Property Manager Data Security: How Safe Is Guest Data in Short-Term Rentals?

Every short-term rental business now runs on data. A single property manager account can hold guest passports, phone numbers, payment references, door codes, owner bank details and the keys to every OTA listing in the portfolio. That concentration is exactly what makes the sector attractive to criminals, and 2026 has shown how fragile the chain can be. In April, Booking.com began notifying guests that unauthorised third parties had accessed reservation information, including names, email addresses, phone numbers and booking details, and reset the PINs of the affected reservations. Payment data held on the platform was not reached, but the exposed details were precisely what fraudsters need to impersonate a host convincingly.

This analysis looks at every layer of the ecosystem, from OTA extranets to smart locks, to answer one question: how safe is property manager data today, and what actually reduces the risk?

Why property managers are a prime target

The short-term rental stack is built from many connected tools: OTAs, a PMS, a channel manager, guest messaging, online check-in, payment processors, smart locks, cleaning apps and accounting software. Every integration adds another login, another API key and another vendor holding a copy of the data.

Global breach investigation data published in 2026 shows how that structure is being exploited. Breaches involving a third party reached 48%, up from 30% a year earlier. Exploitation of software vulnerabilities overtook stolen credentials as the leading way attackers get in, at 31%, and ransomware appeared in 48% of breaches.

What a typical PM account holds	Why criminals want it
Guest identity documents and registration data	Identity theft and resale on criminal markets
Names, phone numbers, emails and booking details	Highly convincing payment scams aimed at guests
Door codes and smart lock access	Physical entry to occupied or empty units
OTA extranet credentials	Hijacking listings, payouts and guest conversations
Owner and bank details	Invoice and payout redirection fraud

Threat 1: Phishing built around the booking workflow

The most active threat remains targeted phishing aimed at reservation staff. Since late 2024, security researchers have tracked successive waves of emails impersonating Booking.com and sent to hospitality teams across Europe, North America, Asia and Oceania. The lures copy everyday situations: a guest complaint, a last-minute booking request, a negative review or an account verification notice.

Many of these campaigns use a technique known as ClickFix. A fake captcha page asks the employee to paste and run a command on their own computer, which silently installs credential-stealing malware or remote access tools. One campaign, active from at least April 2025 until October 2025, used this method to take over extranet accounts on Booking.com, Expedia and Airbnb. Attackers then messaged real guests through the genuine platform, asking them to confirm their card again to avoid cancellation. Stolen extranet sessions and passwords are traded openly on criminal forums and automated Telegram bots.

The financial damage reaches guests directly. In the United Kingdom alone, 532 reports of this type of booking scam were logged between June 2023 and September 2024, with losses of around £370,000.

Threat 2: Fake login pages for PMS and guest messaging tools

Attackers have also moved one step up the stack. In mid-2025, researchers documented a large campaign that bought sponsored search ads impersonating at least thirteen hospitality and vacation rental software providers, including property management and guest messaging platforms. Operators searching for their usual login page clicked an ad placed above the real result, landed on a lookalike domain and handed over usernames, passwords and SMS one-time codes in real time.

Because the fake page relayed the code as it was typed, SMS-based two-factor authentication offered little protection. A compromised PMS account gives the attacker reservations, guest data, payment flows and, in many cases, the ability to push door codes.

Threat 3: Vendor and supply chain breaches

A property manager can do everything right and still lose data through a supplier. Past incidents show a consistent pattern.

Incident type	What happened	Lesson for property managers
Misconfigured cloud storage at a channel manager (2020)	More than 10 million log records exposed, including names, ID numbers, card numbers with CVV and stay details going back to 2013	Ask vendors how data is stored, encrypted and deleted
Compromise of a hotel software supplier (2024)	Roughly half a million guest accounts linked to major hotel brands exposed	Your security is only as strong as your weakest integration
Open database at a hospitality reservation platform	Hundreds of thousands of reservations left publicly accessible	Data kept without a purpose is pure liability
OTA reservation data accessed (2026)	Names, contacts and booking details exposed and reused in targeted scams	Guests must know how you will and will not contact them

Threat 4: More data collected, and kept for longer

Regulation is increasing the volume of sensitive data operators must handle, and every extra field is something that can leak.

