Scam library · Email & phishing · Shopping · Texts
Hotel booking phishing message
You've booked a hotel through a major travel site. A message arrives in the app's chat or your email: 'Your card could not be verified. Please confirm your payment within 12 hours or your reservation will be cancelled.' The link opens a page that looks like the booking site.
The message may really come through the booking platform, because the hotel's own account was hacked. The payment page is fake, and the card details go to scammers.
What the message looks like
From: Message in your booking app from 'Hotel Bayview Reception'
Dear guest, your card could not be verified for your stay on May 14-17. Please confirm your payment within 12 hours or the reservation will be cancelled.
Confirm here: booking-guest-verify[.]com/res/88213
How this scam works
Security researchers and booking platforms have reported campaigns where criminals phish hotel staff, take over hotel accounts on booking sites, and then message guests with real reservation details. Because the message includes your name, dates and hotel, it feels completely legitimate.
The fake page asks for your full card number, expiry and security code, and sometimes a one-time code from your bank. That code may actually approve a payment to the scammer.
Email versions copy booking confirmation designs and use lookalike domains. Text versions claim to be from the hotel and ask you to confirm by clicking a link.
Real booking sites handle payment through their own checkout, and the hotel can charge the card you already provided. If there's truly a problem, the booking site will show it in your reservation details in the app.
When in doubt, call the hotel using the phone number on its official website, not the number in the message, and ask whether there's any issue with your booking.
Travelers are often busy and on the move when these messages arrive, which makes a quick tap tempting. Taking two minutes to check in the app avoids a much longer problem with your bank.
Red flags
- Requests to 're-verify' a card after booking.
- Deadlines of a few hours before cancellation.
- Links to pages outside the booking site's domain.
- Requests for one-time codes from your bank.
- Messages that feel off even though they include real details.
How to tell it’s fake
- Check your reservation status directly in the booking app or website.
- Call the hotel using the number on its official site.
- Look carefully at the domain of any payment link.
- Never enter a bank code to 'verify' a card.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- Don't click. Report the message to the booking platform.
If you paid
- If you entered card details, call your card issuer right away to block the card and dispute charges.
If you shared personal info, a password or a code
- If you shared other personal details or a code, watch your accounts closely.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard in Chrome and Edge on your computer checks booking messages and the pages they lead to. It spots fake payment pages that copy travel sites, even when the message looks like it came from a real hotel. If a request seems legit, a scam expert can check it before you pay.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- Can a message in the real booking app be a scam?
- Yes. Hotel accounts can be hacked. Check the link before paying.
- Do hotels ask to re-verify cards?
- Rarely through outside links. Check in the app or call the hotel.
- I entered my card. What now?
- Call your card issuer to block the card.
- What's the safest way to pay?
- Through the booking site's own checkout.