Cruise passengers sailing with Celestyal, Norwegian Cruise Line and Cunard are being warned about a wave of fraudulent emails asking for payment or card details to "confirm" bookings.
The scam, reported by The Independent, works like this: an email arrives that looks official, claiming the cruise line needs payment verification to secure your cabin. One version sent to Celestyal guests calls the request "a standard security procedure" to protect the booking against unauthorised use. Another pushes urgency, telling recipients to visit a "guest portal" via a link within 24 hours to finalise the reservation and lock in their cabin. That pressure tactic — act now or lose your room — is a classic phishing hallmark.
Celestyal has responded on its website and social channels, confirming the emails are fake and that an investigation is under way with its technology teams and service providers. A spokesperson stressed that no sensitive data was breached, and reminded guests that the line will never ask for booking verification or card details through a link in an unsolicited email. Anyone who has already handed over card details or authorised a payment is urged to contact their bank immediately.
The problem isn't limited to one line. Norwegian Cruise Line has told guests it too is investigating reports of fraudulent emails bearing its name, and points out that genuine NCL messages come only from addresses ending @ncl.com, @e.ncl.com or @nclcorp.com. Cunard flagged a similar scam in September, when a small number of guests received emails demanding payment.
The advice across the board is consistent: don't click links, don't reply, and don't share personal or payment information. If anything about a booking communication feels off, contact the cruise line directly through the phone number or website you already have — not the details in the suspicious email — or go through your travel agent.
Why it matters for travellers: cruises involve large upfront payments, which makes passengers attractive targets for phishers. Bookings made months in advance mean a "verification" email can seem plausible, and the sums at stake are substantial. The defensive habits are simple but worth building: check the sender's domain carefully, treat any 24-hour deadlines with suspicion, and remember that legitimate cruise lines already hold your payment details from when you booked — they have no reason to ask again. If you've booked through an agent, route any booking queries through them rather than an emailed link. A two-minute phone call to the cruise line's official number is far cheaper than a fraudulent charge.
