NCL Probes Phishing Emails That Quote Guests' Real Booking Details
If you are booked on any NCL sailing, especially one departing within the next 30 days, expect a warning from the line. Do not click links, reply, or give personal or payment information in any email claiming to be NCL. Check that the sender address ends in @ncl.com or @nclcorp.com, and remember addresses can be spoofed. If an email worries you, verify through NCL's official website, its official customer service number, or your travel advisor.
My read is that the real story here is credibility, not the phishing itself. These emails quote the guest's actual name, ship, departure date, and booking number, and one Norwegian Encore passenger even saw the amount paid, which is exactly what makes a bogus 'security authentication for the card on file' feel routine. NCL has not confirmed how the scammers got that data, and some passengers are speculating about a breach, so I would treat that as unanswered rather than assume. The line's response of a website notice, a letter to travel advisors, and a warning to guests sailing within 30 days is sensible but reactive. Travel advisors and guests with near-term departures are best placed to benefit, since they get the warning first. Those booked further out are the ones most likely to be caught off guard. The dry irony is that an email promising security is the threat. I would ignore every link and go straight to ncl.com or my advisor.