CSIRT-CAN – Centro de Respuesta a Incidentes de Seguridad de Canarias

Enjoy the summer, but stay protected from cyber scams

Summer is synonymous with vacations, travel, and relaxation. However, while millions of people are planning their getaways, cybercriminals take advantage of this period to launch increasingly sophisticated fraud campaigns.

During the summer months, scams involving accommodation bookings, transportation, online payments, and fake communications increase significantly. These scams are designed to trick users into revealing their personal or financial information.

Understanding the most common threats is the first step toward avoiding them.

1. Smishing: SMS-Based Fraud

Smishing is a form of phishing carried out through text messages (SMS). Cybercriminals send messages pretending to be courier companies, banks, government agencies, or travel providers.

Some of the most common messages include:

  • "Your package could not be delivered."
  • "Please confirm your reservation before it is canceled."
  • "Suspicious activity has been detected on your account."
  • "A small payment is required to complete your delivery."

These messages contain a link that redirects users to a fake website designed to steal login credentials, banking information, or install malware on their device.

How to protect yourself

  • Don't click on links received via SMS if you weren't expecting the message.
  • Always verify the sender.
  • Visit the company's official website by typing the address directly into your browser.
  • If in doubt, contact the company through its official channels.

2. Quishing: The Danger of Fake QR Codes

QR codes have become part of our daily lives. We use them to view restaurant menus, pay for parking, access tourist information, and make payments.

Because of their popularity, cybercriminals have started using them as a tool for fraud. This technique is known as Quishing (QR + Phishing).

In many cases, attackers replace legitimate QR codes with fake ones that redirect users to fraudulent websites.

Victims believe they are making a legitimate payment or accessing an official service when, in reality, they are handing over their personal or financial information to criminals.

How to avoid this scam

  • Check that the QR code hasn't been placed over another one.
  • Look carefully at the website address before entering any information.
  • Never download apps from unknown QR codes.
  • Before making a payment, ensure the website begins with https:// and genuinely belongs to the company.

3. Fake Holiday Rental Scams

Vacation bookings are also one of scammers' favorite targets.

Fraudsters create highly attractive listings using real photos copied from other websites, offer prices well below market value, and present deals that seem too good to pass up.

Once the victim sends a bank transfer or makes an advance payment, they discover that the accommodation never existed or that the supposed property owner was fake.

Warning signs

  • Prices that are significantly lower than comparable listings.
  • Requests for payment by bank transfer or other direct payment methods outside the booking platform.
  • Pressure to book immediately because "many other people are interested."
  • Refusal to arrange a video call or provide proof of ownership.
  • Photos that look unusually perfect or have been copied from other listings.

How to book safely

  • Use reputable booking platforms.
  • Read reviews from previous guests.
  • Verify the property's location using Google Maps.
  • Be cautious of deals that seem too good to be true.
  • Never make payments outside the official booking platform.

General Tips to Avoid Cyber Scams During the Summer

Most of these scams share the same objective: getting you to act quickly without thinking.

To reduce your risk:

  • Keep the operating system on all your devices up to date.
  • Enable Two-Factor Authentication (2FA) whenever possible.
  • Use strong, unique passwords for every account.
  • Never reuse passwords across different services.
  • Only install apps from official app stores.
  • Regularly monitor your bank accounts for suspicious transactions.
  • Be suspicious of any message that creates a sense of urgency or fear.

Prevention Is Still Your Best Defense

Cybercriminals seize every opportunity to deceive users, and summer is one of the busiest seasons for online fraud campaigns.

Taking just a few seconds to verify a link, confirm a booking, or inspect a QR code can help prevent financial losses, protect your personal information, and even stop identity theft.

When it comes to cybersecurity, prevention remains the most effective defense.