Booking Quotation Request Email Scam: Fake Booking Info Steals Passwords

A travel agency wants a booking quotation and an invoice for a deposit. For a reservations team, that sounds like an ordinary opportunity worth answering promptly.

The details seem to be waiting behind a booking-information link. Before opening it, check how this inquiry fits the business you actually handle.

Overview

The inquiry borrows the identity of a real travel agency

The booking quotation request email scam impersonates Turicâmbio – Viagens – Turismo, a travel agency in Porto, Portugal. It asks for booking review and an invoice.

The deposit is supposedly due to proceed that week. This gives hospitality staff a commercial reason to prioritize the message.

The genuine agency is not responsible for the impersonation. A signature using its name or contact information does not establish who sent the inquiry.

The apparent booking file is actually a route to a login page

The BOOKING INFO element is a hyperlink, not an ordinary attached booking document. It leads toward a false email-service sign-in.

The reported destination uses duis294-hrsac931-p0n.checkflicked[.]eu. The page adapts its appearance to the recipient’s email provider, including a Gmail-style imitation.

The request has changed: instead of reading itinerary details, you’re being asked for the credentials to your own mailbox.

Separate a possible customer inquiry from an unsafe document route

Do not open this booking link or enter an email password. Verify an expected business relationship through contact details obtained outside the message.

• Check whether your team knows the agency or proposed booking.
• Distinguish a link styled as a file from a genuine attachment.
• Don’t give a prospective customer access to your mailbox.
• Pause related payment instructions if account access was exposed.
• Let reservations, finance, and IT coordinate any actual incident.

Why the Deposit Promise Makes the Message Worth Opening

A booking inquiry doesn’t need to frighten anyone. It can work by offering normal business that the recipient would be paid to handle.

Reservations teams routinely receive questions from people they have never met. Unfamiliarity alone is not enough to distinguish a genuine customer from an impostor.

The request for an invoice adds a useful-looking next step. A staff member may assume payment depends on reviewing the linked details quickly.

That puts the employee in a familiar role: be helpful, respond efficiently, and don’t lose the booking. The link becomes part of completing the job.

But the commercial purpose doesn’t justify every technical request. A prospective booking partner needs availability, prices, and payment instructions, not your mailbox password.

Keep that boundary clear even when the inquiry seems valuable. You can discuss a possible booking while rejecting an unexplained sign-in page.

If the supposed sender refuses an ordinary way to describe dates and requirements, that is another reason to stop before opening anything.

How the Booking Quotation Request Email Scam Works

Step 1: A plausible agency inquiry reaches staff who handle new business

The message presents itself as a travel-company request. Its signature supplies the kind of organization, location, and contact detail that staff expect in business correspondence.

Those details create context without authenticating the sender. An impostor can copy a real company’s public information into a different mailbox.

An inquiry reaching your reservations address doesn’t mean someone broke into your booking system. Business contact details can be available without access to internal records.

Where a relationship already exists, verify through the contact recorded before this message. Do not let the new signature replace that independent anchor.

Step 2: Booking details are withheld behind the apparent file

The message gives the reader a task, but puts the information needed to finish it behind BOOKING INFO. Opening becomes the obvious next move.

A file-shaped card or document label can disguise a hyperlink. The presentation tells you what the sender wants you to think is there.

It does not establish the actual file type or destination. Look at what the mail application identifies before treating it as an attached itinerary.

You don’t need to open the link to demonstrate that distinction. If uncertain, ask your security team to examine the original message through its established process.

Don’t download a supposed viewer merely because the details won’t display. That would create a separate software risk beyond the documented credential lure.

Step 3: The invoice request makes the click feel financially necessary

The sender links the booking review to a deposit expected that week. That encourages the recipient to view caution as something delaying revenue.

Ask whether the booking itself is defined well enough to quote. A real invoice should relate to identifiable services and your organization’s actual payment process.

