4. Enable Multi-Factor Authentication (MFA): Add an extra layer of security to your email, banking, and travel accounts with MFA.
5. Check QR Codes Carefully: When paying via QR, always confirm the merchant's name in your UPI app before authorising the payment.
6. Monitor Your Statements: Keep a close eye on your bank and card statements during and after your trip. Report any unrecognised charges immediately.
