How to protect your hotel cabinet from fraudsters

Official QonaqBook addresses

Enter your QonaqBook password only on these two sites. QonaqBook emails come from addresses on the @qonaqbook.kz domain.

• qonaqbook.kz

  Site for guests
• partner.qonaqbook.kz

  Hotel cabinet

Before entering a password, check the address bar: the address must end exactly in qonaqbook.kz. Look-alikes such as qonaqbook-kz.com, qonaqbok.kz or partner.qonaqbook.kz.verify-login.com are fakes. The safest way is to open the cabinet from a bookmark or by typing the address yourself, not via a link in a message.

QonaqBook never asks for

• your cabinet or email password;
• a code from an SMS or email — not “for verification”, not “for a payout”;
• your bank card number, expiry date or CVV;
• installing software or opening an attachment to “confirm your account”.

Not by email, not by phone, not in WhatsApp or Telegram. This line is in every email we send. If someone asks you for this, it is a fraudster — even if they name your hotel, a booking number or a guest.

How to spot phishing

Fraudulent messages usually push urgency and lead to a fake sign-in or payment page.

• Urgency and threats

  “Your account will be blocked in 24 hours”, “a guest complained, confirm your details now”, “your payout is on hold”. You will always see real QonaqBook notices in the cabinet too — check there instead of following the link.

• Fake payment and verification pages

  A link to “confirm your card”, “complete verification” or “pay the commission” leads to someone else’s site. QonaqBook commission invoices and payouts are shown only in the finance section of the cabinet.

• Attachments

  Archives, .exe or .scr files, documents with macros, an “invoice” or a “guest complaint” as an attachment — don’t open them. We never send software or ask you to enable macros.

• Messages “from QonaqBook” in messengers

  QonaqBook support does not message you first in WhatsApp or Telegram asking you to sign in, send a code or “confirm your account”. In doubt? Write to us from the cabinet or to the support email.

• A guest asks for payment outside the platform

  If a “guest” asks you to follow a link to pay or receive money, send a prepayment to their card or share card details — it is a scam. Booking conversations take place in the booking chat in the cabinet.

Second sign-in code

• Mandatory for owners and accountants

  After the password the cabinet asks for a one-time code from an email or SMS. Even if the password is stolen, nobody can get in without the code.

• Optional for other staff

  Managers and reception can turn on the second code themselves: cabinet → “Profile”. We recommend it for everyone with access to bookings and guest data.

• “Trust this device for 30 days”

  Tick it on your own work computer and the code won’t be asked for 30 days. Don’t tick it on someone else’s or a shared computer.

Emails about important actions

We email you right away when something important happens in the account:

• a sign-in from a new device or browser;
• a change of password, email or phone;
• the second code being turned off;
• a change of payout details;
• a new staff member invited or their rights changed.

If it wasn’t you, press “It wasn’t me” in the email. All sessions on all devices end, trusted devices are forgotten, the password is reset, the previous email or phone is restored and an urgent request goes to support. You set a new password right on the same page.

Activity log in the cabinet

Who signed in and when, who changed prices, bookings, payout details or staff rights — everything is recorded in the activity log. Owners and accountants see the log of the whole organisation, managers see their own properties. Take a look if something seems odd.

If you suspect a hack

Act right away, without waiting for support to reply:

1. 1

   Change your password

   Cabinet → “Profile”. The new password must be at least 8 characters and different from your email password.

2. 2

   Sign out on all devices

   Cabinet → “Profile” → “Sign out on all other devices”. All other sessions end.

3. 3

   Press “It wasn’t me” in the email

   If you got an email about an action you didn’t take, the button in it secures the account in one click.

4. 4

   Tell us

   Cabinet → “My profile” → “Report suspicious activity” (or at the bottom of the “Activity log”) — this instantly opens an urgent support request. Or write to support@qonaqbook.kz.

A few more rules

• Every staff member has their own sign-in. Don’t share one password across a shift.
• When someone leaves, remove their access in the staff section right away.
• Give the minimum rights: reception doesn’t need access to payout details and payouts.
• Protect the email the cabinet is registered to: a separate password and a second code in your email service.