A promise to pay doesn’t verify the person making it. It also doesn’t require you to supply unrelated credentials before discussing availability.

Keep finance controls in place. A new inquiry should not bypass internal approval simply because the sender says the payment window is short.

If a separate customer is genuinely awaiting an invoice, continue through the known conversation. Don’t assume this message concerns that customer without checking.

Step 4: The destination imitates the recipient’s mail provider

The reported page is designed to recognize the email service and display a matching login. That makes the transition from inquiry to authentication feel less strange.

A Gmail user may see familiar account styling rather than travel-agency details. The changed branding should prompt a question about why mailbox access is needed.

Real organizations can use documented external identity services. This particular imitated login is not authenticated merely by resembling one.

Do not enter a password to unlock the supposed booking. A third party’s itinerary does not entitle that party to collect the password for your inbox.

If your address appears on the page, remember that it was already available to the sender. A prefilled field is not proof of an authorized session.

Step 5: Captured credentials can put genuine business conversations at risk

If the operator gains mailbox access, existing correspondence can become useful for further impersonation. Real names, booking details, and invoice conversations may make later messages more credible.

That possibility deserves a focused review, not a claim that every guest record was stolen. Look for actual access and suspicious account changes.

Payment instructions are particularly important where staff discuss deposits by email. Verify questionable changes through the established payment and contact process.

Don’t assume an invoice was altered simply because the password was exposed. Preserve records and let the relevant team establish what happened.

The fake inquiry’s original link isn’t needed once someone has usable credentials. Closing the page is only the beginning if a real password was entered.

Confirm the Agency Without Calling the Signature’s Number

A real business name gives you something to verify independently. It does not mean the contact details inside the disputed message are safe to use.

Start with your organization’s existing supplier or partner records. If the agency is new, obtain its genuine public contact route outside the email.

Ask whether the specific inquiry was sent and which booking it concerns. Avoid sending guest data or account details while trying to verify the sender.

No phone call or email contact test was made for this article. The copied agency identity is not treated as a verified relationship with the sender.

Even an accurate street address would not settle the issue. Public business information can be reused without the company’s knowledge.

Don’t post the genuine agency’s contact details with accusations against it. Make clear that the warning concerns an impostor misusing its identity.

A supplier should not need to know your mailbox password to confirm a booking request. Keep verification centered on the business facts rather than account access.

Inspect the Message Without Turning Staff Into Test Victims

Save the original message for the authorized security team. Full message details can be more useful than a cropped screenshot of a booking button.

Ask staff not to open the link on a second device to see whether it works there. That creates another interaction without establishing authenticity.

If the link is blocked, don’t disable protection to get the booking details. A customer’s proposed workflow doesn’t override the organization’s safeguards.

The current root-page capture produced a connection-timeout page, not the documented sign-in form. The full campaign path was not independently reproduced.

The illustration above is an original example with fictional contacts. It shows how a booking link can be presented, not an original message from the agency.

No password, guest document, invoice, or payment was submitted to test this case. A particular malware payload was not identified.

The central finding remains the false business inquiry leading to credential collection. Any actual download or installation should be investigated as an additional exposure.

What to Do if You Have Fallen Victim to This Scam

1. Stop using the booking-information link. Close the imitation and preserve the inquiry. Don’t send an invoice or guest details through the unverified conversation.

   Note whether you only clicked or supplied a password, code, document, or payment. Give that precise account to the person coordinating recovery.

2. Secure the exposed mailbox through its actual provider. Use a trusted environment, replace the compromised password, and follow genuine recovery instructions if access has changed.

   For company email, involve the administrator promptly. Tell them if the credential was shared with other work services rather than changing things silently.

3. Review access and mailbox settings with authorized help. Check unfamiliar sessions, recovery changes, connected applications, forwarding, and message rules relevant to the incident.

   Keep multifactor authentication enabled. Replacing a password and removing other access are separate actions that may both be necessary.

