Real Hotel Message vs Hotel Phishing Scam
Tell a genuine hotel/booking message from phishing that wants your card details.
Last reviewed: 1 June 2026
Hotels and booking platforms do message guests, and almost all of it is ordinary: a confirmation, a check-in time, a question about your arrival. Hotel phishing is unusual among scams because the details are frequently correct. Compromised property accounts and breached booking data mean a message can quote your dates, room type, and reference number, and it often arrives inside the same chat thread you have been using all along. The context does the work. You are travelling or about to travel, a payment problem sounds plausible, and losing the room feels worse than re-entering a card number. The distinction that matters most is what is being asked for. A genuine hotel or platform never needs your full card number, your CVV, or a one-time code typed into a link sent by message.
Side-by-side comparison
| Real hotel message | Hotel phishing | |
|---|---|---|
| Card details | Doesn't ask for CVV or codes by message | Asks to 're-verify' full card details/CVV |
| Links | Uses the official app/site | Links to a non-official domain |
| Pressure | No 'verify in 2 hours or lose booking' | Urgent cancellation threats |
| Channel | Visible in your official booking account | Only via email/SMS/chat link |
Common red flags
- Requests for full card details, CVV, or one-time codes
- Links to non-official domains
- Urgent cancellation threats
- Real booking details used to seem genuine
Verification steps
- Open the official app/site and check your booking
- Call the hotel/platform using the number on its official site
- Never enter CVV or codes from a message link
What not to do
- Don't click the link
- Don't enter card details or CVV
- Don't share one-time codes
A safe response
Do not use the link. Open the booking platform's own app, or type the hotel's website address yourself, and see whether any payment issue actually appears on your reservation. If you want to hear it from a person, ring the hotel on the number listed on its official site rather than one in the message, and ask whether they contacted you. Saying you will confirm through the app costs you nothing, and a real property will simply agree. If you have already entered card details or shared a code, contact your bank right away to stop the card, and report the message to the booking platform so they can review the property account.
Frequently asked questions
The message came through the booking platform's own chat. Doesn't that make it safe?
Not on its own. These messages often do arrive in the real chat, because someone else has gained access to the property's account, so the thread, the branding, and your booking details are all genuine. What is not genuine is the request. Judge the message by what it asks you to do, and check any payment issue by opening your booking in the app or ringing the hotel on the number from its official website.
Should I ever pay for a room by bank transfer?
Be careful. Established hotels and platforms take card payments and handle problems through your account, and a request to transfer directly, especially an urgent one, removes the protection a card gives you. If a small independent property genuinely prefers a transfer, confirm it first by phoning the number on their own website, and keep records. If someone in a chat thread pushes for a transfer to avoid a cancellation, treat that as phishing.
But the message had my real booking reference?
Scammers exploit breached booking data, so a real reference doesn't prove a message is genuine. Always verify through the official app or phone number.