Updated

Updated · Fox News · Jul 2

Travel Breaches Expose 2.1 Million Amtrak Accounts and Other Booking Data to Scammers

Updated

Updated · Fox News · Jul 2

Travel Breaches Expose 2.1 Million Amtrak Accounts and Other Booking Data to Scammers

Q: AI can now clone a loved one's voice in seconds. Is a simple 'code word' truly enough to stop the next emergency scam?

No. A family code word is useful, but by itself it is not enough against AI-powered emergency scams. It still matters because it creates a simple test a fraudster may fail. Cybersecurity experts continue to recommend a prearranged safe word or verbal PIN for family emergencies, especially as AI can now clone a voice from just a few seconds of audio. But the weakness is human, not technical: in a panic, people may forget to ask for it, or be pressured past it by urgency, secrecy, and fear. That risk is growing because travel breaches give scammers the raw material to make calls far more believable. Recent incidents at Booking.com, Amtrak, Carnival, and airline service providers exposed names, contact details, travel dates, and sometimes ID data. Combined with data-broker records and spoofed caller ID, criminals can time a fake “stranded abroad” call precisely when a loved one is actually traveling. The stronger defense is layered verification. If a caller asks for money, credentials, or secrecy, hang up and contact the person through a known number or separate channel. Ask a question only the real person would know, not something discoverable online. Never rely on the incoming call alone, no matter how familiar the voice sounds. Reducing the odds of being targeted also matters: limit public audio and video posts, tighten social-media privacy, remove personal data from broker sites, and use strong account security. A code word is a good tripwire. It is not a complete shield.

3 articles · Updated · Fox News · Jul 2

Hundreds of thousands of travelers had booking details exposed this spring, with scammers in some cases sending messages quoting real hotel names and check-in dates before breach notices arrived.
Travel bookings often bundle names, addresses, trip dates, payment details and sometimes passport numbers, giving criminals enough information to mimic hotels, airlines or family emergencies convincingly.
Recent incidents span Booking.com in April 2026, Amtrak with more than 2.1 million accounts exposed, Carnival in June affecting nearly 6 million people, and a 2025 KLM-Air France third-party breach.
The weak point is often not the brand itself but hotel staff accounts, customer-service vendors or a single compromised user account, making the problem an industry-wide partner-chain risk.
Recommended defenses include verifying booking messages through official sites, using credit or virtual cards, enabling alerts and 2FA, deleting stored passport or card data, and setting a family code word.