4. Check genuine bookings and invoices for suspicious communications. Ask reservations and finance to review relevant conversations, especially unexpected payment-detail changes.

   Verify with customers or partners through contacts already on record. Do not send the harmful link as part of a warning about it.

5. Contact the financial provider if money was sent or redirected. Give the real transaction details and explain the suspected impersonation or altered instructions.

   Ask about available recall or dispute procedures and keep the incident reference. Neither the travel-agency name nor a screenshot guarantees reimbursement.

6. Investigate downloaded files or installed viewers. Use current device protection such as Malwarebytes where appropriate. Managed work equipment should be handled with the organization’s IT team.

   Don’t delete unfamiliar system components or reset devices blindly. Preserve evidence and discuss backups before any action that could remove settings or business data.

7. Report the email and prepare for another approach. Use your provider’s phishing feature and the company’s reporting route. Be cautious of follow-up booking or recovery messages.

   AdGuard can reduce some malicious advertisements, but it doesn’t verify travel partners. Account protection and independent booking checks remain necessary after credential exposure.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Free — one of the most trusted malware removal tools available.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.

Stay Protected: Block Ads and Malicious Sites

Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

Use the Right Recovery Guide for the Mailbox

Google’s compromised-account guidance explains checking activity and securing a Google account. Use it only if that is the account actually involved.

For another provider, use its own instructions or your administrator. A copied Gmail design doesn’t necessarily mean your business mailbox is managed by Google.

Choose a new password that isn’t used elsewhere. If the old one was reused, address those accounts through their separate genuine sign-in routes.

Gmail’s phishing-report instructions describe how to flag a suspicious message. Other email applications provide their own reporting mechanisms.

Keep reporting and recovery distinct. Flagging the inquiry helps identify the lure but does not remove an intruder’s active session.

For work records, let the authorized organization decide whether customers or partners need notification. Don’t publish guest details as evidence of your own incident.

A Better Reservations Workflow for Unexpected Documents

Agree on an approved way to receive new booking details. Staff should know what to do when a customer insists on a different login or download process.

That doesn’t require treating every unfamiliar agency as hostile. It gives genuine customers a workable alternative while keeping mailbox access out of the transaction.

Separate invoice preparation from opening unverified content. Basic dates, services, and guest counts can be confirmed through the accepted process before finance issues anything.

Have a route for urgent uncertainty. Employees should be able to ask a manager or IT colleague without feeling they are jeopardizing a valuable booking.

Keep support calm after a mistake. Quick reporting can reveal the exposure before someone uses a trusted business conversation for another payment request.

Finally, review confirmed incidents for a specific improvement. A clear document policy is more useful than simply telling everyone to be careful next time.

Frequently Asked Questions

Is the named travel agency behind this scam?

No. The described email impersonates the genuine agency. Its name and contact information are borrowed to make the inquiry appear credible.

Is BOOKING INFO an actual attached file?

In this case it is a hyperlink styled as booking information. Following it leads toward a false email-service login rather than an ordinary attachment.

Why would a booking require my mailbox password?

The prospective customer has no reason to collect that credential. The change from itinerary review to mailbox authentication is the key warning.

Does the promised deposit prove the sender is a customer?

No. A payment promise can make the inquiry appealing without establishing a real booking, authorized representative, or incoming funds.

What if the sign-in page matched our usual provider?

The reported imitation adapts to the email service. Familiar styling doesn’t prove the password goes to that service rather than the page’s operator.

Should the team cancel every pending booking?

No. Preserve genuine business and review the affected conversations selectively. Verify questionable instructions through known contacts and involve the appropriate administrator.

The Bottom Line

Do not use this booking-information link or provide a mailbox password. The apparent quotation opportunity is a route toward credential theft, not a verified reservation.

If you entered credentials, secure the real account and review relevant business messages. Verify any genuine inquiry independently before sending records or acting on payment instructions.