Scammers are texting hotel guests real reservation details and demanding payment. Here is how the trick works and what to check before you pay.
A message that gets your arrival date and reservation number right can still be a scam. Criminals are breaking into hotel staff accounts, reading real bookings, and then messaging guests on WhatsApp. The message says to pay now or the room will be canceled.
The European Commission announced an investigation into Booking.com on Wednesday, Oct. 21. Regulators are reviewing how reservation data is shared with hotels and other accommodation providers. They are also looking at the platform's messaging service, fraudulent listings and advertising transparency. No wrongdoing has been established. Booking.com said it is cooperating and prioritizes security and the protection of personal information.
Cybersecurity firm Bridewell described the pattern earlier this year. Attackers sent hotel employees fake messages and imitation login pages. Once they had a hotel's partner-account login, they could see guest names and booking details on the reservation platform.
Guests then received WhatsApp messages with accurate details and a warning that the booking would disappear within 24 hours. Links led to pages that imitated the booking service. The scam works because the details come from a real booking, so the message feels legitimate.
Travel scams can be costly. A September PYMNTS Intelligence report found average travel-scam losses of $35,272, the highest of any category it examined. That figure reflects each respondent's most financially damaging personal scam in the past five years. A separate survey cited by emerchantpay found 34% of holiday-makers saw more suspicious travel content on social media over the last 12 months.
Fake bookings are a different problem. The Federal Trade Commission warns that criminals copy rental listings, advertise properties they do not control or invent places that do not exist. Supposedly free vacations can also lead to demands for upfront fees.
Anyone with a hotel reservation made through an online booking site could receive a message like this. Hotels are in the picture too, because a stolen staff login is what exposes guests. Someone with no upcoming reservation is not the target of this particular scheme.
The alert box above lists the steps. The key idea is simple: do not treat correct details as proof. Confirm any payment request through the hotel or the booking app using contact details you find yourself. The FTC also warns against payment only by cryptocurrency or gift cards.
The investigation is just starting, and it is not yet known what regulators will conclude. Travel businesses are expected to do their part, such as limiting staff access to guest records and giving guests an independent way to confirm extra charges.
If a message about your hotel booking demands payment, ignore its links and confirm with the hotel or booking app using contact details you found yourself.
Fake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourselfSecurity firm Flashpoint says criminals are trading in refund tricks, gift card fraud and hacked online stores ahead of the holidays. Shop owners should check their refund steps.
Read more: Scammers are targeting store refunds and gift cards before the holidaysMorristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cash
