Hotel Phishing

Hotel phishing is a targeted scam in which fraudsters impersonate a hotel you have already booked with, contacting you via email, SMS, or booking-platform chat to request that you 'verify' or 're-enter' your payment card details due to a supposed problem with your reservation.

What makes this scam particularly effective is that the messages often include genuine details from your booking — your name, the hotel's name, check-in dates, and a real-looking reservation reference. This creates an impression that the message must be legitimate, because how else would the sender know these details?

The answer is that booking-platform data breaches, compromised hotel management systems, and third-party data leaks have made it possible for fraudsters to obtain partial booking records for large numbers of guests. They use these real details to give their phishing messages a credibility that generic scam emails lack. Victims who would normally spot a suspicious link are thrown off guard because the context feels genuine.

After obtaining booking data — through a breached travel platform, a compromised hotel front-desk system, or leaked aggregator data — the scammer sends a message that appears to come from the hotel or the booking platform. The message describes a plausible problem: a card pre-authorisation that failed, a payment that needs to be updated, or a system that requires re-verification before check-in.

The message includes a link to a fake page styled to match the hotel's or platform's branding. This page asks you to enter your full card number, expiry date, CVV, and sometimes a one-time code from your banking app. Once submitted, the details are captured and typically used within minutes to make fraudulent purchases or withdrawals.

The messages are often timed strategically — sent a day or two before check-in when the booking feels urgent and guests are anxious about having everything in order. Some campaigns are sent in bulk to everyone in a leaked dataset regardless of check-in date, relying on a proportion of recipients having bookings current enough to find the message plausible.

The inclusion of real booking details is the central reason this scam succeeds where generic phishing fails. When a message knows your name, your hotel, and your check-in dates, the normal heuristic of 'I didn't expect this message so it might be spam' no longer applies — you were expecting to hear from the hotel.

The emotional context reinforces urgency. A guest two days before a holiday does not want to risk their booking being cancelled over a payment issue. The scammer frames inaction as the risky choice, and clicking the link as the safe, responsible one.

Booking platforms' and hotels' increasing use of chat tools and messaging integrations also means guests are accustomed to receiving communications through multiple channels. A message via a booking app's chat feature feels especially plausible, and some scams occur precisely there when hotel accounts on booking platforms are compromised.

A guest with a hotel booking receives a message via the booking platform's own chat system — sent from what appears to be the hotel's account — stating that a card pre-authorisation failed and the reservation will be released unless payment is updated within four hours. The message includes the correct check-in date and room type. The guest follows the link, enters their card details, and a short time later notices unauthorised transactions on their account. The hotel, when called, has no record of sending any such message.

Your reservation [reference] will be cancelled unless you re-verify your card within 2 hours: [fake link].

Important: your card pre-authorisation for [hotel] on [dates] has failed. Please update your payment within 4 hours to keep your room: [fake link]

Hello [guest name], this is [hotel]. We require card verification before your arrival on [date]. Please complete at [fake link] — this takes under 2 minutes.

Security alert: an issue was detected with your payment for booking [reference]. Update your details to avoid cancellation: [fake link]

If you receive any message asking you to re-verify payment details for a hotel booking, do not click the link. Instead, open the booking platform's official app or navigate directly to its website, and check your booking from there. If the platform shows no payment issue, the message is fraudulent.

Alternatively, call the hotel directly using a number you find on the hotel's own website or a trusted map listing — not any number in the message or confirmation email. Ask the front desk whether there is a payment issue with your reservation.

Legitimate hotels and booking platforms do not ask for your CVV or banking app codes via email or SMS links. If any message requests these, treat it as a scam regardless of how convincing the surrounding details appear.