The Anatomy of a Modern Travel Scam
Scammers are increasingly targeting travellers with highly convincing fake messages. This isn't your typical spam email with obvious errors. These fraudsters often have your real booking details—your name, the hotel, and your stay dates—making their requests
seem legitimate. The scam typically involves receiving an email, SMS, or a message through a booking app's own system. The message claims there's an issue with the credit card on file, and that you must update your payment information to avoid cancellation. The goal is to trick you into clicking a malicious link and entering your credit card details on a fraudulent website or to make a direct payment through an untraceable method.
How Scammers Get Your Details
A key reason these scams are so effective is that the criminals have specific details about your trip, lending them an air of authenticity. This information is often obtained through data breaches at third-party booking platforms or even by compromising a hotel's own administrative systems through targeted phishing attacks. Once they gain access, scammers can see a list of upcoming reservations and use that information to contact guests directly, pretending to be the hotel. They are essentially inserting themselves into the communication chain between you and your accommodation provider, making it difficult to tell a real message from a fake one.
Red Flags to Watch For
While scammers are getting better, there are still several warning signs. The most significant red flag is a demand for urgent action. Messages that use phrases like “immediate action required” or threaten instant cancellation are designed to create panic and rush you into a mistake. Another major warning sign is the requested payment method. Hotels and major booking sites will not ask you to pay via peer-to-peer apps like PayPal or Venmo, nor will they ask for a bank transfer or cryptocurrency. Finally, scrutinise any links you are asked to click. Hover over the link to see the actual URL. Scammers often use lookalike domain names that are just slightly different from the real hotel or booking site's address.
How to Protect Yourself
The single most important step is to verify any unexpected payment request independently. Do not click any links or call any numbers provided in the message. Instead, find the hotel's official phone number from your original booking confirmation or their official website and call them directly to ask if there is a genuine issue with your reservation. If you booked through a third-party website, log into your account on their official app or website to check for any notifications—do not use any links from the suspicious message. Using a credit card for bookings also offers a stronger layer of fraud protection compared to debit cards or other payment methods.
What to Do If You Receive a Suspicious Message
If you receive a message you suspect is a scam, do not reply to it and do not click on any links. The best course of action is to report it. You can report the message within the booking platform's app if that's where you received it. You should also contact the hotel and the booking platform through their official channels to let them know about the fraudulent communication. If you have already clicked a link or provided your details, contact your bank or credit card company immediately to report potential fraud and have your card blocked. Reporting these incidents helps platforms and hotels identify compromised accounts and warn other travellers.
