Card testing campaigns target hotel booking engines

Stolen-card testing against hotel booking engines is not a single dramatic breach but a persistent, documented pressure across the industry. Trustwave's 2025 Risk Radar for the hospitality sector found criminal guides circulating on how to insert stolen credit card data into active bookings and bypass verification checks. Imperva put malicious bots at 37.4% of all web traffic to travel sites, and Visa ranks card enumeration among the top threats to the payments ecosystem. For a hotel, the question is no longer whether the checkout page gets probed, but how often and at what cost.

An ecosystem that teaches itself

The sharpest finding in Trustwave's 2025 report is cultural rather than technical: in underground forums, Telegram groups and private marketplaces, cybercriminals collaborate, share guides and trade access on how to exploit major booking platforms. SpiderLabs researchers specifically noted detailed tutorials on inserting stolen card data into existing reservations, defeating verification checks and avoiding detection. The report also measured the pressure at the login layer: brute force attempts rose about 14% since Trustwave's previous hospitality threat report, a category that includes credential stuffing and dictionary attacks, fed by the daily drip of credential dumps and password reuse.

The automation numbers from Imperva and Visa

Imperva's 2023 Bad Bot Report recorded that 37.4% of web traffic to travel sites came from bad bots, a return to pre-pandemic levels after two quieter years. The report describes how bots abuse the business logic of booking engines, from price scraping to account takeover, and lists stolen-card testing and credit card fraud among popular bad-bot abuses, including documented cases of payment pages used to validate stolen cards.

Visa's Biannual Threats Report from fall 2024 confirms the trend from the network side. Enumeration, the programmatic automated testing of payment elements through e-commerce transactions to guess card numbers, CVV2 codes or expiration dates, remains among the top threats to the payment ecosystem and produces significant follow-on fraud. Over the six months the report covers, the US region accounted for 58% of issuer-side enumeration transactions, up 16% year over year. The report also details an incident at a travel e-commerce merchant where stolen credentials were used to upload JavaScript files to the checkout page, replacing the legitimate payment processor URL with a fake form that harvested guest payment data.

What it looks like from the defense side

Card testing follows a grammar a front-office or fraud team can learn to recognize without any operational detail. A healthy booking engine sees transaction volume proportional to real demand. Storms of micro-authorizations, often for pennies or small amounts, with sequential card numbers or many card-and-code combinations from one IP range, signal batch validation of stolen card files. Two variants worry fraud teams most: direct validation on the checkout page, and inserting a stolen card into an already existing booking, the move the underground guides Trustwave observed are designed to hide by mimicking a guest completing or editing a stay.

The consequences for a property are twofold. Financially, mass declined authorizations bring interchange fees, risk network downgrades and potential penalties when fraud ratios exceed contract thresholds. Operationally, a burst of automated attempts can slow the engine for genuine guests and bury real signals in noise, exactly when a genuine skimming implant would want to hide in the same logs.

A documented precedent: the IRM Ng engine

Bitdefender's September 2023 whitepaper "Booking Engine Security Revisited" documented a different attack on the same surface. Investigating a US resort's server from November 2022, researchers isolated XModule, a malicious IIS native module purpose-built for e-skimming, the theft of card data and passwords by injecting malicious code into a JavaScript file used by Resort Data Processing's IRM Next Generation booking engine. The original attack against that engine was discovered in 2021. Five vulnerabilities received public identifiers: CVE-2023-39420, CVE-2023-39421 and CVE-2023-39422 for hard-coded credentials in application components, CVE-2023-39423 for an SQL injection, and CVE-2023-39424 for an injection in a file upload component. Bitdefender says it tried to reach the vendor for more than 90 days without answer before publishing.

The precedent matters for how hotels read the risk: the same checkout page that attracts card testing can also be breached to capture data at the source, and in raw logs the two phenomena look similar until someone separates them.

What properties can watch

The cited reports converge on the same defenses, none of them magic. On detection: alert thresholds on authorizations per minute, tracking the look-to-book ratio, IP logging and correlation, and extra controls on card changes to existing reservations, the technique underground guides present as quiet. On accounts: multi-factor authentication on booking platform logins, phishing simulations for staff, and dark web monitoring for chatter about the property's brand, a measure Trustwave recommends explicitly to spot exploitation of a booking portal before it lands. On vendor relations: asking booking engine and payment gateway providers for their security posture, since the IRM Ng case showed that a vendor unreachable for three months is itself part of the risk.

The wave has not produced one dramatic collapse of a major hotel site, and that is the signal to keep in mind. Card testing works by attrition: a permanent wave across thousands of small properties rather than a single headline.