Planning your next getaway? Be on high alert for a sophisticated scam currently targeting travellers who use Booking.com.
How the Scam Works
Fraudsters are exploiting security breaches at the individual hotel level to access legitimate reservation details. Because the scammers know your full name, booking dates, hotel location, and reference number, their communications can appear remarkably convincing.
Here is how the fraud typically unfolds:
Direct WhatsApp Messages: Victims are contacted on WhatsApp by someone claiming to represent their booked accommodation.
Artificial Urgency: You will be told there is an issue with your payment card details and warned that your reservation will be cancelled within 24 hours unless you re-verify them.
Cloned Web Links: You are sent a link to a website designed to look identical to the official Booking.com payment portal, where your bank and card details are stolen.
2FA Code Theft: In some cases, scammers may even phone you directly, posing as customer support, and ask you to read out a two-factor authentication (2FA) text code to compromise your accounts.
How to Protect Yourself and Outsmart the Fraudsters
Many genuine hotels do use WhatsApp to communicate with guests, so you shouldn't ignore messages automatically—but you must verify them using these quick checks:
Check the Country Code: Verify that the sender’s phone number matches the country code of your holiday destination. A message regarding a hotel in Spain sent from a South American country code is a major red flag.
Inspect the Link: Look carefully at any web address provided. Phishing links often feature extra hyphens, misspellings, or random sequences of letters attached to the domain name.
Cross-Reference Details: Search the telephone number on the hotel’s official site to see if it matches their contact information.
Phone the Hotel Directly: If in any doubt, do not click the link or reply on WhatsApp. Call the hotel directly using the telephone number provided on your original confirmation email or official website.
Never Share Verification Codes: No legitimate company will ever phone you and ask you to read out a security or two-factor authentication code sent to your mobile phone.
Bottom line: Always pause before acting on urgent payment demands, double-check web addresses, and contact your accommodation directly through verified channels if something feels amiss. Safe travels!
