Phishing peaks in summer as risk awareness drops

The summer season is increasingly being exploited by cyber criminals as a prime window to launch targeted phishing campaigns. According to Action Fraud, UK consumers lost over £11.6 million to holiday related scams in 2024 alone, with July and August seeing the highest volume of reports.

Why?

Experts point to a combination of seasonal distractions and increased online transactions, particularly for travel and leisure, as key drivers. With staff taking annual leave and workflows stretched thin, businesses are also becoming easier prey for invoice fraud and impersonation attempts.

Proofpoint, a global cyber security firm, recently warned that over one third of major UK travel booking platforms are failing to implement basic email authentication protections, such as full DMARC rejection policies, leaving customers vulnerable to spoofed messages. “Criminals know people are more likely to be booking trips or awaiting parcels,” said Adenike Cosgrove, cybersecurity strategist at Proofpoint. “That makes them more likely to click without thinking.”

Fake travel sites and booking confirmations are widespread

A common scam involves fake travel booking websites or emails posing as legitimate platforms such as Booking.com, Airbnb or Jet2. In many cases, victims are lured through paid adverts on social media or search engines, where fraudulent domains are made to closely resemble real travel brands.

In one incident recently flagged on Reddit and verified by multiple users, scammers exploited Booking.com’s internal messaging system to pose as hotels, sending follow up messages asking guests to confirm payment via a malicious third party link. The impersonators mimicked the platform’s branding and messaging style with alarming accuracy.

Fake accommodation offers

According to Action Fraud, 44% of holiday related phishing reports in 2024 involved fake accommodation offers. Many victims were contacted after initially engaging with a legitimate booking site, suggesting criminals are monitoring and hijacking booking journeys to insert phishing attempts at key points.

Delivery text scams continue to catch holidaymakers off guard

One of the most persistent phishing threats this summer is smishing, where fraudulent text messages impersonate delivery companies such as Royal Mail, Evri or DPD. These scams typically claim a parcel is delayed or requires a small fee to release, directing the recipient to a fake website that harvests card details or personal information.

The problem is growing. According to Proofpoint and UK Finance, fake parcel delivery texts accounted for 67.4% of all reported smishing attempts in the 30 day period to mid July 2025, up from 53.2% in previous months. Financial impersonation scams, by comparison, made up just 22.6% over the same period.

This reflects a longer term trend. The National Cyber Security Centre reported a 174% year on year rise in smishing attacks as of mid 2024, and industry data indicates that the increase has continued well into 2025. A recent consumer survey by Ofcom found that 42% of UK mobile users had received a suspicious call or SMS in the past three months.

Mobile scam filters still falling short

While mobile operators claim that scam filters are improving, independent testing has raised concerns. In one 2025 study by cyber firm MetaCert, every simulated smishing message was successfully delivered to UK phones. These included texts spoofing well known brands and containing malicious links, suggesting that current filtering systems are still failing to block even basic threats.

Why summer timing makes these scams more effective

The seasonal context plays an important role. During the summer, people are more likely to shop online for travel items, gifts or personal deliveries while away from home. This makes messages about missed or rescheduled parcels seem believable and time sensitive, creating the urgency that scammers rely on.

According to advice published by Age UK Barnet, for example: “scam texts often appear to come from delivery companies, like Evri or Royal Mail, saying that a parcel is on its way and asking for payment.” The charity warns that people may click without thinking, especially when expecting a delivery, and highlights that older users may be particularly vulnerable if they are unfamiliar with digital services or not used to checking links carefully.

The growing sophistication of these scams, including the use of personalised names, postcodes or local courier references, makes them harder to detect. This is especially true on mobile devices, where links and sender details are less visible at a glance.

Fake invoices and business email scams surge before holiday deadlines

For UK businesses, the summer period brings another kind of cyber threat. Business Email Compromise (BEC) and invoice phishing scams often spike around end of quarter deadlines or during peak holiday handovers, when key personnel may be absent.

Scammers typically insert themselves into existing email threads by using a near identical address to impersonate suppliers, contractors or internal staff. They then request urgent payments to altered bank accounts, citing things like updated banking details or changes to invoice terms.

