Is it normal for a hotel to ask for card verification by WhatsApp?
No. A genuine hotel won't ask you to 're-verify' full card details or codes via WhatsApp, SMS, or email links.
Last reviewed: 1 August 2026
Explanation
No. This is a known phishing pattern that surged after scammers began compromising hotels' accounts on major booking platforms: because the message arrives through the platform's own chat or quotes your real booking reference, dates, and price, it looks far more credible than ordinary phishing. The story is always a payment problem — your card 'failed verification', the booking 'will be cancelled tonight' — and the fix is always a link where you re-enter your full card number, CVV, or a one-time code. Genuine hotels and booking platforms never do this; payment issues are handled inside the platform's secure payment flow, and no legitimate process needs your CVV or a code sent to your phone via a chat link. If you get such a message, don't click the link — open the official app or website directly, check whether your booking actually shows a problem, and contact the hotel through the number on the platform. If you already entered card details, call your bank immediately to block the card.
Common red flags
- Requests to 're-verify' full card details or CVV via a link
- Real booking details used to seem genuine
- Urgent 'verify now or lose your booking' pressure
- Links to non-official domains
What to do now
- Don't click or enter details
- Verify your booking via the official app or phone number
- Call your bank if you already entered card details
Frequently asked questions
Why does the message know my booking reference?
Scammers exploit breached booking-platform data. A real reference doesn't prove a message is genuine — verify through the official app or phone number.
The message came through the booking platform's own chat. Doesn't that make it real?
No — it usually means the hotel's account on the platform was compromised. The chat channel is only as trustworthy as the accounts using it. Treat any payment link sent through chat as suspect and check your booking's status in the app directly instead.