Jurisdiction	Requirement	Data security implication
Spain	Since 2 December 2024, all tourist accommodation must report traveller data to the Interior Ministry platform SES.HOSPEDAJES under Royal Decree 933/2021	More than 15 data points per guest, including document and support numbers, plus payment details such as card type and number or IBAN, kept for three years
Italy	On 21 November 2025 the Council of State reinstated the requirement to identify guests in person, overturning a May 2025 regional court ruling	Remote verification through a live video connection remains possible, pushing operators toward ID tools that process facial images
European Union	Regulation (EU) 2024/1028 has applied since 20 May 2026, with registration numbers and monthly activity data shared by platforms with authorities	More structured data flowing between hosts, platforms and public systems
GDPR (EU wide)	Breaches must be notified to the authority within 72 hours, with fines of up to €20 million or 4% of global turnover	Late notification is itself a violation: Booking.com was fined €475,000 in 2021 for reporting a breach too late

The practical risk is over-retention. Passport scans sitting in email inboxes, WhatsApp chats or shared drives long after the legal obligation has been met are one of the most common and most avoidable exposures in the sector.

Threat 5: Smart locks, Wi-Fi and the physical layer

Door codes that never expire, shared admin accounts on lock platforms and unsegmented networks can turn a data incident into a physical one. If an attacker controls the PMS that generates access codes, they effectively control the door. Guest Wi-Fi that shares a network with cameras, locks or the office router widens the attack surface further.

Threat 6: AI-powered fraud

Generative AI makes phishing messages fluent in any language and free of the spelling mistakes that used to give them away. Breach data shows the share of malicious emails containing AI-generated text roughly doubled in two years. The same tools can produce convincing fake identity documents and deepfake video, a growing concern as remote and video check-in become standard.

How safe is property manager data today?

Layer	Current risk level	Main weakness
OTA extranet accounts	High	Infostealer malware on staff devices
PMS and channel manager	High	Credential phishing and overly broad user permissions
Guest messaging	High	Scam messages sent from genuine, trusted channels
Online check-in and ID tools	Medium to high	Document images and biometric data stored for too long
Smart locks and IoT	Medium	Static codes and shared admin logins
Email and office devices	High	ClickFix lures and malicious attachments

The honest answer is that the platforms themselves are generally well defended, but the ecosystem around them is not. The weakest points are the people, devices and integrations that connect to those platforms every day.

The security framework that works

Control	What to do	Threat it stops
Phishing-resistant MFA	Use passkeys or authenticator apps, not SMS codes, on OTAs, PMS, email and banking	Credential theft and fake login pages
Bookmarked logins	Never sign in through search ads or links in emails; use saved bookmarks or the official app	Malvertising and lookalike domains
No pasted commands	No legitimate service asks staff to run commands on their computer; restrict PowerShell and admin rights for non-technical users	ClickFix malware
Device protection	Keep every reservations device updated, with endpoint protection and no personal browsing on admin machines	Infostealers and remote access tools
Least-privilege access	Give each user their own login, limited by property and role, and remove leavers the same day	Account abuse and lateral movement
Vendor due diligence	Ask for ISO 27001 or SOC 2 reports, a GDPR data processing agreement, data location, breach notification times, SSO and MFA support, and scoped API keys	Supply chain breaches
Data minimisation	Collect only legally required fields, delete ID scans after submission and purge records once the retention period ends	Over-collection and large-scale leaks
Payment hygiene	Never store card numbers in PMS notes, email or chat; use tokenised, PCI DSS compliant payment providers	Card data theft
Smart lock hygiene	Unique codes per stay that expire at checkout, individual admin accounts, separate guest and device networks	Unauthorised physical access
Guest education	State in every confirmation that you will never request payment outside the agreed terms or through links in chat	Guest-facing payment fraud
Incident response plan	Define roles, OTA support contacts, password resets, tested backups and the 72-hour notification process	Ransomware and breach escalation
Ongoing training	Short monthly drills using real examples of current lures	The human element behind most breaches

Key takeaways for property managers

Priority	Actionable takeaway
Treat logins as the front door	Phishing-resistant MFA on every OTA, PMS and email account is the single highest-impact fix
Audit your vendors	Map every integration that touches guest data and request evidence of its security controls
Hold less data	Delete identity documents and payment details as soon as legal obligations allow
Prepare for the day it happens	A written response plan turns a crisis into a procedure and keeps you within GDPR deadlines