For the past few weeks, customers of Norwegian Cruise Line have been reporting emails that quote authentic personal information, accurate reservation numbers, and even the exact dollar amounts they have paid for reservations on upcoming NCL cruises.
The emails threaten to cancel upcoming cruise reservations if customers don't immediately "verify" their payment method.
But the emails aren't from Norwegian. They appear to be an attempt by scammers to use authentic information to trick customers into clicking through to a scam website that collects their credit card information.
It's unknown how the scammers have been able to obtain accurate booking information from the cruise line, but the situation is so dangerous that NCL posted an urgent warning at the top of its website, NCL.com:
"We are investigating reports of fraudulent emails claiming to be from Norwegian Cruise Line. We advise guests not to click links, respond to these emails, or provide personal or payment information. Norwegian Cruise Line emails come from @ncl.com, @e.ncl.com or @nclcorp.com. For reservation questions, contact your travel advisor or call 866.234.7350. For numbers outside the United States, visit ncl.com/contact-us."
Hackers are now using true booking details
This latest scam sounds an awful lot like a similar swindle that Frommer's reported earlier in October involving authentic hotel reservations information (see: This Harmless-Looking Hotel Scam Could Happen to Anyone).
The sudden emergence of widespread scam operations that somehow manage to obtain accurate personal information to appear legitimate should alarm everyone who books travel digitally. We're entering an age in which scammers can direct AI to hack your private information directly from the source and use it to paint a convincing mask on any scam they wish.
Confirmation emails are being weaponized across all travel sectors.
We're even seeing unverified reports of scam phone calls that appear to use authentic personal details.
It's probably not a coincidence that earlier this week, financial institutions worldwide reported a surge in attempts by unauthorized AI agents to access private bank accounts.
From now on, remember: Even an email containing your accurate reservation information is not proof that the email is genuine.
To validate any request for personal information from a travel vendor, even if the email seems urgent and even if you're currently in the process of doing business with that vendor, you must always contact the vendor directly, preferably by phone, to verify that the request was authentic. Never, ever click links—not even to just have a look at the page.
If you can't phone your vendor, make sure you navigate to its website by typing the address yourself, never by clicking on a link provided to you by someone else.
