Phishbowl

Scammers Are Using Real Hotel Reservations to Trick Travellers

August 4, 2026

What Happened?

Travellers are being warned about a sophisticated scam where fraudsters use genuine hotel reservation details to impersonate hotels or booking providers. Victims receive an email, SMS, or WhatsApp message claiming there is a problem with their booking or that additional payment is required to confirm their stay.

Because the scammers have access to real reservation information—such as the guest’s name, hotel name, booking dates, or reservation number—the messages appear genuine and can easily fool unsuspecting travellers. Victims who follow the payment instructions may unknowingly provide their credit card details or lose money to the scammers.

How the Scam Works

Criminals first obtain genuine hotel reservation information, often through compromised systems or stolen booking data. They then contact travellers while pretending to represent the hotel or booking platform.

The message usually claims there is an issue with the reservation, such as a failed payment, missing payment verification, or the risk of the booking being cancelled. The victim is urged to act quickly by clicking a link to complete or verify payment.

The link directs the traveller to a convincing fake payment page designed to look like the hotel’s website or a legitimate booking service. Any payment information entered is captured by the scammers, who can then steal funds or misuse the victim’s credit card details.

Warning Signs

You receive an unexpected request for payment after your booking has already been confirmed.
The message creates urgency by claiming your reservation will be cancelled if you do not act immediately.
Payment is requested through a link sent via email, SMS, or WhatsApp.
The website address looks unusual or slightly different from the official hotel or booking website.
You are asked to re-enter your payment card details outside the official booking platform.

How to Stay Safe

If you receive a payment request relating to a hotel reservation, don’t click the link immediately. Instead, log in to your booking through the official hotel website or your booking platform using your browser or app.

If you’re unsure whether the request is genuine, contact the hotel directly using the phone number or contact details listed on its official website or in your original booking confirmation. Avoid using contact details provided in the suspicious message.

Before entering any payment information online, always check that you’re on the correct website. Be cautious of websites with misspelled domain names or unfamiliar URLs. Enabling transaction alerts on your payment card can also help you quickly identify and respond to any unauthorised activity.