With this in mind, the North East Business Resilience Centre (NEBRC) has issued multiple alerts this summer urging firms to verify payment details verbally before transferring funds. “Organisations should treat every payment change request—no matter how routine it seems—with extreme caution, especially when staff are away,” said the NEBRC’s cyber lead. “We see companies lose tens of thousands of pounds in a single transaction.”

According to UK Finance, invoice and mandate scams cost UK businesses over £56.7 million in a single year, with construction, legal and property sectors among the most targeted.

Quishing attacks using QR codes are also on the rise

Perhaps a less familiar but growing trend is the use of malicious QR codes in phishing campaigns, often referred to as “quishing”. These codes may appear in emails, event posters, parking meters or travel itineraries, and lead to malicious websites once scanned.

Security researchers at Check Point have identified a significant increase in such attacks since spring 2025, with many targeting travellers by mimicking airline boarding passes or local information portals.

The real danger lies in the perception of safety associated with QR codes, particularly when presented in a printed or semi-official context. In several recent cases, scammers have replaced public QR codes on transport signage or tourist maps with fake stickers that lead to credential harvesting sites.

UK businesses operating physical locations or QR-based digital services are being urged to regularly check signage, validate their own codes, and educate staff on the risks of scanning unknown links.

Criminals exploit social context and emotional cues

What links all of these attacks is timing and emotional manipulation. Summer, with its relaxed atmosphere, frequent purchases and disrupted routines, creates ideal conditions for social engineering.

As cyber security firm Barracuda reports, seasonal phishing emails tend to use more emotionally charged language, including urgency, fear of missing out or appeals to customer service or refunds. Phrases like “Your booking is at risk”, “Re-delivery needed today” or “Outstanding invoice requires attention” are designed to provoke rapid reactions.

The NCSC encourages UK users to follow its “Stop, Challenge, Protect” guidance: pausing before clicking or paying, questioning the legitimacy of the request and reporting suspicious messages to the Suspicious Email Reporting Service (SERS) at report@phishing.gov.uk.

Many attacks are enabled by gaps in email security

A report by Proofpoint revealed that as of summer 2025, only 61% of the UK’s top 50 travel websites had enforced full DMARC rejection policies, which is a basic email authentication setting that helps prevent domain spoofing. This leaves both individual travellers and business clients exposed to fake emails that appear to come from trusted brands.

Similarly, smaller organisations often lack the cyber hygiene measures to filter out high risk attachments or check for lookalike domains. In phishing simulations conducted by KnowBe4, UK companies saw click rates of over 33% during peak summer periods, compared to 24% in winter, suggesting seasonal distractions increase user vulnerability.

The British Chambers of Commerce has called on smaller firms to step up basic security practices, especially during holiday periods when decision making may be rushed or decentralised.

Cybercriminals are adapting faster than users can react

The final concern raised by many experts is the speed with which scammers adapt. While businesses and individuals may learn to spot one kind of scam, attackers quickly switch tactics, changing domain names, targeting new seasonal trends or using AI tools to personalise their phishing lures.

Check Point’s threat intelligence team recently found that Google, Microsoft and Apple were the top three brands impersonated in UK phishing campaigns during Q2 2025. These impersonations often come in the form of bogus security alerts, fake travel subscriptions or seemingly legitimate service confirmations.

The summer of 2025 is no exception. As more people head off on breaks, and companies operate with skeleton crews, phishing attacks are exploiting every opportunity to slip through the cracks.

What does this mean for your business?

What emerges from this summer’s phishing surge is a clear pattern of opportunism that cuts across both consumer and business behaviour. It seems that cyber criminals are not relying on sophisticated infrastructure or zero day exploits. Instead, they seem to be exploiting timing, familiarity and human distraction. For UK businesses, especially smaller firms, this creates a persistent operational risk that does not end with the holiday season.

