Fake Cancellation & Refund Scams

Fake cancellation and refund scams send travellers convincing messages claiming that their flight, hotel reservation, package holiday, or tour has been cancelled. The message offers a refund and directs the recipient to a fake page that either harvests card and banking login credentials, or charges a 'processing fee' to release money that was never owed.

These scams operate on two separate but related exploits. The first is the harvest of credentials: the fake page asks for bank account details, card numbers, or online banking logins to 'process the refund'. The second is the advance fee: the page claims a refund is ready but requires a small fee — for processing, administration, or 'currency conversion' — before it can be released. In both cases, the victim loses money rather than receiving any.

The scam is particularly effective when real disruptions are occurring. During periods of airline strikes, extreme weather, or major service failures, travellers with bookings become more alert to cancellation notices and less likely to dismiss a cancellation message as implausible. Scammers monitor these situations and deploy opportunistic campaigns that capitalise on the broader anxiety.

The scam begins with a message — typically email or SMS — that mimics the style and branding of a travel provider the recipient has a relationship with. The message states that a booking has been cancelled, often citing a vague operational reason such as 'technical issues', 'scheduling changes', or 'force majeure'. It includes a booking reference that may be genuine (obtained through a data breach) or fabricated.

A link in the message leads to a fake page. The page may display the provider's branding and describe an automatic refund process. To 'receive the refund', the user is asked to enter their bank account details, full card number, or online banking credentials. Once submitted, the details are captured and used to initiate fraudulent transactions.

In the advance-fee variant, the page acknowledges the refund is approved but states that a small fee — perhaps for processing or international transfer — must be paid first. The victim pays the fee and receives nothing, while their card details may also be retained for further fraud.

Genuine cancellations do happen, and travellers with bookings are primed to receive communications from their providers. A message about a cancelled booking fits within the normal range of travel correspondence rather than feeling random or intrusive.

The refund framing is particularly compelling because the message appears to be giving money rather than taking it. The psychology of an incoming refund reduces the vigilance that would accompany a request to pay. The victim is completing a form to receive money they believe they're owed — not paying a stranger, but reclaiming their own funds.

The advance fee element follows the same logic as refund scams in other contexts: the promise of a larger sum makes the small upfront payment feel rational. By the time the victim realises no refund exists, the fee and their card details are gone.

A traveller with a flight booked for the following week receives an email in the airline's style, including the correct flight number and booking reference, stating that the flight has been cancelled due to operational reasons. A refund link leads to a page asking for bank account details to process the automatic refund. The traveller enters the details and awaits the refund. Two days later, they discover unauthorised transactions on their account. When they check the airline's app, the flight is still scheduled and their booking is intact.

Your booking [reference] is cancelled. Claim your [amount] refund within 24h: [fake link].

Important: your flight [reference] has been cancelled due to operational reasons. To receive your automatic refund, complete the form at [fake link] within 48 hours.

Your [hotel] reservation for [dates] has been cancelled. A refund of [amount] is approved. Enter your bank details to receive it: [fake link].

Refund ready: a processing fee of [amount] is required to release your [amount] travel refund. Pay here: [fake link]

Any time you receive a cancellation notice with a refund link, verify the cancellation directly with the travel provider before clicking anything. Use the provider's official app or website — navigate there directly, do not use a link in the message — and check the status of your booking.

Genuine refunds do not require you to enter your bank account details, online banking credentials, or a new card number on a form. Legitimate providers refund to the original payment method automatically. If a page is asking for this information, it is a fraudulent page regardless of how convincing it looks.

If you are uncertain whether a cancellation is real, call the provider's official support line using a number from their official website. Never use a number provided in the suspicious message.