Booking.com scams: recognise fake payment requests and respond after sharing card details
After a real booking, you may receive a message knowing your hotel, dates and price. It asks you to verify a card, repeat a payment or confirm the reservation through a link. Correct booking details alone do not prove authenticity.
What happened?
Receiving the message alone does not mean a loss. What matters is whether you opened a link, entered details or approved a payment.
I only received a suspicious message
It knows your booking details, but you have not opened a link or sent anything.
View the steps →I opened the link
The fake page opened, but you entered, downloaded and approved nothing.
View the steps →I entered card details or a password
You entered payment card details, sign-in credentials or reservation information.
View the steps →I approved a payment or transfer
Money left your account, you approved a banking action or sent a transfer outside the booking terms.
Open urgent response steps →A real booking with a fake request, or accommodation that does not exist
Both scams may misuse Booking.com’s name, but differ in whether a genuine reservation exists on the platform.
Scam after a genuine booking
The booking exists, but the offender misuses its details to send a fake payment request.
- You make a genuine reservation.
- The offender obtains booking details or access to communications.
- The message includes the hotel, dates, price or booking number.
- It threatens cancellation or claims payment failed.
- A link leads to a fraudulent payment page.
- The offender obtains card details, a password or payment approval.
Fake accommodation offer
The offer or reservation is fabricated and you are directed to pay outside the official process.
- You find an attractive offer or imitation website.
- The conversation moves away from Booking.com.
- A bank transfer is requested.
- You receive a fake booking confirmation.
- The property stops responding or the offer disappears.
- No matching reservation can be found through the official booking details or support.
How a post-booking scam usually works
The attacker impersonates the property or booking platform and claims you will lose the reservation unless you act immediately.
Real reservation
You booked normally and the reservation is active.
Obtained information
The offender knows the hotel, dates, price or booking number.
Convincing message
The message imitates the hotel or Booking.com. A compromised property account may even be used to send it within the platform.
Time pressure
It says the booking will be cancelled or payment has failed.
Fake website
The link imitates Booking.com or the hotel’s payment interface.
Misuse of information
The offender obtains a card, password or authorised payment.
How the suspicious request may arrive
A message may appear to continue a genuine conversation with the property. Do not judge authenticity by the channel alone.
Booking conversation
A compromised accommodation account may send convincing messages within the platform’s booking chat.
The offender poses as the hotel and demands urgent verification or payment.
The message uses a logo, booking details and a link to a fake site.
Text message
A short message threatens cancellation and demands that you open a link immediately.
Phone call
The caller creates pressure, confirms booking details and directs you to pay or enter a card.
What a fraudulent request often claims
Wording varies. Watch for unexpected changes to payment terms and pressure to act quickly.
Verify your card
The card supposedly needs a temporary check and no money will allegedly be taken.
Confirm within 24 hours
A short deadline is meant to stop independent checking.
Payment failed
You are told to enter the card again or repeat the transaction.
The booking will be cancelled
The message creates fear of losing the stay or money already paid.
Part of the price is missing
The offender claims that only a deposit or part of the stay was paid.
Security deposit
A new fee is presented as a refundable deposit, verification or booking protection.
Agreed payment versus a fraudulent additional request
Not every deposit or direct payment to a property is fraud. It should match the booking confirmation and the method agreed in advance.
Payment matching the reservation
- Included in the booking confirmation.
- Amount, currency and due date match.
- Deposit, cancellation terms and extra charges match.
- Uses the official website, app or previously stated payment method.
- No unexpected account change or pressure.
Suspicious payment request
- Arrives later through an external link.
- Account or payment terms differ.
- Threatens immediate cancellation.
- Requests full card details again.
- Moves communication outside official channels.
- The link goes to an unfamiliar domain or payment page that cannot be independently verified.
booking.com
booking-confirmation-payment.example
How to check the message without using its link
Handle new demands outside suspicious correspondence. Open the reservation and support directly through the official app or known website.
Do not open the supplied link
It may lead to a fake payment page even when the message includes genuine reservation details.
Open the booking yourself
Use the official Booking.com app or type the known website address yourself.
Compare the payment terms
Check amount, currency, date, deposit, cancellation rules and payment method.
Contact the hotel and support independently
Call the hotel using a number found outside the message. Open customer support directly in the app or official site.
