I have faced the same issue twice: 2 people, whose names are definitely not the same as mine, used my email address to book hotels through a well-known hotel company and a lesser-known hotel booking site (well, lesser-known in my country).

Each time, by fear of phishing or credit card theft, I never clicked in the mails or called the numbers present in the mail, and called the companies (once a hotel, the other a booking site) by using the phone number on their site to check whether it is phishing and that my credit cards were safe.

The weirdest part is that the bookings do exist! And the emails were legit, the employees genuinely believing that it was me (well, my email address) who did those bookings... The sender address was theirs, the phone number in the mail was the right one,...

The bookings were made with another name, with other credit cards (the employees gave me the first numbers of those credits cards and they were not mine), but with my email address! This email address is a very long one, so no way it was done by mistake! I also tried to request a password reset on the booking site (which I never used) to check whether an account has been made there using my address, and my address was not recognized.

And, at least for the first one, where I didn't react early, the people did not show up at the hotel and the hotel manager sent me a mail telling that they will take money from the credit card (which is not mine) as a compensation.

So my questions are: 1) what kind of scam is this? Why would you need my email address and not my credit card? 2) what can I do to stop it, or at least, avoid aggravation of the issue? I've already changed all my passwords last time for complicated ones (most of them through password generator), and it still takes place.

Thanks in advance

  • 2
    How easy would it be to "fat finger" your email address? – Cowthulhu Aug 16 '18 at 14:07

As I am not a cyber-criminal all I can do is guess. ;-)

As hotels often pre-approve credit cards at the time of making a booking I would say that this is a way for bad guys to test to see if the stolen credit card details they bought on the black market actually work.

Your email address is being used because they probably plucked it out of a compromised email database that is readily available on the dark web. You can actually go to haveibeenpwned.com to see if your email address has been listed in a data breach.

Changing passwords is absolutely one of the first things you should do when anything funky happens so well done there.

To answer your questions...

  1. This looks like a simple test of stolen payment details against your email address.
  2. Not much apart from changing email addresses unfortunately.
  • 1
    There are no "email databases on the dark web". That's a common myth. These databases are often sold on the regular internet. There are even free databases on the regular internet, though those are much less up to date. – forest Aug 17 '18 at 8:54
  • They are everywhere. Again, have a look at haveibeenpwned.com to see if your email address has been captured in a leak. It is pretty extensive. – Ben Aug 18 '18 at 10:08
  • Yeah they are everywhere, but not on the "dark web". At least not unless someone has decided to simply mirror something from the regular internet. – forest Aug 18 '18 at 13:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.