Dear Restaurant Partners & Diners:
You may have seen recent headlines concerning a scam or a hack on OpenTable. The security of our systems is intact and the breach isn’t coming from the OpenTable platform; rather, there is an ongoing phishing scam targeting UK restaurants and diners.
Data security is of the utmost importance to us. In addition to working with legal authorities on this issue, we are encouraging all diners & restaurants to stay vigilant and watch out for calls or emails requesting sensitive information.
Here’s how the scam works: a bad actor calls a restaurant pretending to be from a reservation-taking tech platform and asks their staff to confirm account log-in information. If a restaurant shares the information, that bad actor now has access to the restaurant’s books and diner details. This data does not include credit card information. The bad actor then contacts diners directly and requests credit card details, often under the guise of placing or refunding a deposit or other reservation related purposes.
Restaurants – here’s how to protect yourselves:
- Be vigilant and educate your team members on this scam to help protect your business. Ensure your team is aware that OpenTable will never request your password or any sensitive information.
- To strengthen your account security, set up two-factor authentication (2FA) – an extra layer of security that requires a one-time-only code to log in. To set up 2FA, find instructions here.
- For reservations where credit card details are required, secure credit card links can be sent via SMS to guests to confidentially and safely input their information. There’s no additional cost to you, and your guests can enter their information safely.
- If you suspect your restaurant may have been targeted, contact your OpenTable rep directly.
- For more helpful security tips, check out our checklist, designed to help safeguard you against online fraud and cyber crimes.
Diners – here’s how to protect yourselves:
- If you receive a call from a restaurant asking for your credit card details – do not share it, even if you have a booking. Hang up and call the restaurant back directly to confirm their identity and whether or not your credit card details are needed. Please note: the bad actor may have access to your reservation details (for example: the name/date/ party size of your dinner reservation and potentially the last four digits of your credit card number) and as a result, the scammer can be very convincing.
- If you receive a suspicious call regarding a reservation, notify us via email at phishing@opentable.com. Each report brings us one step closer to catching those that are behind this fraudulent activity.
Thank you,
Henry Praw
Chief Information Security Officer, OpenTable
