Malik Haidar has spent his career in the trenches of corporate defense, translating complex digital threats into strategic business risks. As a seasoned cybersecurity expert with deep experience in protecting multinational corporations, he has witnessed firsthand how hackers exploit the gaps between technology and human psychology. Today, with the European Commission intensifying its gaze on major travel platforms, Haidar provides a crucial perspective on why the current investigations under the Digital Services Act are a watershed moment for the travel industry. Our discussion explores the mechanics of recent phishing campaigns, the systemic vulnerabilities in how guest data is shared, and the heavy financial stakes facing platforms that fail to secure their digital ecosystems.
How do the current investigations by EU regulators represent a shift in how major travel platforms are expected to manage phishing and fraud risks?
The European Commission is essentially pressure-testing whether these major players are living up to their status as Very Large Online Platforms. With the Digital Services Act having been in force since November 2022, regulators are no longer accepting excuses for systemic vulnerabilities that lead to direct financial loss for consumers. This formal proceeding, which was announced on October 21 following a detailed preliminary probe, centers on whether the platform has done enough to stem the tide of sophisticated scams. It is a high-stakes environment where a failure to comply could trigger a staggering fine of up to 6% of global annual turnover, a number that forces even the largest boardrooms to prioritize security over mere growth.
What specific vulnerabilities exist in the way guest and reservation data is shared between platforms and accommodation providers?
The way reservation data flows between a central platform and individual hotels is often the weakest link in the digital security chain. We have seen how cybercriminals can intercept these “handshakes” to pivot from a secure-looking booking into a devastating phishing attempt that feels entirely legitimate to the user. The Commission is specifically looking at what safeguards are in place to prevent this sensitive information from being misused to solicit fraudulent payments from unsuspecting travelers. It is not just about technical encryption, but about the strict protocols that govern who sees what data and when, ensuring that a single compromised hotel does not become a gateway to thousands of victim profiles.
How can the design of an internal messaging service be exploited by malicious actors to carry out phishing attacks?
Messaging services within these apps are designed for convenience, but for a hacker, they are a gold mine of perceived trust. When a customer receives a message inside the official platform’s ecosystem, their guard naturally drops, making them far more likely to click a malicious link or provide payment details without a second thought. Regulators are scrutinizing the design and functioning of these communication tools to see if they are essentially “open doors” for malicious actors to execute phishing attacks. If a platform is not actively monitoring and filtering these internal interactions for red flags, they are effectively providing a protected, “verified” channel for scammers to operate right under the user’s nose.
In what ways does the dissemination of illegal content, such as impersonation fraud, create a systemic risk for the entire travel ecosystem?
The dissemination of illegal content, particularly impersonation fraud and non-compliant accommodations, has become a systemic plague that undermines the entire digital economy. It is heartbreaking to hear stories of families arriving at a destination only to find the “luxury villa” they booked does not exist, which is a direct result of inadequate vetting processes. Under the DSA, the platform has a clear responsibility to assess and mitigate these risks proactively rather than just reacting after a traveler has already lost their money. This investigation will determine if the current measures are robust enough to catch these fraudulent listings and impersonated accounts before they can be used to harvest deposits and ruin vacations.
How do advertising transparency obligations under the DSA help protect users from being lured into fraudulent schemes?
Transparency in advertising is a pillar of the DSA because it prevents malicious actors from “buying” credibility through sponsored spots that look official. The investigation is digging into whether the firm meets its obligations to clearly disclose how and why certain ads are shown to users, preventing a “pay-to-play” environment for scammers. We often see sophisticated threat actors use paid advertising to push fraudulent links to the top of search results, tricking users into thinking they are interacting with the official brand when they are actually on a spoofed site. By enforcing strict transparency, regulators want to ensure that the platform is not inadvertently profiting from ads that lead users directly into a phishing trap.
Looking at recent history, what can we learn from the Vidar, ClickFix, and recent Japanese phishing campaigns about the evolution of these threats?
The history of these attacks shows a relentless evolution, starting with campaigns like the Vidar infostealer in 2023 that targeted hotel credentials to reach customers. More recently, in March 2025, Microsoft flagged the “ClickFix” campaign that used malicious emails to lure users across North America and Asia into downloading malware. Just this June 2026, we saw a specialized campaign identified by TrendAI Research in Japan that used fake guest complaints to trick hotel staff into opening malicious files. Each of these instances highlights a different vector of attack, proving that the threat is not static but constantly finding new ways to exploit the human element of the travel industry through social engineering.
What is your forecast for the future of digital travel regulation?
The regulatory landscape is going to become significantly more aggressive, moving from occasional audits to continuous, real-time oversight of digital platforms. I expect that by 2028, we will see “security by design” become a mandatory legal requirement rather than just a best practice for tech companies operating in the European market. This will likely involve AI-driven fraud detection systems that are audited by independent third parties to ensure they are catching more than just the obvious, low-level scams. Ultimately, the cost of being insecure is becoming higher than the cost of implementing top-tier defense, which is the only way we will truly see a shift in how these global giants prioritize consumer safety.
