Norwegian Encore nameplate. Editorial Image: ID 251979731 © Iandewarphotography | Dreamstime.com
Update 12 October: NCL displays guest advisory
Norwegian Cruise Line is now displaying an “Important Guest Advisory” banner on its website, advising guests to be cautious about suspicious communications.
The notice encourages passengers to avoid unfamiliar links and protect their personal and payment information.
The banner does not specifically mention the passenger reports described below, confirm a data breach or explain how the reported booking information was obtained. It provides an official warning about suspicious communications, while those questions remain unanswered.
Norwegian Cruise Line passengers have reported receiving suspected phishing emails containing accurate details about their upcoming cruises, including reservation numbers, sailing dates and cabin information.
Several posts shared in the r/NCL Reddit community on 10 October describe messages asking passengers to complete guest check-in or additional verification. Some reportedly threatened cancellation unless passengers followed a link and acted quickly.
The reports have not been independently verified by Voyage Ready, and the source of the booking information remains unknown. They do, however, highlight a warning for anyone receiving emails about travel, banking or other accounts: correct personal details don’t automatically make a message genuine.
What passengers are reporting
A screenshot shared on Facebook shows another variation, this time referring to a Norwegian Gem reservation. Headed “Mandatory Compliance Step”, the message claims the passenger must authenticate the card used for their booking to activate boarding clearance and terminal fast-track.
It acknowledges that the cruise is already paid and presents the request as fraud protection rather than another payment. Voyage Ready has not independently verified the email’s origin, but the screenshot illustrates how a suspicious request can be framed as a security measure.
Suspected phishing email referring to a Norwegian Gem booking, shared on Facebook. The email’s origin has not been independently verified.
In one Reddit post, a passenger booked on Norwegian Encore’s 11 October Vancouver–Los Angeles sailing said they received an email requesting guest check-in.
According to the passenger, it contained their full name, reservation number and the amount paid for their cruise. They said they called NCL and were told the message had not originated from the cruise line.
In a second post, another Norwegian Encore passenger reported a similar message containing their name, ship, exact sailing dates, booking number, cabin number and a booking or payment amount.
That passenger said the sender’s address and linked website did not use NCL’s domain. They reported the message to NCL and said they had not entered passwords, payment details or passport information.
A commenter on the first thread also reported receiving a similar request relating to Norwegian Viva, including a warning about potentially losing their cabin.
In a further Reddit post, a passenger booked on Norwegian Getaway’s 12 October sailing reported receiving at least six suspicious emails. They said the messages included family members’ names, their reservation number and the exact amount paid, with some threatening cancellation unless they completed additional verification.
Another passenger said a linked page requested credit card information and payment of the full cruise cost again, despite their booking being fully paid and check-in showing as complete on NCL’s official website.
These remain passenger accounts, rather than independently confirmed findings.
Has an NCL data breach been confirmed?
As of the morning of 12th October, NCL is now displaying a guest advisory warning about suspicious communications, unfamiliar links and requests for personal or payment information. The advisory does not confirm a data breach or identify the source of the booking details described in passenger reports.
Why accurate details can make a suspicious email convincing
An email asking you to finish check-in can seem plausible when you’re about to travel. Add your actual ship, sailing dates and reservation number, and it becomes easier to assume the sender must be legitimate.
But those details alone don’t prove who sent it.
The Australian Cyber Security Centre’s phishing guidance explains that fraudulent messages can closely resemble communications from trusted organisations, using convincing wording and official-looking logos. Pressure to act quickly, threats of consequences and requests for sensitive information are warning signs.
The Hong Kong Computer Emergency Response Team Coordination Centre has issued similar advice about travel-booking scams, warning that genuine names and itinerary details do not prove a message is authentic. Its warning concerns other travel platforms, rather than these NCL reports.
A message saying you could lose a cabin you’ve already paid for gives you a very good reason to worry. It also gives you a very good reason to stop and check before doing what it asks.
How to check an unexpected email safely
The same precautions apply to cruise bookings, airline reservations, parcel deliveries, bank accounts and government services.
If an unexpected message asks you to log in, pay money or confirm personal information:
- Open the official app or website yourself. Use your existing app, a saved bookmark or a known web address to check your account.
- Verify the request separately. Contact the company or your travel agent using details from your original booking or the official website.
- Don’t use the suspicious message’s contact details to check it. A phone number or reply address in the email may lead back to the sender.
- Pause when there’s pressure to act. A genuine deadline may still need attention, but verify it through a trusted channel.
- Don’t rely on familiar details or branding. Your name, a correct booking number and a recognisable logo are not proof that the request is genuine.
These steps follow the Australian Cyber Security Centre’s advice to check requests through trusted sources and avoid unexpected links or attachments.
For NCL passengers, that means opening the NCL app or manually visiting NCL’s official website to check the reservation, then contacting the cruise line or booking agent if something doesn’t match.
Legitimate companies do send emails containing links. The point is to verify an unexpected or sensitive request before trusting it.
What if you’ve already entered information?
If you entered a password on a suspected phishing page, change it through the genuine website or app. Change it anywhere else you’ve reused it, and enable multi-factor authentication where available.
If you supplied card or banking details, contact your bank promptly through its official app or a known phone number. Let the cruise line or booking agent know if your reservation information may also be affected.
Keep the email and relevant screenshots for reporting, but avoid posting unredacted booking numbers or personal details publicly.
The Australian Cyber Security Centre provides reporting and recovery guidance for people who think their information or accounts have been compromised.
For now, the source of the information described in these passenger reports remains unknown. Check an unexpected request through a channel you already trust, even when the email appears to know all the right details.
