Norwegian Cruise Line passengers are warning fellow travelers about a targeted phishing campaign involving scam emails that appear to contain accurate cruise-reservation information.
Many passengers have reported receiving messages claiming to come from Norwegian Cruise Line or its guest-services department. The emails reportedly included real details such as the recipient’s name, ship, sailing date, reservation number, payment amount and, in some cases, cabin information.
The messages allegedly urged passengers to complete a “verification” or “authentication” process through an outside website. Some reportedly threatened that a paid reservation could be canceled if the recipient failed to act quickly.
At this time, Norwegian Cruise Line has not publicly confirmed a data breach or phishing email scam. Here’s what we know about the email scam and how you can protect yourself, if you receive one.
Norwegian cruisers describe the reported phishing email scam
Reports shared on Reddit and Facebook describe a series of emails designed to look like official Norwegian Cruise Line communications. Some are more convincing than others with official Norwegian branding, while a few seem to utilize an AI-generated template.
The messages reportedly came from unrelated email domains, including mike@joinorderly.com and support@herdr.io, rather than an official NCL address.
Some emails used subject lines such as “Security Authentication Required,” “Reservation update” and “Follow-up: complete your card verification.”
Several screenshots shared by passengers used NCL logos, navy-and-gold branding, and headings such as “NCL Guest Services,” “NCL Compliance” and “Guest Portal.” The messages claimed that passengers needed to complete a mandatory payment confirmation, even when their cruise had already been paid for.
The reported scam emails included details such as:
- The passenger’s name
- The Norwegian ship connected to the reservation
- The sailing date
- A partially redacted booking number
- Claims that payment was already on file
- Instructions to complete “card verification” or “security authentication”
The messages also used pressure tactics, which is a common strategy for scammers. Some told recipients they had only 24 hours to respond and warned that Norwegian Cruise Line might not hold the reservation or cabin if verification was not completed.
Other messages claimed the additional verification was not a second payment, while still directing passengers to follow an unfamiliar link.
These are significant phishing warning signs, including an unexpected request, an unfamiliar sender, a website outside the official ncl.com domain, a request involving payment information, and a threat of cancellation.
Just because the email includes real booking details does not mean the communication is legitimately from Norwegian Cruise Line. Passengers should verify any unexpected request by opening the official NCL app or manually visiting ncl.com. Do not click the email link, reply to the sender, or provide card, password, or passport information.
Is this a confirmed Norwegian Cruise Line data breach?
At this time, the reports reviewed for this article do not independently confirm that Norwegian Cruise Line experienced a data breach.
Passengers have understandably raised questions because the emails reportedly contained specific reservation details. However, the source of that information has not been established publicly.
The information could have come from a hacked customer account, travel agency, third-party booking service or cruise-line system.
For now, the reports point to a serious, highly personalized phishing scam, but it is still unclear how the scammers obtained the passengers’ reservation information.
How to identify the Norwegian scam email
Cruisers should be especially cautious if an email:
- Comes from a domain unrelated to Norwegian Cruise Line or the traveler’s booking agency
- Directs the recipient to a website other than the official NCL website
- Requests a credit-card number, password, passport information or identity documents
- Claims a fully paid cruise will be canceled unless the recipient responds immediately
- Asks the recipient to “verify” information that can be checked directly in the NCL app or on the official website
- Uses unusual wording, unexpected branding, or a sender address that does not match the company being represented
A message can still be fraudulent even if it contains your real name, ship, sailing date or reservation number. Accurate details do not prove that the sender is legitimate.
What to do if you receive a scam email
If you received one of these phishing emails, it’s important that you don’t click the link, reply to the message, or enter information on the linked website.
Instead:
- Open the Norwegian Cruise Line app yourself or manually type ncl.com into your browser.
- Check your reservation directly through your account.
- Contact Norwegian using a phone number from your booking confirmation or the official NCL website, not the email.
- If you booked through a travel advisor or third-party agency, contact that company through a verified phone number or website.
- Mark the message as phishing and preserve the original email, including its headers, if possible.
- If you entered payment or login information, contact your financial institution, change the affected password and enable multifactor authentication.
- Report suspected internet crime to the FBI’s Internet Crime Complaint Center and fraud to the FTC at ReportFraud.ftc.gov.
Passengers should also monitor bank and credit-card accounts for unauthorized activity. If a password was reused elsewhere, it should be changed on those accounts as well.