Attacks linked to fake bookings, delivery texts and invoice fraud are not only rising in volume but also in precision. Social engineering tactics have become more convincing, and the tools behind them more accessible. As the examples in this report show, scammers no longer need to breach systems to steal money or data, but they just need to catch someone at the wrong moment with the right message. This is particularly dangerous in summer when staff changes, out of office patterns and dispersed decision making leave more gaps than usual.

The ongoing failure to implement email authentication standards such as DMARC, and the unreliable performance of mobile scam filters, suggest that many organisations are still relying on outdated or partial defences. Without investment in basic technical controls and regular user awareness training, UK businesses will continue to see preventable losses from phishing, whether in the form of misdirected invoice payments, stolen credentials or damaged trust.

For individuals, especially those booking holidays or expecting deliveries, the lesson is equally pressing. The presence of a recognisable brand or a plausible message is no longer a guarantee of safety. Personal vigilance, combined with public reporting and institutional support, will remain critical.

Looking ahead, the challenge is not just seasonal. Cyber criminals will continue to adapt their tactics to whatever events, platforms or behaviours dominate public attention. However, the summer phishing spike is a useful case study in how quickly attackers can exploit simple human habits, and how slow many defences still are to catch up. For both UK organisations and their customers, tackling phishing will require more than just summer warnings. It demands consistent, year round resilience.

The post Summer Phishing Surge: Why Scammers Love Holidays appeared first on Quayside Technical Services.

The arrival of generative AI and its use by scammers to create more sophisticated phishing emails is behind an increase in travel scams of up to 900 percent in the last 18 months, Marnie Wilking, chief information security officer at Booking.com, has warned.

The post 900% Increase In Travel Scams appeared first on Quayside Technical Services.

Do Airbnb Hosts Have The Right To Film Guests? 

You may be surprised to know that the answer to this question is yes, hosts do have the right to install surveillance devices in certain areas of their properties, which may result in guests being filmed, but this is heavily regulated and restricted for privacy reasons.

When Is It OK For Hosts To Film Guests? 

The primary legitimate reason for hosts to install surveillance devices is for security purposes. They are not allowed to use them for any invasive or unethical purposes. Airbnb’s community standards, for example, emphasise respect for the privacy of guests and any violation of these standards can lead to the removal of the host from the platform.

Clear Disclosure 

Airbnb’s company rules say that monitoring devices, for example cameras, may be used, but only if they are in common spaces such as living rooms, hallways, and kitchens, and then only if Airbnb hosts disclose them in their listings. In short, if a host has any kind of surveillance device, they must clearly mention it in their house rules or property listing so that guests are made aware of these devices before they book the property.

What About Local Laws? 

It is also the case that although disclosed cameras in common spaces on a property may be OK by the company’s rules, Airbnb hosts must also adhere to local laws and regulations regarding surveillance. This can vary widely from place to place and, in some regions, recording audio without consent is illegal, whereas video might be permissible if disclosed.

Hidden Cameras 

Even though Airbnb rules are relatively clear, there appears to be anecdotal and news evidence that some Airbnb guests have discovered undisclosed surveillance devices in areas of Airbnb properties where they should not be installed. Examples that have made the news include:

• Back in 2019, it was reported that a couple staying for one night at an Airbnb property in Garden Grove, California discovered a camera hidden in a smoke detector directly above the bed.
• In July 2023, a Texas couple were widely reported to have filed a lawsuit against an Airbnb owner, claiming he had put up ‘hidden cameras’ in the Maryland property they had rented for two nights in August 2022. According to the Court documents of Kayelee Gates and Christian Capraro, the couple became suspicious after Capraro discovered multiple hidden cameras disguised as smoke detectors in the bedroom and bathroom.
• Last month, a man calling himself Ian Timbrell alleged in a post on X that he had found a camera tucked between two sofa cushions at his Aberystwyth Airbnb.

Wouldn’t It Be Better To Disallow Any Cameras Inside An Airbnb Rental Property? 

Banning all cameras at Airbnb rental properties might initially seem like a straightforward solution to privacy concerns, yet there are important factors to consider surrounding this. Some hosts may legitimately need to use them in common areas such as entrances, for security purposes if perhaps the property is in an area where crime has been a problem and they need to deter theft and vandalism and provide evidence if a crime occurs. On the other hand, a complete ban on cameras would address the privacy concerns of guests, ensuring they feel comfortable and secure during their stay.

