Why Sirvoy is asking you to verify more often (and how to keep your account safe)

Over the past months, you may have noticed Sirvoy asking you to verify yourself more often than before.

We know those extra steps can be frustrating when you’re trying to get something done, so we want to explain why they’ve appeared.

Hospitality businesses are increasingly being targeted by sophisticated phishing attacks. Sirvoy was targeted too.

The attackers attempted to gain access to customer accounts and the guest information inside them. We identified the activity quickly, stopped the method being used and have continued strengthening account security since then.

Some of the additional checks you now see are part of that stronger protection. Thanks to your feedback, we’re continuing to fine-tune these checks so they protect your account without getting in the way of your day-to-day work more than necessary.

Why hospitality is being targeted

Hospitality businesses hold information that can be valuable to fraudsters: guest names, contact details, arrival dates and payment information.

With access to a real account, an attacker can make a fraudulent message look convincing because the guest is already expecting to hear about a genuine booking.

Fake pages and messages have also become harder to spot. They can look and sound very believable, which means security cannot depend on people catching every suspicious detail themselves.

How this kind of phishing works

Imagine someone sets up a second reception desk just outside your real one.

It looks right. A guest hands over their passport and booking reference, and the impostor quietly passes the information to the real reception desk. The guest still gets checked in, so nothing appears to have gone wrong.

But the impostor has also got what they need to get inside.

A modern phishing attack can work in much the same way.

You land on a page that looks like Sirvoy but uses a different web address. Your password is passed straight to the real login page. If you enter a verification code, that can be passed through too while it is still valid.

You may even end up successfully signed in while the attacker gains access at the same time.

Strong passwords and verification codes still offer important protection. But this type of attack can sometimes get around them by passing what you enter straight through to the real site.

Passkeys work differently. They check that you are signing in to Sirvoy’s real website before they work, so a fake lookalike page cannot simply capture and reuse them.

What Sirvoy has changed

Sirvoy was among the hospitality systems targeted by a campaign using this kind of attack.

Some security improvements were already underway. Passkeys had been in development before the campaign and became generally available in June.

Most of the protection we have added or strengthened happens quietly in the background. The extra checks you occasionally see are just the visible part.

There is no single security feature that solves everything, so we use several layers together:

• Safer sign-in options. Passkeys offer strong protection against this type of phishing, and authenticator app codes are available to every user.
• Checks for unusual activity. If something about a session looks unusual, we may ask you to verify again or end the session.
• Shorter-lived verification codes. Codes now expire after ten minutes instead of an hour.
• Extra checks around sensitive areas. We ask you to verify again before accessing account settings where sensitive information and permissions can be managed.

Legitimate travel, a new device or a VPN can occasionally trigger one of these checks too. That is why we generally ask you to confirm it is really you rather than simply locking you out.

“Security is difficult because, as the defender, you have to cover all the ground. An attacker only needs to get through once,” says Johan Wilfer, our CTO. “That’s why we use multiple layers of protection.”

Three things you can do to keep your account safe today

1. Turn on a passkey

A passkey lets you sign in using your fingerprint, face or device PIN.

Your biometric information stays on your device and is never sent to Sirvoy. Because a passkey is tied to Sirvoy’s real web address, it will not work on a fake lookalike page.

It can also make signing in quicker because you do not need to type a verification code each time.

You can set one up in your user profile, or watch a short video to see how it works.

2. Reach Sirvoy the same way each time

Type the Sirvoy address yourself or use a bookmark you trust.

Many phishing attacks begin with a link in an email or message. Going directly to Sirvoy removes that first opportunity for a fake page to get between you and the real login.

3. Be cautious if your usual sign-in suddenly changes

If you normally use a passkey but a page unexpectedly asks you for a verification code instead, stop before continuing.

There can be legitimate reasons for another sign-in method to appear. But an attacker who cannot get past your passkey may also try to push you toward a weaker option.

If something feels unusual, close the page and open Sirvoy again using your normal bookmark or web address.

We will keep adapting

This will not be the last attempt against the hospitality industry, and it probably will not be the last time we adjust how Sirvoy protects your account.

Your bookings, rates and guests’ personal details all live there. Keeping that information safe has to come first, but security should not make your everyday work harder than it needs to be.

We will keep strengthening that protection, reducing unnecessary friction and explaining clearly when something changes and why.

Thanks for trusting Sirvoy with your business.