Guide Scams and phishing
A "hotel" message asks you to verify your card or pay a balance: how to spot the scam and what to do
The message knows your name, your dates and your booking number. It says your payment failed, or that the reservation will be cancelled unless you verify your card within the hour. It can still be a scam – and police have described travellers who lost thousands this way. Here's how to tell, and what to do if you've already entered your card.
Key points
- Real booking details don't prove a message is genuine. Scammers can get them from hijacked property accounts or leaked data, and the message can even arrive in the booking site's own chat.
- Never pay or enter card details through a link in the message. Open the booking app or type the site's address yourself and check whether a payment is really due.
- Read what your banking app is asking you to approve. A "card verification" that shows an amount is an outgoing payment.
- Already entered your card? Freeze it in your banking app or call your bank's fraud line now, then report it.
What the scam looks like
You've booked a stay – on Booking.com, another platform or directly with a hotel. Days or weeks before you travel, a message arrives that matches your booking exactly. According to HKCERT and Czech police cases, the reason is usually one of these:
- the payment failed or your card needs to be verified,
- your booking needs to be confirmed or your details are "incomplete",
- your payment details must be updated by a deadline,
- and almost always a deadline: act now or the reservation will be cancelled.
The message contains a link. It opens a page that looks like the booking site but runs on a different address, and asks for your card details, passwords or one-time codes (HKCERT, June 2026).
Two real cases
Czech Republic, 2026. A woman booked an apartment through a travel site in December for a stay in August. In May she got a message through a messaging app that looked like part of her booking conversation. She clicked the link, entered her card details and approved two transactions in her banking app. Four payments went through in the end – almost 21,000 Czech crowns. The booking site told her afterwards it had never asked for any payment (Czech Police, 28 July 2026).
Czech Republic, 2023. A woman booked a hotel in Dubai through an app. A "hotel manager" contacted her on WhatsApp, quoting her booking number, price and dates, and said there was a problem verifying her card. The link opened a page that looked identical to the app. She entered her card, approved the payments and lost almost 50,000 crowns (Czech Police, 6 February 2023).
Why the message sounds so convincing
The fact that a message knows your booking proves nothing:
- Leaked data. HKCERT warned in June 2026 that scammers were contacting travellers by email and WhatsApp using booking details apparently leaked in an earlier security incident, including guest names, contact details and messages with properties.
- The real chat. If criminals take over a property's account on a booking platform, their messages arrive in the platform's own chat. A message inside the app isn't proof that the hotel wrote it.
- Regulators are looking at it. On 21 October 2026 the European Commission opened formal proceedings under the Digital Services Act. Among other things, it is examining whether Booking.com does enough against phishing scams that exploit its reservation and guest data. Opening proceedings doesn't mean a breach has been proven.
Looking for a long-term rental rather than a holiday stay? Fake landlords ask for a deposit before you've seen the place – our guide Rental scams and fake landlords shows how to spot them.
How to check the message
- Don't pay through the link. Open the booking app or type the site's address yourself and look at your reservation. If no payment is due there, the message is fake. HKCERT and Czech police give the same advice.
- Read the full address. Fake sites often differ from the real one by a small detail. Our guide How to spot a fake link shows how to read a domain.
- Ignore the countdown. "Pay within the hour or lose your booking" is designed to stop you thinking. Czech police note that reputable companies don't usually demand urgent payments through messaging apps.
- Be wary of anything off-platform. Moving the conversation to WhatsApp, or a request to pay by bank transfer, are warning signs. Pay only in the official app or website, or on arrival.
- Call the property on a number you found yourself – from its official website, not from the message.
- Read what you approve in your banking app. Approving a payment means agreeing to send money (Czech Police). A "verification" that shows an amount and a merchant is an outgoing payment.
Already entered your card or approved a payment?
- You approved a payment: call your bank's fraud line straight away (the number is on the card and in the app) and ask whether the payments can be stopped or disputed. In the 2026 case above, the woman approved two payments and four went through – so freeze the card even if you think nothing more can happen.
- You entered your card: freeze it, order a new one and keep an eye on your statements for several weeks. HKCERT also advises keeping screenshots of the messages, the page address and the transaction records. More in what to do after entering details on a phishing site.