Airbnb’s current policy attempts to balance security and privacy by allowing cameras in certain areas while requiring full disclosure and banning them in private spaces like bedrooms and bathrooms. However, enforcing a complete ban on cameras would be very challenging, as hidden cameras are, by nature, difficult to detect. Even if there was a ban, some owners may simply not comply. The Airbnb model is built on trust between hosts and guests, and clear communication and transparency about security measures, including camera usage, are crucial for maintaining this trust. While a total ban on cameras might seem like a simple solution to privacy concerns, it overlooks the legitimate security needs of hosts. A balanced approach with clear guidelines and strict enforcement might be more effective in protecting both guest privacy and host security.

How To Check 

If you’re worried about possibly being filmed or recorded by hidden and undisclosed surveillance devices in a rented Airbnb property, here are some ways you can search the property and potentially reveal such devices:

• Inspect any gadgets. Check smoke detectors or alarm clocks as they are known as places to hide cameras. Examine any other tech that seems out of place. You may also want to check the shower head.
• Search for Lenses. For example, making sure the room is dark, use a torch, such as the one on your phone, to spot reflective camera lenses in objects like decor or appliances.
• Use phone apps like Glint Finder for Android or Hidden Camera Detector for iOS to find hidden cameras.
• Check storage areas, for example examine drawers, vents, and any openings in walls or ceilings.
• Check mirrors. Many people worry about the two way mirrors with cameras behind them. Ways to check include lifting any mirrors to see the wall behind, turning off the room light and then shining a torch into the mirror to see if an area behind is visible.
• Check for infrared lights which can be used in movement sensitive cameras. Again, this may be spotted by by using your phone’s camera in the dark, and then looking out for any small, purple, or pink lights that may be flashing or steady.
• Scan the property’s Wi-Fi network and smart home devices for unknown devices.
• Unplug the Airbnb property’s router. Stopping the Wi-Fi at source should disable surveillance devices and may reveal whether the owner is monitoring the property, for example it may prompt the host to ask about the router being unplugged.
• If you’re particularly concerned, buy and bring an RF signal detector with you. Widely available online, this is a device that can find any devices emitting Bluetooth or Wi-Fi signals, which inculde wireless surveillance cameras, tracking devices and power supplies.

What Does This Mean For Your Business? 

The issue of undisclosed cameras in Airbnb properties raises important considerations for Airbnb as a company, its hosts, and travellers. For Airbnb, the challenge lies in upholding and enforcing privacy standards to maintain user trust. This could involve enhancing their policies, perhaps even investing in technology or an inspection process for better detection of undisclosed devices, and/or providing more reassuring information about the issue, thereby safeguarding guest security, ensuring host accountability, and helping to protect their brand reputation.

It should be said that most Airbnb hosts abide by the company’s rules but are caught in a delicate balancing act between providing security and respecting the privacy of their guests. Any misuse of surveillance devices can, of course, have serious legal consequences and potentially harm a host’s reputation and standing on the platform. However, even just a few stories in the news about the actions on one or two hosts can have a much wider negative effect on consumer trust in Airbnb and can be damaging for all hosts. It could even simply deter people from using the platform altogether.

For some travellers, this situation may make them feel they must proactively take the responsibility for their own privacy, which may not reflect so well on Airbnb. They may feel as though they need to be informed about their rights, familiarise themselves with detection methods and remain vigilant during their stays.

This whole scenario emphasises the need for a continuous update of policies and practices by Airbnb to keep pace with technological advancements and the varying legal frameworks in different regions. It also highlights the importance of clear communication and transparency between the company, its hosts, and guests to maintain a trustworthy and secure environment.

The post Cameras In Airbnb Properties – What Are The Rules? appeared first on Quayside Technical Services.

