Norwegian Cruise Line, Celestyal and Cunard warn passengers about convincing phishing scams using booking details, raising questions about cruise security.
There was a time when the biggest worry before a cruise was whether the suitcase would close. Now some passengers have a more expensive concern: an email from someone who knows their booking details and wants their credit card.
Norwegian Cruise Line (NCL), Celestyal and Cunard have warned about criminals impersonating their brands to target travellers with existing reservations. Some messages look alarmingly convincing, demanding urgent payment checks or threatening to cancel a holiday.
Unlike the customary promise of a free Caribbean cruise from a stranger with questionable spelling, these scams can arrive armed with information that appears authentic.
NCL: the worrying details
Reports began circulating on 10 October, when NCL passengers described emails containing genuine names, reservation numbers, ships, departure dates and, in some cases, amounts already paid.
The details came from passenger accounts reported by Cruise Critic and other travel publications. They do not establish that scammers obtained credit card numbers or accessed NCL’s computer systems.
The messages directed recipients to unfamiliar websites for supposed card verification or pre-departure security checks. Some warned that fully paid reservations could be cancelled if passengers failed to act promptly.
NCL issued a warning and said it was investigating the fraudulent communications. It identified @ncl.com, @e.ncl.com and @nclcorp.com as its legitimate email domains and advised passengers to avoid suspicious links and contact their travel advisor or the cruise line directly.
Those addresses are a useful reference, but even a familiar-looking sender is no guarantee. Fraudsters can disguise display names and spoof email identities.
The question still hanging over the gangway is obvious: how did the senders know so much about genuine bookings?
No publicly confirmed finding establishes that NCL suffered a data breach. No verified evidence shows that the incidents involving the three operators share a perpetrator or a common cause.
Celestyal warns guests
Celestyal reported a similar impersonation campaign in October. Its customers received messages requesting booking verification and payment card details through links in unsolicited emails.
The operator said it was investigating with technology teams, service providers and external specialists. A spokesperson told Travel Market Report that “at no time was sensitive information breached”.
That is the company’s account, not an independently established finding about the origin of every message.
Celestyal said it had contacted guests and trade partners, reminding them that it would never seek booking verification or payment details through an unexpected email link.
Cunard’s warning came earlier
The problem is not confined to two operators. On 11 September, Travel Weekly UK reported that a Cunard customer booked on a Christmas voyage aboard Queen Anne had received a fraudulent request for the outstanding balance.
Her travel advisor, Kieran Eccles-Miller of Magical Traveller, said the email contained the customer’s booking reference, date of birth and sailing date.
Cunard confirmed that a small number of guests had received demands from people falsely claiming to represent the company. It said there had been no unauthorised access to its systems and that it was investigating the source.
Three brands, then, but not a proven industry-wide breach. That distinction matters.
What Australian travellers and advisors should do
These reports do not establish that an Australian traveller has lost money in the incidents described. They do show why anyone holding an international cruise booking should be alert, especially when final balances and travel documents are due.
Advisors can help by warning booked clients that genuine reservation details may appear in a fraudulent message. A short call before final payment could save a lengthy dispute afterwards.
If an email demands immediate card verification, do not use its link, attachment or telephone number. Instead, open the operator’s official website or app independently, or speak to the advisor who made the booking.
Australia’s Scamwatch recommends never sharing card details, passwords or one-time security codes in response to unexpected contact. Anyone who has already provided payment information should contact their bank or card issuer immediately, secure affected accounts and report the incident.
Cruise lines have spent years making embarkation almost effortless. Passengers would be wise to keep one small inconvenience: checking who is asking for their money.
The best port of call remains the trusted travel advisor. The impostors can stay ashore.
By: Stephen Peters – © 2026.
Read Time: 3 minutes.
Author Bio:
Stephen Peters has spent much of his career proving that the straight-and-narrow path is considerably overrated. Armed with a Bachelor’s degree in Technology from the University of Queensland and a Master’s in Management, he first ventured into hospitality, working in and helping open several five-star hotels across Sydney and Asia.
After deciding he had experienced quite enough of five-star hospitality from the operational side of the desk, Stephen returned to technology, working with major US tech companies while based between Australia and Asia.
Then came the ultimate change of scenery. Stephen built his own yacht and, with his family aboard, sailed from Florida through the United States and its Great Lakes before crossing the Pacific to Asia. Several memorable years followed, exploring Indonesian waters before the Peters family eventually returned to Australia with considerably more sea miles, stories and perspective than when they left.