- You entered your booking account password: change it, and change it anywhere else you used the same one. Turn on two-step verification.
- Someone then calls you "from your bank": hang up and call the number on your card yourself – see bank impersonation calls.
Where to report it
- The booking site the message came through, using the help section of its official app or website. Tell the property too, on a number from its website – its account may have been hijacked.
- A scam text: in the UK and the US, forward it to 7726. The NCSC also explains how to report scam emails and websites. For a suspicious address, our link checker prepares a short report you can copy.
- You lost money: your bank first. In the US, also report it to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov.
A different scam is accommodation that doesn't exist at all, or a "host" who wants a deposit by bank transfer outside the platform – see fake online shops and marketplace sellers for how to spot those.
FAQ
The message came through the Booking.com chat and knows my reservation. Can it still be a scam?
Yes. When criminals get into a property's account, they can message guests from the real account. What matters is where the link goes: if it leads anywhere other than the booking site's official domain, don't enter anything there.
How do scammers know my name, dates and booking number?
In June 2026 HKCERT, Hong Kong's national computer emergency response team, warned that scammers were using booking details apparently leaked in an earlier security incident – guest names, email addresses, phone numbers and messages with the property. In October 2026 the European Commission opened formal proceedings to examine, among other things, whether Booking.com does enough against phishing that exploits reservation and guest data. No outcome has been announced.
The hotel wants me to pay a city tax or a deposit before arrival. How do I know it's real?
Log in to the booking app or website yourself and check the fees listed in your reservation. If you're still unsure, call the property on a number from its official website, not one from the message.
I entered my card on the page from the link. What now?
Freeze the card in your banking app or call your bank's fraud line (the number is on the back of the card), check your recent transactions and dispute any you didn't authorise. Then report it to the booking site and, in the US, to the FTC and the FBI's IC3.
How can I see where the link goes without opening it?
Paste the whole message into our link checker. Your browser pulls out the links, and only the one you choose is sent to our server, after you click. We show where it ends up after redirects, how old the domain is and whether it imitates a well-known brand.
Sources
- HKCERT – Phishing Alert: Beware of Booking.com Phishing Messages Exploiting Suspected Leaked Booking Data (15 June 2026)
- European Commission – Commission to investigate how Booking.com combats scams and fraud under the Digital Services Act (21 October 2026)
- Czech Police – Holiday yes, but with consideration (Ústí Region, 28 July 2026, in Czech)
- Czech Police – She booked a hotel (Hradec Králové Region, 6 February 2023, in Czech)
- NCSC (UK) – Report a scam text message
- FTC – How To Recognize and Report Spam Text Messages
Spotted a mistake? Let us know and we will correct it openly.
Related
Guide
I sent a photo of my ID to a scammer: what to do now
Scammers ask for a copy of your ID under all sorts of pretexts: “identity verification” for a loan, a flat you want to rent, a prize you've supposedly won, a job offer or a message that claims to be from a government agency. If you've already sent it, money won't vanish from your account because of the photo alone. But a document image with your name, date of birth and document number can be used to open credit or accounts in your name, and makes the next scam aimed at you far more convincing. Here's what to do, step by step.
Guide
SIM swap scam: your phone suddenly has no signal – what to do
Your phone suddenly shows “No service” or “SOS only”, maybe right after someone called claiming to be your mobile carrier and asked for a code from a text message. That's the classic sign of a SIM swap: a criminal has moved your phone number to a SIM or eSIM they control. From then on, your calls and verification texts go to them – including codes from your bank and email. The FBI's Internet Crime Complaint Center received 1,611 SIM swapping complaints in 2021 alone, with more than $68 million in losses. Here's how to spot it, what to do in the first minutes and how to protect your number.
Guide
A supplier says their bank details have changed: how to spot invoice fraud and what to do if you've already paid
The email comes from an address you know, follows on from a real order and simply says the supplier has a new bank account. Accounts pay it – and a few weeks later the real supplier chases an unpaid invoice. The FBI calls this business email compromise and counts it among the costliest frauds it tracks. Here's how to spot it, a simple rule your whole business can follow, and what to do in the first hour if the money has gone.