The scheme is referred to as "I Paid Twice"; hotel customers are conned into handing over their banking information. This multi-step campaign actually begins when hackers target hotels themselves.