What do these messages look like?
They arrive by email, text, WhatsApp or phone call, supposedly from the hotel or the booking platform. In 2026 two European bodies described two versions in detail:
- Confirmation demanded: in July 2026, INCIBE, Spain's national cybersecurity institute, warned of messages, mainly on WhatsApp, in which criminals pose as hotels. The reservation supposedly has to be confirmed via a link or it will be cancelled. The fake page then asks for personal or payment details.
- Refund offered: in September 2026, Austria's Watchlist Internet described an email claiming a hotel had charged the local tourist tax and a service fee twice. A button, or a QR code in an attachment, leads to a fake portal showing real details of the stay. There you are asked to log in with your online banking details.
Why are the hotel name and booking number right?
According to INCIBE, the criminals have genuine details such as the property, the dates, the guest's name or the booking number. In the Austrian case, Watchlist Internet believes the data probably came from a leak at booking.com. Switzerland's National Cyber Security Centre (NCSC, known in German as BACS) names data breaches in its semi-annual report 2026/1 as one way criminals approach victims.
So genuine booking details do not prove a message is genuine. Nor does a name or logo, INCIBE points out. In the Austrian refund email, the sender name showed the hotel, but the address did not belong to the business.
An example: the refund email after a city break
Fictional example: Ciarán from Galway spent three nights in Salzburg and paid by card at checkout. A week later an email arrives in the hotel's name: the local tourist tax had been charged twice and would be refunded. It quotes his booking number and dates, and has a "Confirm refund" button and a PDF with a QR code.
Ciarán does not scan the code. In the booking platform's app he sees nothing about a refund. He calls the hotel on the number from its own website, and the front desk knows nothing about a double charge. Ciarán forwards the email to the hotel, reports it and deletes it.
How can you check the message without tapping the link?
- Do not reply, tap any link or button, or scan any QR code in the message.
- Open the platform's app or website yourself, never via the message. Check the status of your booking and whether any payment is outstanding.
- Call the hotel on the number from its official website, not the one in the message. Watchlist Internet notes that a call to the real hotel clears things up quickly.
- Compare the sender and link address with the official channels of the hotel and platform. An unfamiliar domain is a clear warning sign.
- Take a screenshot, report the message and only then block the sender.
Tip: Save the booking confirmation and the hotel's website when you book, so the real phone number is to hand. More in Before you travel: prepare your digital access.
How can you tell the payment request is fake?
| The message… | Why that proves nothing | How to check |
|---|---|---|
| quotes the hotel, dates and booking number | criminals may hold real booking data, for example from a leak | open the booking yourself in the app |
| shows the hotel's name or logo | names and logos are easy to fake | compare sender and number with the hotel's website |
| threatens cancellation | time pressure is meant to stop you checking | call the hotel yourself |
| offers a refund via a button or QR code | the fake portal wants your online banking login | ask the hotel whether a refund is due |
| asks for card details, a login or a code | in the Austrian case the code approved a payment to the criminals | enter nothing |
To receive money you normally do not have to approve anything. How to read your bank's confirmation requests is explained in Banking app approval request.
What should you do if you have already entered details?
- Call your bank or card issuer straight away and explain what happened.
- Change your online banking password if you still can, and watch your account closely for the next few weeks.
- Report it to the police, with screenshots, the sender, the link and any payment records.
- Stay alert: according to Watchlist Internet, whoever has your contact and bank details may try again with another scam.
If you only opened the page and entered nothing, INCIBE says it is enough to close it and not go back. Full steps are in Card details entered on a suspicious site. Getting money back depends on the individual case; this page is not legal advice.
Where can you report the message in six European countries?
| Country | Report the message | If you lost money or data |
|---|---|---|
| Germany | Forward phishing emails to phishing@verbraucherzentrale.nrw (consumer centre's Phishing-Radar) | Call your bank; report to the police |
| Austria | Watchlist Internet's reporting form | Call your bank; report to the police |
| Switzerland | NCSC/BACS online reporting form | Call your bank; report to the police. Not in the EU: EU payment rules do not apply automatically |
| France | Signal Spam for emails, 33700 for texts; Info Escroqueries 0 805 805 817 (free, weekdays 9:00–18:30) | Block your card with your bank at once; complaint to police or gendarmerie |
| Italy | Police; not required for a refund, but according to the Banca d'Italia it helps fight fraud | Bank: dispute the payments and claim a refund; if it refuses or does not respond to the dispute within 15 working days, you can go straight to the Arbitro Bancario Finanziario (ABF) |
| Spain | INCIBE's fraud reporting form; free 017 helpline | Contact your bank; report to the police |
Also tell the hotel and the platform through their official customer service.
Common mistakes
- Trusting the message because the booking number and dates are right.
- Calling back on the number in the message instead of the one on the hotel's website.
- Tapping the link for fear of cancellation instead of checking the booking in the app.
- Logging in to online banking and confirming a code to receive a supposed refund.
- Waiting after entering card details instead of calling the bank straight away.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
The message knows my booking number. Does that make it genuine?
No. According to INCIBE, Spain's national cybersecurity institute, criminals have real details such as the name of the property, the dates of the stay, the guest's name and the booking number. That is exactly what makes the message believable. Rely only on what you see in your booking in the app, or on what the hotel confirms when you call its official number.
Can a hotel ask for money after I have booked?
Depending on the booking, you pay in advance, on arrival or by deposit. What applies to you is in the confirmation and in the booking in the app. If a message asks for an extra payment or a fresh card check, verify it there and ask the hotel on a number you have looked up yourself. Never pay through a link in the message.
I tapped the link but did not enter anything. What now?
According to INCIBE, it is enough to close the page and not open it again. Check your booking in the app as usual and report the message. If you downloaded something or installed an app after tapping, read Opened a suspicious link and work out what actually happened on your device.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- INCIBE (Spain): Criminals pose as hotels on WhatsApp to 'confirm' bookings (alert of 31 July 2026, in Spanish)Source review date:
- Watchlist Internet (Austria): Fake refund for a double-charged tourist tax (in German)Source review date:
- Swiss NCSC/BACS: Semi-Annual Report 2026/1Source review date:
- Verbraucherzentrale (Germany): Phishing-Radar (in German)Source review date:
- Cybermalveillance.gouv.fr (France): Phishing – what to do (in French)Source review date:
- Banca d'Italia: Scams in payments – how to protect yourself (in Italian)Source review date:
