The Room That Was Booked Twice: How a Hijacked Listing Diverted a Canmore Inn’s Guests — and Their Deposits

CANMORE, Alta. — November 3, 2026 — The room was booked, the deposit was paid, and the confirmation email looked exactly right. When the guests arrived at Stonepine Lodge, the fictional Canmore inn at the centre of the story, there was no reservation under their name — and the room they thought they had paid for was already occupied. The inn had not lost their booking. Someone else had taken it over before they ever arrived.

The problem was not in the inn’s own booking system. It was in the listing most guests found first: the inn’s profile on a popular map and travel directory. Sometime in the autumn, the phone number and booking link on that listing had been quietly changed. Callers reached a polite voice who took deposits by card, and online bookers landed on a copy of the inn’s booking page, complete with its photos, its room names, and its rates. The money went to an account that had nothing to do with the inn, and the guests’ details went with it.

The room had not been double-booked. It had never been booked at all.

According to the fictional inn’s account, the pattern emerged only when several guests arrived in the same week with confirmations the front desk could not find. Staff compared the confirmations with their own system and found the mismatch — the email addresses were slightly different, the booking references did not exist, and the phone number on the guests’ confirmations was not the inn’s. One guest had even called “the inn” to confirm a late arrival, and been reassured by a stranger.

“We answer the phone with the same greeting we’ve used for years, and suddenly people are telling us about conversations we never had,” said June Calloway, Stonepine Lodge’s fictional owner. “Guests arrive tired after a long drive, holding a confirmation we can’t honour, and they think we’ve made a mistake. We hadn’t. Someone was standing in front of our front door, wearing our name, and collecting our guests before they reached us.”

Hijacked business listings are a quiet, growing target for small-business fraud.

Cybersecurity and small-business advisors say directory listings are attractive precisely because they are trusted, public, and rarely checked. A listing does not need to be hacked in the dramatic sense — an attacker only needs to submit a plausible “correction” to a phone number or website, or to claim an unverified profile, and wait for the platform to accept it. Guests, meanwhile, trust the first result they see, especially when the photos and reviews look familiar.

“The listing did exactly what it was designed to do. It sent guests to a booking page,” said one small-business fraud advisor familiar with listing-hijack cases. “The attacker did not need to break into the inn’s systems. They only needed to change where the listing pointed, and let honest guests do the rest.”

In this fictional case, the damage was not a single dramatic theft. Individual deposits ranged from one night’s stay to a full weekend, and the inn estimates several thousand dollars was diverted in total before the listing was corrected. For the guests, the loss was compounded by the moment of discovery — arriving late, in the mountains, to a room that was never theirs, with card details already handed to a stranger. For the inn, the damage was reputational as well as financial: guests who had done nothing wrong left believing the inn had failed them.

Stonepine Lodge says it has since changed how it guards its online presence. The inn reclaimed and verified its listings on every major directory, set up alerts for changes to its phone number and website, and now checks its listings weekly, the way it checks its smoke alarms. Its real phone number and booking link are printed on its door, its receipts, and its own website, and staff are trained to spot a confirmation that did not come from the inn’s own system.

The fix, experts say, is deliberately unglamorous: claim the listing before someone else does.

That advice applies well beyond one inn. Across Canada, restaurants, clinics, tradespeople, and small hotels all depend on listings they may never have claimed, and most owners check them only when a customer complains. The defence is not a cleverer directory. It is ownership of the profile guests actually see.

For guests, the checklist is short: book through the business’s own website or the phone number printed on its door or receipt, be suspicious of a booking page reached only through a directory link, and check that a confirmation email comes from the business’s own domain. For small businesses, it is equally simple: claim and verify every listing, lock it with two-factor authentication where available, set change alerts, and check the phone number and booking link regularly — especially before a busy season.

Stonepine Lodge says affected guests are being offered rebooked stays where a diverted deposit can be proven, and the inn is asking guests to forward suspicious confirmations so the copycat pages can be reported and taken down.

The room was booked in good faith. The listing guests trusted was no longer the inn’s. And the difference — one phone number, checked before the season began — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.