Booking.com WhatsApp Hotel Payment Scam

Overview

Scammers use real reservation details leaked in a Booking.com data breach to send convincing WhatsApp messages claiming a guest's hotel payment failed, directing them to a fake payment page that steals their card details.

How It Works

After a Booking.com data breach, criminals send travelers a WhatsApp message that references their actual hotel name, exact stay dates, and real confirmation number, then claims there's a problem with the payment and includes a link to a fake site made to look like the hotel's or Booking.com's own payment page. Because the message gets so many real details correct, victims have little reason to doubt it and enter their card information to "fix" the supposed payment problem, handing it directly to the fraudsters. Investigators also traced some of the stolen details to hotel staff accounts compromised separately through phishing or malware, meaning the scam isn't limited to travelers who stayed during the breach window.

Red Flags

• Unsolicited WhatsApp message claiming your hotel card payment failed or needs to be redone
• Message includes a link to re-enter payment details on a page designed to look like the hotel's or Booking.com's own payment page
• The sender knows accurate booking details (hotel name, dates, confirmation number) but contacts you through WhatsApp rather than the official app
• Request for payment or card verification outside Booking.com's official app or website

Real Examples

• An April 2026 Booking.com data breach exposed personal details of more than 4,000 travelers, including about 300 cases with payment card information, which scammers then used to craft convincing WhatsApp messages referencing travelers' real hotel name, stay dates, and confirmation number
• Spain's INCIBE and Guardia Civil renewed a public warning on August 13, 2026 about the scam still actively targeting travelers that summer, with Spain's consumer group OCU logging complaints from travelers who lost hundreds of euros after trusting messages containing accurate stay details

Where It Spreads

How to Protect Yourself

• Never enter card details through a WhatsApp link for an existing stay
• Verify any WhatsApp sender's number against the hotel's official contact details
• Check that a payment link's web address matches the legitimate hotel or platform exactly before entering any information
• Report suspicious messages to the Policía Nacional or Guardia Civil, or flag them through INCIBE's helpline

Related Scams