Startup Accelerator and Venture Capital Firm 

Y Combinator is a well known startup accelerator and venture capital firm based in the US. It was founded in 2005 by Paul Graham, Robert Morris, Trevor Blackwell, and Jessica Livingston. Y Combinator is often referred to as an “accelerator” because it provides a comprehensive programme designed to help early stage startups grow and succeed.

Y Combinator says so far it’s funded 4,000 startups with a $600 billion valuation.

How? 

Startups accepted into the Y Combinator programme receive seed funding, typically in exchange for equity, and participate in a structured three month programme. During this time, they receive mentorship, guidance, and access to a network of experienced entrepreneurs, investors, and industry experts. Y Combinator also provides office space and various resources to support the development of the startups.

The program culminates in a Demo Day, where each participating startup presents its progress and business plan to a large audience of potential investors. Demo Day offers a valuable opportunity for startups to secure additional funding and establish crucial connections within the investment community.

Who? 

Over the years, Y Combinator has supported and nurtured numerous successful startups, including Stripe, Airbnb, Instacart, DoorDash, Cruise, Twitch, Coinbase, PagerDuty, Faire, Brex, Deel, Rippling, reddit, Gusto, Flexport, Dropbox, Razorpay, Scale AI, GitLab, Benchling, Fivetran, Rappi, Checkr, Zapier, Whatnot, Podium, Webflow, Zepto, Groww, Segment, and others.

Its reputation and track record have made it one of the most prestigious and sought after startup accelerators globally, attracting entrepreneurs from various industries and sectors.

The Goal 

Y Combinator says its goal is to “help startups really take off” and to help them “to be in dramatically better shape three months later”. It defines being in better shape as having a better product with more users, and to having more options for raising money.

Influence 

Y Combinator and its founders, such as Paul Graham, have become influential voices in the startup ecosystem. They have shared valuable insights, advice, and thought provoking essays on entrepreneurship, technology, and startup culture. Y Combinator’s blog and the published writings of its founders have gained widespread recognition and are considered valuable resources for aspiring entrepreneurs.

Expansion and Global Reach 

Y Combinator has expanded its reach beyond Silicon Valley to accept startups from around the world, including international teams, into its programme. This global perspective has allowed Y Combinator to tap into a diverse range of innovative ideas and entrepreneurs from different regions, making it a truly influential force in the global startup ecosystem.

In The News 

In May last year, Y Combinator made the news when it sent a letter to its portfolio founders (its ‘who’s who’ of startup successes) entitled “Economic Downturn” which warned them to “plan for the worst” due to economic slowdown, inflation, rising interest rates and geopolitical unease. The letter painted a bleak picture to startups saying, “it’s your responsibility to ensure your company will survive if you cannot raise money for the next 24 months.” 

Startups

Startups are generally characterised by innovation and high growth potential, but they face funding challenges and rapid cash burn. Despite these hurdles, investors find startups attractive due to their potential for high returns and the opportunity to be part of groundbreaking ventures.

What Does This Mean For Your Business?  

The presence and success of Y Combinator, a renowned startup accelerator and venture capital firm, highlight important considerations for UK businesses. Startups, with their innovative ideas and high growth potential, face funding challenges and rapid cash burn. However, the allure of startups lies in their potential for significant returns on investment and the opportunity to participate in groundbreaking ventures.

For UK businesses, this highlights the importance of fostering a culture of innovation and embracing the potential for high growth. By encouraging and supporting startups within the local ecosystem, businesses can tap into the vibrant entrepreneurial spirit and benefit from collaborations with innovative startups.

Moreover, it is crucial for businesses to consider the funding landscape and explore ways to support startups. This could involve establishing partnerships or mentorship programmes, providing resources or office space, or even considering investment opportunities in promising startups. By nurturing and engaging with startups, businesses can gain access to fresh ideas, talent, and potential future collaborations.

Judging by some of the well known names listed as being helped by Y Combinator, it’s clearly had some success in helping them but, as all businesses know, and as Y Combinator warned its customers just last year, these are very tough economic times that will make it very challenging for today’s startups, and it’s currently more a matter of just focusing on survival for those that can’t raise the necessary funding in the near future.

The post What is ‘Y Combinator’? appeared first on Quayside Technical Services.