Duff on Hospitality Law

Happy Saturday from Seattle . . .  Our Online Travel Update for the week ending Friday, March 14, 2025, is below.  What started as a relatively quiet week in the travel industry (other than the concerning reports from several major airline carriers that captured much of the travel industry’s attention and reporting), finished with a bang as multiple outlets began warning on Friday of a widespread phishing campaign targeting the hospitality industry via fake Booking.com emails.  I hope you enjoy.

• Microsoft and Others Warn of Widespread Phishing Campaign Via Booking.com.  The campaign, which, according to Microsoft, began in December 2024, uses an increasingly popular social engineering technique called ClickFix to deliver malware designed to steal users’ credentials.  According to Microsoft,  “[T]his phishing attack specifically targets individuals in hospitality organizations in North America, Oceania, South and Southeast Asia, and Northern, Southern, Eastern and Western Europe, that are most likely to work with Booking.com, sending fake emails purporting to be coming from the agency.”  The fake emails encourage recipients to respond to negative reviews left on the platform by purported guests.  Recipients of the emails are then re-directed to a fake page that ultimately allows the hackers to collect payment and personal information.  So why are these campaigns targeting Booking.com and not other travel platforms?  The answer isn’t clear, though earlier last week, the UK consumer watchdog Which? reported that the lack of effective checks left Booking.com wide open to fraudulent campaigns (and listings) and urged the platform to do more to prevent fraud on its side.  Even if Booking.com chooses to ignore these requests, the UK’s Online Safety Act (which takes effect this year) may force its hand – at least in the UK.
  
  
• California Legislature Is Focused on Allegedly Abusive Predictive Pricing.  California legislators have introduced five (yes, five) bills aimed at limiting or preventing predictive pricing.  Predictive pricing involves the use of various technologies (including AI) to set different prices for the same products and services (including travel) based on users’ personal information (e.g., browsing history, residence).
  
  
• Another Week and Another Booking Platform Announces Its AI Partnerships.  South Korean online travel agent, Yanolja, announced this past week new partnerships with Google and OpenAI (including OpenAI’s new agentic AI tool, Operator) to offer new products and services to hoteliers and to enhance users’ trip planning experience.
  
  
• Massachusetts AG Releases New Junk Fees Rule.  Massachusetts’ Attorney General, Andrea Joy Campbell, announced the new regulations this past week as part of National Consumer Week.   Like the FTC’s recently issued final junk fee rule (which takes effect this May), the new Massachusetts’ regulation requires hoteliers to present most prominently the total price (rate and mandatory fees) of products and services whenever pricing is presented.  Taxes and other government charges are excluded from total price, though of note, taxes and charges on a hotel that the hotel chooses to pass on to the guest are not excluded.  The regulations also expressly require hoteliers to provide the nature and purpose of the mandatory fees.  The new regulations take effect on September 2, 2025.  This newest regulation underscores the need for uniform regulation of junk fees across the United States, which is a critical component missing from the FTC’s rule. 

Have a great week.