Fraudsters used holiday booking scams to steal more than £7 million from travellers last year, according to a new report.