The Rise of the Reservation Hijack
A new and alarmingly effective type of scam is targeting travellers across India and the world. It’s known as a “reservation hijack,” and it works precisely because it looks so real. Scammers are no longer just creating fake hotel websites; they are now exploiting
legitimate bookings you’ve already made. The scheme relies on obtaining your actual reservation details—your name, the hotel you booked, your check-in dates, and your contact information. Armed with this data, which makes them appear completely credible, they launch a targeted attack when your guard is down. This information is often acquired by hackers who compromise the booking systems of hotels or their third-party partners, giving them a treasure trove of real, live travel itineraries to exploit.
How the Scam Unfolds
Days or weeks after you’ve made a booking on a popular platform, you receive a message. It might be an email, an SMS, or increasingly, a WhatsApp message. It will greet you by name and reference your specific hotel and stay dates. The message will claim there has been an issue with your payment, or that you need to 're-verify' your credit card details to prevent your booking from being cancelled. The language is urgent, designed to create a sense of panic and pressure you into acting quickly. The message will contain a link, which directs you to a website that is a perfect replica of the booking site you used or the hotel's own page. Once you enter your card details on this fake portal, the scammers have what they want. Because they used your real trip details, the whole process feels legitimate until it's too late.
Spotting the Red Flags
While these scams are sophisticated, they have tell-tale signs. The biggest red flag is any communication that tries to pull you away from the official booking platform’s app or website. If you booked on a site like Booking.com or MakeMyTrip, all official communication and payment issues should be handled within their secure messaging system. Be immediately suspicious of requests for payment or card details via WhatsApp, personal email, or SMS. Scammers often use international numbers, including those starting with +91 from outside your circle, to add a layer of confusion. Another major warning sign is the manufactured urgency. Phrases like “your reservation will be cancelled in 30 minutes” or “urgent action required” are classic pressure tactics. Reputable companies will provide reasonable timeframes to resolve genuine issues.
Your Best Defence Strategy
The single most important rule is to never click on links in unexpected messages about your booking, no matter how authentic they appear. If you receive a message about a payment problem, do not respond. Instead, independently verify the claim. Log out of all accounts and log back into your official booking app or website by typing the address directly into your browser. Check your messages and booking status there. If there is a real issue, it will be reflected in your official account. For added security, find the hotel’s official phone number through a separate Google search or on their official website and call them directly to confirm. Do not use the contact information provided in the suspicious message.
What to Do If You've Been Targeted
If you suspect you’ve received a scam message, report it. Block the number on WhatsApp and report the message to the booking platform you used. They need to be aware of these security issues to protect other users. If you have already clicked a link and entered your card details, contact your bank or credit card company immediately. Report the fraud and ask them to block your card to prevent any unauthorised transactions. The sooner you act, the more likely you are to mitigate the financial damage. You should also report the incident to the national cybercrime reporting portal to help authorities track these fraudulent activities.
