Booking.com Hotel Payment Scam: How to Check a Message
If a message apparently from your hotel asks you to verify a card, pay again or follow a link to prevent cancellation, stop before entering any information. Open the booking independently in the app or through your usual route and compare the request with the original payment terms. If you have already shared card details or approved an unfamiliar payment, contact your bank immediately through its official channel, then report the incident to the booking platform.
Verify the request without using the message's link
Open the Booking.com app you normally use, or reach your account independently. Find the actual reservation and read its payment policy, current status and any amount still due. Do not use the new message's link or telephone number as the starting point for checking whether that same message is genuine.
Compare four things: who is meant to collect payment, when it is due, how much is due and the agreed method. If the request changes an important part of that arrangement, ask the platform's customer service or contact the property through a number you independently verified. A reply in the same conversation is not an independent check of the sender.
Do not cancel the booking simply to escape the message. First establish whether the reservation itself is still valid and what the real provider requires. Deleting an alarming message, paying a second time and cancelling a legitimate stay are different actions with different consequences.
Once the booking and payment questions are resolved, try RoadMe to build a complete personalised sightseeing plan around your interests, dates and pace in supported cities. It is a convenient way to return to organising the trip with time for the places you actually want to enjoy.
If arrival is imminent, make that clear when contacting support: give the booking reference and explain that you need the legitimate payment and check-in arrangements confirmed. Keep the response. An urgent arrival is a reason to seek a clear answer promptly, not to give an unexpected link permission to change the booking terms.
Correct booking details do not prove the sender is genuine
A fraudulent message can contain your name, the hotel's name, the stay dates and the expected price. Those details make the message persuasive, but they do not establish who is controlling the conversation. Do not treat personalisation as a security check that replaces comparison with the actual booking.
Messages can arrive through email, WhatsApp or a booking platform's own messaging system. The Swiss National Cyber Security Centre has described attacks involving compromised hotel-system accounts, as well as messages using real reservation details. Being inside an apparently familiar conversation is therefore not enough to authorise a new payment.
You do not need to establish the technical cause before taking sensible precautions. The traveller's task is to verify the request through an independent route, protect any information already exposed and obtain a clear answer about the reservation. Speculating about exactly whose system was affected does not settle the payment question.
The same caution applies after a stay. A supposed refund or cashback can be another reason given for following a link and entering financial information. An unexpected promise of money deserves the same independent check as a threat that you will lose the booking.
| What the message says | Why to pause | What to check independently |
|---|---|---|
| Verify the card immediately or the room will be cancelled | Pressure can push you past ordinary payment checks | The actual reservation status and original payment policy |
| The payment failed; use this new link | The new route may be unrelated to the real booking | Who was meant to collect the payment and whether it is actually missing |
| A refund is waiting | A refund story can also be used to request sensitive details | Whether the provider has confirmed a genuine refund through a trusted channel |
| The message includes your exact dates | Real information can be used by an impersonator | The sender's authority, not just the accuracy of the details |
Read the original payment policy before deciding
Accommodation bookings can have different legitimate arrangements: payment in advance, payment at the property, a scheduled charge or a deposit under the stated conditions. The existence of a payment request is not, by itself, proof of fraud. The key question is whether the request fits the arrangement you agreed to and can be confirmed independently.
A paid stay can still have a separately disclosed local charge or deposit. Conversely, a “pay at the property” booking should not be reinterpreted through an unexplained new message demanding an unrelated transfer. Read the actual confirmation and ask about a discrepancy before sending money.
Our guide to accommodation deposits and extra charges explains how to separate those items. It helps you ask a precise question rather than treating every new amount as either automatically legitimate or automatically fraudulent.
Booking.com's safety guidance says it will not ask for card details by email, phone, text or WhatsApp, or ask for a bank transfer that differs from the payment policy in the confirmation. Do not read that as permission to send details through another unfamiliar route. Use the policy and a verified contact together.
If the property normally uses a separate payment service, confirm that fact and the specific request through a trusted route before using it. A professional-looking payment page does not establish that it belongs to the provider. Equally, an external service is not automatically fraudulent solely because it has a different name.
What to do depends on what you have already shared
Write down what happened without trying to complete the suspicious process to see where it leads. Did you only read the message, open a page, enter an account password, enter card details or approve something in your banking app? Those are different situations and should be described accurately to the relevant support team.
| Your situation | Immediate priority |
|---|---|
| You only received or read the message | Do not use its link; verify the reservation independently and report the request |
| You opened the page but did not enter information | Stop interacting, close it and report what happened; mention any download or installed software |
| You entered an account password | Secure the affected account through its genuine service and address any reuse of that password |
| You entered card or bank details | Contact the bank or card provider immediately and follow its instructions to protect the account or card |
| You approved a payment or money has moved | Tell the bank exactly what was authorised and ask what can be stopped, investigated or disputed |
Do not wait for an unfamiliar transaction to appear if you have already supplied card details to a page you believe is fraudulent. Explain the exposure to the issuer and ask about blocking or replacing the card. The bank's response should be based on your actual situation; a travel article cannot promise that one account setting will resolve every kind of exposure.
