I am a PBX phone operator, so my entire job is to handle the phone calls. Not entirely sure where to post this, but thought this sub would be a good idea. If you have heard anything similar to this, I'd love to hear.
I've been working as a phone operator at a large hotel chain, not large domestically, since May. I haven't dealt with any phone scams up until this point because the hotel I work at is the only one from this chain open in the US.
To begin, I got an outside call asking to connect to our bell desk. I tried to connect them over, the bell team was busy, and the call bounced back. I informed the caller the bell team was occupied, and he asked to connect to "his room" and gave the exact room number along with the full first and last name. There were 3 guests on the reservation and no one answered the phone, so the call bounced back and I informed the caller of this. Without saying anything, they hung up.
Not too long later, I received an inside call who identified their name and said they were from the bell team. They asked to connect to the same room that the outside caller provided, no one answered, and I informed them. The caller then said "Can you connect me to their direct phone number? I tried to call but didn't get through". This person said they dialed 9 then the phone number. I said for outside calls, you need to dial 91, then the phone number, but that I'd connect them over.
We recently expanded on staff over the summer, so there are some new hires in a few departments. The training hasn’t fully covered more advanced phone scams, however we know to ask for the name and reason for calling. Oftentimes, I have had actual employees from different departments calling to ask about things they may have been unclear on in regard to requests.
I have also had people from other departments call to connect to the same guest twice because more information was needed/they needed to communicate something that hadn't been completed in the first phone call. I'll also admit I'm not the most informed on some protocols and policies. To me, it made sense that the bell team, who I knew received a new hire, was unaware of how to fully call outside.
I then received a call of someone claiming to be from housekeeping asking about a guest request and they named the specific software we use. It's not niche, but it also isn't posted online that we use this specific system. She asked if we made any requests recently because the room number wasn't showing up. I said I hadn't and asked my coworker also in PBX if he had. He hadn't, and I said it may have been from the front desk, so I connected her to the FD manager.
On the phone, we can see whether a call is in house or an outside call. I have to press the "source" button to see the number of who calls, and I've had the habit of always pressing it when I pick up calls. I have never had issues seeing numbers, but this one did not show it and showed RT: 27. I've seen this very few times before, but some calls consistently this day were showing the RT: 27.
Later, this same person called back, identified themself with the same name and said they were from housekeeping and requested to speak to a certain room. As they called, stated they were from housekeeping, connected to the FD manager, and identified our guest request software, I didn't see this as being out of the ordinary. I assumed they were following up on the request or delivering it. Maybe 5-10 minutes later the same person called to connect to the same room.
Around this time, my colleague received a call from someone who identified themselves from the bell team, and stated a name. We have a summer intern and this was the one who was identified, and he asked to connect to a room. The caller gave the room number and exact last name as on the reservation. The guest didn't pick up.
Maybe 30 minutes later, while my colleague was on break, the FD manager came in to say that the guest from the housekeeping request room call came to the front desk hysterically. The guest informed us the caller said that our front desk system had shut down and that they needed a credit card for the file and asked for their information over the phone. Maybe this guest didn't pick up the first call, which is why the caller tried a second time. Thankfully, the guest didn't give their credit card info over.
I told her everything I typed. Our manager followed up on the guest who's direct phone was called (from the bell team) and the guest informed us it was the same thing, except this guest did provide their credit card information.
What confuses me the most is how connected and sophisticated this attack is. There were at least 3 people involved, some on the property (as some calls were from the phones on the property itself) and some not, who were aware of our systems, our team members, and guest information. To me, I think it has to be someone who is involved with our property, but why would they do this? Our hotel is known for having great benefits for employees and a lot of people are happy here.
My coworker worked at a very well known luxury hotel chain that had proper training regarding safety protocols and the different types of scams. He had never heard or experienced anything like this.
I realized that the person who called and tried to connect to the bell desk then their room was most likely trying to set up a story to make the call from the bell desk easier to connect to the guest's actual number. They gave me reason to believe the bell desk's request was not out of place. But they also confirmed the guest wasn't in the room twice, so then they connected to the direct number when they also said how they tried to call the number and SPECIFICALLY explained they only dialed 9, then the number.
With the housekeeping one, they set up the story by mentioning our specific request software, got an actual guest request from the FD manager, who told me she gave a room number and request the FD made around that time, and called back to connect to that room. There was no reason for me to believe anything was out of the ordinary. Later, in our email chain, the FD manager explained that she asked who placed the request (from our request system, where you can see that), and the caller hung up immediately after.
We have received outside calls from employees on shift with requests regarding guest rooms, like our in room dining. Not everyone here follows protocol, which further adds to their story. They knew that we'd slip up. Today, one of our IRD team members called and informed me about a request that couldn't be completed and it made me think about the RT: 27. I called the hotel phone from mine but hid my number with *67, and the RT: 27 came up again. The only person who called from outside hid their number, so I'm assuming maybe they are an employee or a former one.
Any thoughts? Has anyone experienced anything like this? I'm currently working while completing undergrad for hospitality management, so I'd love to hear honestly anything.