Fake travel-agency 'booking inquiry' email links to credential phish on checkflicked.eu
PCrisk reports a phishing email with the subject "booking inquiry" that falsely uses the name and contact details of Turicâmbio - Viagens - Turismo, a travel agency in Porto, Portugal. It asks the recipient to review…
- First reported
- Reports
- 1
Source: pcrisk.com · published
What happened
PCrisk reports a phishing email with the subject "booking inquiry" that falsely uses the name and contact details of Turicâmbio - Viagens - Turismo, a travel agency in Porto, Portugal. It asks the recipient to review booking details and send an invoice for a deposit. The "BOOKING INFO" element is a link, not an attachment, to duis294-hrsac931-p0n.checkflicked.eu, which detects the recipient's email provider and shows a matching fake login page (for example a Google sign-in) to steal credentials. Turicâmbio has no involvement and is not accused. The agency's name and details were taken from a genuine business and used in the sender's signature without its knowledge.
How the scam works
Business-to-business scams like this one are built to look like the routine work of a travel desk: a quote request for a booking, a prompt to "share your invoice" and a deposit "this week". The signature gives a name, a Porto street address and a phone number. The sender's display name matches the agency, but the sender address is on an unrelated domain.
The "BOOKING INFO" item is styled as an Excel file icon with a green highlight, but it is a link. It opens a page on a throwaway subdomain of checkflicked.eu that checks the email provider and shows a login page to match, so the victim thinks they need to sign in to see the file. Passwords typed there go to the attacker.
PCrisk's findings point to credential theft, not a real booking. Stolen mailbox access can be used to read invoices, divert payments and send convincing follow-up messages to the victim's own business contacts. If you handle bookings or invoices, treat any unexpected request that asks you to log in to view a document as suspect, and confirm it by calling the sender on a number you already have.
PCrisk notes that campaigns of this kind are sometimes also used to distribute malware, rather than or in addition to harvesting credentials, so a click should never be treated as harmless.
Source
PCrisk, "Booking Quotation Request Email Scam" (removal guide, 27 October 2026).
Red flags
- An unexpected quotation or booking request from a company you don't deal with.
- A document that looks like an attachment but is a link.
- A sign-in page that appears when you try to view the file, on an unfamiliar domain.
- A sender address that doesn't match the agency whose name and phone number appear in the signature.
- A request to send an invoice and arrange a deposit quickly.
If you were targeted
- 1Don't click the 'BOOKING INFO' link or sign in on the page it opens.
- 2If you entered your email password, change it now, sign out of other sessions and turn on multi-factor authentication.
- 3Check unexpected requests by phoning the company on a number from its official website.
- 4Warn colleagues and report the email as phishing; delete it.
- 5Check your mailbox for unfamiliar forwarding rules.