Carnival Rolls Out New Security Measure to Protect Cruise Bookings

If you’re managing your Carnival Cruise Line booking online, you may be surprised by the company’s new interface. Instead of only being asked for your booking number and the guest’s last name, you’ll have to add more information corresponding to your reservation.

Under the new system, users must specify their date of birth, vessel name, sail date, booking number, and surname. The changes were implemented over the weekend, adding another layer of security that prevents unauthorized access. 

Though the cruise line hasn’t officially announced the update or explained why it was rolled out, it could be due to previous cases of fraudulent activity in its website’s Manage Your Booking section.

Last May, a passenger from Kentucky, Tiffany Banks, learned that her $12,000 booking had been suddenly canceled when she checked on her cruise via the website. At first, Banks thought the problem was at Carnival’s end. 

@thathippiedoc

We will never book with carnival again … #carnival #celebration #carnivalcelebration

♬ original sound – Tiffany Banks

Since she couldn’t resolve the issue with the cruise line’s customer service department, she posted a TikTok video that eventually went viral. Netizens sided with Banks, many of them encouraging TikTok to file legal action.

However, another video surfaced in the following days that explained what happened. According to Kelly Thompson, a TikTok user following the story, another user fraudulently gained access to Banks’ booking after Banks posted a photograph of a personal document from the cruise line.

Thompson narrated, “At some point, she posted a picture of her boarding pass online, and some person took her booking number, created a fake profile on Carnival, added their booking number to their account, and then canceled her $15,000 cruise.”

Carnival later offered Banks $10,404 in future credits. Banks is still waiting for a refund.

Cybersecurity experts agree that human error is the leading cause of data breaches. Examples include weak passwords, phishing attempts, unsecured devices, missing security patches, and in Banks’ case, the improper handling of sensitive data.