The old cues for spotting a scam are becoming unreliable. Misspelled words, strange formatting, unfamiliar sender names, requests that arrive completely out of nowhere: those signals are fading. Scammers using artificial intelligence tools have learned to replicate legitimate correspondence closely enough that their messages no longer stand out from the real ones.

“The most dangerous scams don’t look suspicious; they look expected,” said Iskander Sanchez-Rola, a scam expert at Norton, the cybersecurity company.

Summer travel is winding down, but with Thanksgiving and the holiday season approaching, this is a good time to understand how these scams work and what to watch for. According to a Federal Trade Commission report published in June 2026, Americans lost $3.5 billion to impostor scams last year, with nearly one in three fraud reports involving an impostor contact. Travel is among the most targeted contexts.

Reservation hijacking

One of the more sophisticated scams circulating now involves hotel reservations. In reservation hijacking, scammers first phish hotel staff to obtain their login credentials, which gives them access to real booking data. They then contact guests directly, posing as the hotel, and include the guest’s actual reservation dates and exact costs in the message to establish credibility.

The communication typically claims something has gone wrong with a payment and asks the guest to click a link and enter new information. Because the details are pulled from the legitimate reservation system, the message does not look like a guess. It looks accurate.

“The main thing is that this isn’t a fake booking confirmation, it’s a real reservation that is weaponized against you,” said Sanchez-Rola.

If you receive a message like this, go directly to the hotel’s official website and call the number listed there. Do not call any number provided in the suspicious message. Do not click the link.

Fake flight cancellations

A related scam takes advantage of the anxiety around travel disruptions. Scammers send urgent messages claiming a flight has been canceled or significantly delayed, then offer to rebook the passenger for an additional fee.

“You’re going to a place, and one day before that happens, they tell you that the flight was canceled,” said Sanchez-Rola. “So in that moment, there is an inherent urgency.”

Go directly to your airline’s portal and verify the status before doing anything else. Do not click links in text messages. And do not post photos of tickets or boarding passes on social media, even with flight numbers covered by emojis. The QR codes and barcodes on travel documents contain more information than the visible number, sometimes including return flight details.

QR code swaps

QR codes became a restaurant standard during the pandemic as a contactless alternative to physical menus. Their ubiquity has created an opening for a simple but effective scam: placing a sticker with a fraudulent QR code directly over the real one.

“You may be sitting at a coffee shop and have a real QR code with a fake one that’s a sticker laid right on top,” said Alissa Abdullah, Mastercard’s deputy chief security officer.

If the payment page looks unfamiliar or you notice a sticker layered over another at a table, ask a staff member and pay with cash or a card instead.

Public Wi-Fi

Free Wi-Fi at airports and hotels is useful and also a common point of exposure. Criminals create networks with names close to the legitimate ones, counting on people to connect without verifying. If you join their network, they can potentially steal information, damage your device, or gain remote access.

“Sometimes cyber criminals will create a network that looks close to the name of a legit network to dupe you into logging onto their network,” said Brian Cute, chief executive officer of Global Cyber Alliance.

If you need public Wi-Fi, stick to low-stakes tasks like finding directions. Banking, email, and anything requiring a password or payment are better saved for a private connection.

The behavioral shift all of this requires is less about memorizing a list of scams and more about building one habit: when travel-related urgency appears in a message, slow down, go to the source directly, and remind yourself that a scam depends on speed. Taking a moment to pause could be your greatest act of defense.

Image alt text: Person looking at their phone with a concerned expression at an airport departure gate, luggage nearby