When to stop payment or data entry
One sign alone may not prove fraud. Unexpected changes, urgency and an external link together are a strong reason to verify first.
Threat of cancellation
The booking supposedly expires within hours.
Immediate payment
You are given no time to contact the hotel or support.
Unfamiliar domain
The link only imitates Booking.com’s name.
Full card details
The page asks again for the card number, CVC and approval.
Different bank account
Bank details do not match the booking confirmation.
WhatsApp or text message
A sensitive payment request arrives outside the agreed process.
Different amount or currency
The new request differs from the original reservation.
Unusual payment method
Gift cards, cryptocurrency or an unexpected transfer.
What to do after a suspicious booking or payment request
Respond according to whether you only received the message, opened a page, entered a card or password, or already sent money.
I only received a suspicious message
- Do not click the link.
- Document the message and sender.
- Open the reservation directly in the Booking.com app.
- Contact the hotel through independently found contact details.
- Report the suspicious communication to official support.
I opened the page but entered nothing
- Close the page.
- Do not download anything or grant permissions.
- Keep the exact URL without opening it again.
- Check your downloads.
- Verify the reservation directly through your booking details or support.
I entered payment card details
- Contact your bank immediately using its official number.
- Block the card as instructed by the bank.
- Check transactions and ask the bank about replacing the card.
- Contact official Booking.com customer support.
- Do not follow another request to repeat the payment.
I entered my Booking.com password
- Change it through the official app or website from a safe device.
- Enable two-factor authentication where available.
- Check bookings, personal information and account changes.
- Change the password on other services if reused.
- Report the concern to official support.
I approved a payment or sent a transfer
- Contact your bank immediately.
- Ask whether the payment can be stopped or disputed; recovery is not guaranteed.
- Send no further money.
- Keep the recipient, amount, time and transaction confirmation.
- Contact Booking.com and the accommodation independently.
- Report financial loss to local police.
I cannot find the reservation
- Check the official confirmation, account and any guest-booking details; absence from an account alone is not proof of fraud.
- Contact official customer support.
- Verify the hotel through its own official website.
- Keep the offer, confirmation and payment details.
- If you sent money and suspect fraud, contact your bank and local police.
Act quickly after sharing card details or approving payment
End the conversation, approve nothing further and contact your bank through an official independent channel.
What to keep
Limit further harm first. Then preserve information that may help your bank, Booking.com, the property or police.
Original correspondence
Message, email, WhatsApp, text, phone number and contact time.
Fake website
Exact URL, screenshot, domain name and requested information.
Booking details
Hotel, dates, price, booking number and original terms.
Payment request
Screenshot of the amount, currency, account, payment page or recipient.
Transaction information
Amount, time, recipient, bank account and payment confirmation.
Verification with the hotel and support
Correspondence with the property and official Booking.com support’s response.
Booking-related scams — FAQ
Can a message with correct booking details still be fraudulent?
Yes. Phishing can include the exact hotel, dates, price and booking number. Verify the payment terms and destination through independent official contacts.
Can it look like a message from the property?
Yes. The offender can impersonate the hotel or use a compromised property account. Verify any new sensitive request with the hotel and official support independently.
Does Booking.com request card verification through WhatsApp?
Booking.com’s safety guidance warns against sharing card information through email, calls, texts or WhatsApp requests. Use official support if uncertain.
How can I verify a payment address?
Do not use an unexpected message’s link. Open the reservation in the official app or website and compare the agreed payment terms; ask official support about anything unfamiliar.
What if the hotel genuinely needs a deposit?
A deposit can be legitimate when it matches the property’s stated conditions and booking confirmation. Verify any new or different request first.
What if I only opened the link?
If you entered, downloaded and approved nothing, close the page, check downloads and verify the reservation independently.
What if I entered a card or password?
For card details, call your bank immediately. For a password, secure the account through the official site, enable available two-factor protection and contact Booking.com support.
Where can I report the communication?
Official Booking.com support, the property, your bank and local police where appropriate. You can also send a report to DPP.
Received a fake booking or payment request?
Keep the message, domain, hotel, booking details and payment request. Reporting to DPP does not replace contacting your bank, Booking.com or police. DPP’s form is currently in Czech.