If credentials were entered, change the affected password through the genuine account and use available account-security settings, including two-factor authentication where offered. If the same password was reused elsewhere, those accounts need attention too. Do not follow a second link from the suspicious sender claiming to “secure” the account.
If a file was downloaded, software installed or remote access granted, tell the support service that specifically. Merely opening a link and installing software are not the same event. Seek appropriate device-security assistance rather than assuming that a password change alone establishes the device is unaffected.
Bank codes and approvals: read what they actually authorise
A caller or chat participant may ask you to provide a code or approve a banking prompt as part of a supposed verification or refund. Do not pass banking security codes to someone in that conversation. Read the bank's own message or app prompt carefully: the operation, merchant and amount matter more than the explanation supplied by the person asking.
A statement that an action is “only verification” does not change what the banking prompt authorises. If you do not understand it or it describes a different operation, stop and contact your bank through the channel you normally use. Do not approve an unfamiliar request to keep the conversation moving.
There are also legitimate authentication steps in ordinary payments. The distinction is not that every bank approval is fraudulent; it is whether you initiated and understand the transaction and have verified the payment route. A screenshot of a hotel logo or a promise of a refund does not answer that question.
After an incident, preserve the exact messages and explain what you entered or approved. Do not describe a bank-approved transfer as though no authorisation occurred, or assume that a payment is unrecoverable without asking. Accurate details help the issuer assess the available next steps.
Contact the platform and property through a trusted route
Use the help or customer-service route reached from the actual app or reservation you opened independently. Explain that you received a suspicious payment or verification request, provide the relevant booking information and state whether you used the link or shared information.
Keep booking credentials private outside the genuine support process. A reservation PIN is different from a bank security code or your account password. Do not send a screenshot containing all of them to a stranger who claims to be support. Share only what the verified service needs.
When calling the property, use contact information you have independently verified, rather than the new number in the alarming message. Ask a concrete question: does this request belong to the property, does it match the agreed payment arrangement and what, if anything, remains due? Keep the answer and the time of the conversation.
If the message appears inside the platform, report it there even if someone replies reassuringly in the same thread. That reply may not provide an independent answer. You can ask the genuine support team how to preserve the reservation while the request is investigated.
A support report and a bank report serve different purposes. Informing the platform does not itself protect an exposed card or stop a payment; contacting the bank does not establish that the accommodation has confirmed your check-in. Keep both tasks visible until the relevant service has answered.
Keep a short evidence record
Save the original confirmation, the suspicious request, the sender information, the time and any page or transaction details relevant to what happened. Screenshots can be useful, but keep sensitive information out of anything you share publicly. You do not need to post your full booking reference or card data to ask a general question.
Make a simple incident note: what was requested, what you did, what information was entered, which official services you contacted and any reference they provided. This is easier to use than a long message history when the bank or platform asks a specific follow-up question.
If money was lost, ask about the appropriate reporting and dispute steps and consider reporting the suspected crime to the police under the relevant local process. Keep the bank and platform reference numbers together. Recovery depends on the circumstances and applicable processes; no report should be described as a guaranteed refund.
Do not pay a further “release fee” or give remote access to a new person who claims they can recover the money. Verify any follow-up through the existing official channels. An upsetting first incident should not be allowed to make the next unexpected demand seem more credible.
Prepare future bookings so a real problem is easier to resolve
Before departure, save the booking confirmation and note the agreed payment schedule, remaining balance and the way to reach the platform or property. Keep a suitable contact and payment backup for arrival. A clear record helps distinguish a genuine unresolved balance from a new story introduced by a message.
Our guide to preparing your phone for travel helps organise account access, saved information and practical backups. Check that you can reach the services you need without relying entirely on the same message thread or on a phone number you may not receive while abroad.
Use security settings offered by the real services and avoid sharing more booking information publicly than necessary. Even strong account protection does not turn every incoming message into a trusted instruction. Continue to compare a payment request with the actual booking and verify an important change independently.
With the stay confirmed, RoadMe can work out a personalised sightseeing plan for supported cities, balancing your preferred visits with meals and rest. Try it to organise the enjoyable parts of the journey around your own interests and pace.
The quick decision before any new hotel payment
- Stop the new instruction. Do not enter information through an unexpected payment or verification link.
- Open the real booking yourself. Check its payment policy and status through your normal app or access route.
- Verify independently. Use the platform's genuine support or a property contact you checked separately.
- Protect anything already exposed. Tell the bank promptly about card details or approvals, and secure affected accounts.
- Keep the record. Save the request, confirmation and official case references.
A convincing hotel message is still a request to be checked. Correct dates, a familiar logo and an urgent deadline do not replace the agreed payment terms or a trusted confirmation. Verify the payment first, and let the genuine provider explain what the booking actually needs.
