More than 5,000 people were the victims of holiday booking fraud last year, with their total losses amounting to £7m, research suggests.