A message with the exact name of the hotel and check-in date may not be a booking confirmation, but part of a fraudulent scheme. Criminals use these details to trick people into providing their bank card information through messengers or chat services. This is reported by Ausnews. Other examples of phishing attacks are collected in the material about fake payment links.
How hotel booking scams work
Tourists may receive messages on WhatsApp or directly in the Booking.com chat. The message includes the name of the accommodation, travel dates, and other booking details, and then prompts them to urgently confirm payment details supposedly to secure the reservation.
The link leads to a fake page resembling the service's website. If one enters card details there, they end up with the scammers. The mere fact that the message arrived in the genuine chat of the platform does not guarantee its safety: the account of the accommodation or partner may have been compromised.
One such case was reported by the German publication Bild. An employee received a message with the name of accommodation in the Faroe Islands exactly as it was listed on Booking.com. The owner of the accommodation confirmed that they had not sent it. How exactly the criminals obtained this information remains unknown.
How to protect card information while traveling
Possible sources of data leakage include access to booking data or the system used by the accommodation owner. These are still theories, not confirmed explanations of the incident. Previously, Booking.com had already warned some users about suspicious activity, through which third parties could gain access to certain booking data.
If a message urgently requests your card details, do not click the link. Contact the hotel using the phone number from its official website or check your booking via the app or website you opened yourself. A similar principle of caution is needed when receiving fake messages with links.
If you have already entered your card details, immediately contact your bank, request to block the card, and check your latest transactions. Do not share confirmation codes from SMS or your banking app with anyone. Read more about similar ways of stealing financial data in the material about protecting bank accounts.