What are the red flags of this scam?

A WhatsApp or email message quotes your exact hotel name, check-in date, booking reference, and your name — this data comes from compromised hotel accounts, not your device • The message says your payment failed or needs verification before check-in, even though you received a booking confirmation weeks ago • You are asked to click a link and re-enter your full card number, expiry, and CVV — Booking.com stores your payment securely and your hotel never needs to collect card details via chat • The link leads to a domain that is not booking.com — look for subtle misspellings or payment pages hosted on unrelated sites • The message creates urgency: 'confirm payment within 24 hours or your room will be released' • Contact comes via WhatsApp from an unfamiliar number, even if the display name says 'Booking.com' or your hotel name

What should I do if this happened to me?

Do not tap any link — open the Booking.com app directly or type booking.com into your browser and check your reservation from there • Call your hotel using a phone number from the hotel's own website (not any number in the message) to confirm whether any payment issue exists • If you already entered card details on a linked page, call your bank immediately on the number on the back of your card to cancel the card and dispute charges • Report the message to Booking.com at partner.booking.com/help and forward phishing emails to phishing@booking.com • The message knowing your real booking details does not make it legitimate — this is a sign of the breach, not proof of authenticity • Report to Scamwatch at https://www.scamwatch.gov.au/report-a-scam or ReportCyber at https://www.cyber.gov.au/report.

HIGH phishing Last reported: 5 Oct 2026 Share

A WhatsApp or email quotes your real Booking.com reservation details then steals your card

Q: Is this a scam?

Yes. This is a documented scam pattern. Criminals use real reservation data (hotel, dates, name, reference) from compromised Booking.com hotel accounts to send convincing WhatsApp or email messages. They claim your payment failed and link to a fake page that steals your card details. Victims have included dozens of Australians since the April 2026 Booking.com breach.

Criminals use real reservation data (hotel, dates, name, reference) from compromised Booking.com hotel accounts to send convincing WhatsApp or email messages. They claim your payment failed and link to a fake page that steals your card details. Victims have included dozens of Australians since the April 2026 Booking.com breach.

Also known as: Booking.com scam Australia, fake hotel payment request Australia, travel booking WhatsApp scam, hotel phishing using real booking details, Booking.com data breach phishing

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.

What to do right now

1 Do not tap any link — open the Booking.com app directly or type booking.com into your browser and check your reservation from there
2 Call your hotel using a phone number from the hotel's own website (not any number in the message) to confirm whether any payment issue exists
3 If you already entered card details on a linked page, call your bank immediately on the number on the back of your card to cancel the card and dispute charges
4 Report the message to Booking.com at partner.booking.com/help and forward phishing emails to [email protected]
5 The message knowing your real booking details does not make it legitimate — this is a sign of the breach, not proof of authenticity
6 Report to Scamwatch at https://www.scamwatch.gov.au/report-a-scam or ReportCyber at https://www.cyber.gov.au/report.

Red flags

⚠ A WhatsApp or email message quotes your exact hotel name, check-in date, booking reference, and your name — this data comes from compromised hotel accounts, not your device
⚠ The message says your payment failed or needs verification before check-in, even though you received a booking confirmation weeks ago
⚠ You are asked to click a link and re-enter your full card number, expiry, and CVV — Booking.com stores your payment securely and your hotel never needs to collect card details via chat
⚠ The link leads to a domain that is not booking.com — look for subtle misspellings or payment pages hosted on unrelated sites
⚠ The message creates urgency: 'confirm payment within 24 hours or your room will be released'
⚠ Contact comes via WhatsApp from an unfamiliar number, even if the display name says 'Booking.com' or your hotel name

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Sources