We spent the summer building a place for you to talk, and it’s ready! Backchannel is our new private forum. Readers use it to argue about the stories in this newsletter and to tell me what I got wrong.

Any subscriber can join and post in the open channels. PRO members get three more channels that nobody else can see. I take questions in Ask Elliott, our advocates work cases in Get Help, and Insiders Only belongs to the members.

Your PRO subscription pays for this reporting, and it comes with those private channels, our members-only coverage and every book I’ve written.

In our latest podcast, we expose the bizarre and frustrating paper trail for a recent case

We have the full paper trail on today’s case, and it’s enough to drive anyone out of their mind. The boys read it—and weep. Here are the details.

Catch up on the latest stories from the Elliott Report

Booking.com rented him a room with blood on the walls. Why won’t it refund his $313?
A studio apartment in Penang, Malaysia, came with bloodstains, mold and someone else’s hair in the bedding. Booking.com says the refund is the host’s call, and the host says cancel.

The ugly truth about August travel: Why you should stay home—or do this
August travel means thin staffing, dirty rooms and more cancellations, all at peak prices. Why the system breaks down every summer and how to work around it.

Would you pay extra to use the overhead bin?
If you’ve ever wondered what they’ll think of next—at least when it comes to airline fees—here’s your answer: Jetstar announced this week that it will soon charge you to put a bag in the overhead bin.

A stunning reversal for airline consumer rights
The government hasn’t assessed a single civil penalty against an airline for violating consumer protection rules this year.

More travelers are losing their insurance claims because of this. Don’t be one of them.
When something goes wrong on the road — a flight delay, vanishing luggage, illness — you file a travel insurance claim, expecting a quick reimbursement.

My hotel reservation disappeared. Why won’t Booking.com refund me for my new room?
A missing hotel reservation left him booking two rooms at his own expense. What to do when a hotel cannot find you, and how to get the difference back.

Viva Aerobus canceled my flight. Why did it send my $844 refund to the wrong bank?
Viva Aerobus cancels Carol Bartell’s flight to Mexico and insists on wiring her refund to a U.S. bank account. But the money disappears after a SWIFT code error sends the cash to the wrong credit union.

Flying with a cat allergy, and what you said about August travel

Dan Lieber worked out mid-flight why his eyes were itching. A cat, one row over, being petted the whole way. He keeps a rescue inhaler within reach and asks the crew for more fresh air in the cabin mix. Skandapriya Swamy says start earlier, at the gate, so the seats can be spread out. Tell us how you handle it.

Yesterday’s story on August travel drew a variety of responses from readers. Sheryl called operational decay an excellent summary and has skipped Europe in August for years, since that’s when the locals take their own holidays. Dee Eagle plans to sit the month out now too. What do you think?

Information and insights for Elliott Confidential PRO subscribers

The Federal Trade Commission (FTC) has published its annual summer travel scam warning, and the advice is the same advice it gives every year. Scroll past the paid search ads. Type the airline's web address yourself. Don't pay strangers by wire or gift card. Useful, but about a decade behind the problem.

What changed this year isn't in the FTC's warning at all.

Companies are playing fast and loose with your personal data. Carnival Corporation suffered a massive data breach in late May. An attacker used social engineering against a single employee account. Names, addresses, dates of birth, plus passport and driver's license numbers in some cases, were exposed for more than 5 million customers. (As a make-good, Carnival is offering two years of TransUnion credit monitoring.)

Then there’s Amtrak. A dataset attributed to the railroad appeared on Have I Been Pwned in April, verified at more than 2.1 million unique accounts, including names, addresses and customer support records. The group behind it claimed 9.4 million records were affected. (Amtrak hasn't confirmed any of it.)

The practical consequence for anyone traveling this summer:

The industry prefers to frame this as a consumer education problem. That framing is convenient. Carnival took six weeks to tell people. Amtrak, so far, hasn't told them at all. Travelers are being asked to outthink criminals working from data the travel companies lost and then sat on.

The takeaway: Assume any travel company you've booked with has already leaked your itinerary, and verify every unexpected message by calling a number you looked up yourself.