A hotel message can include your real name, travel dates and reservation number — and still be a scam. Recent attacks involving hotel booking data have shown how criminals can use accurate reservation information to send convincing payment-verification requests through email, SMS and WhatsApp. The practical rule for travellers is simple: do not verify a booking by following a link in an unexpected message. Open your original booking app or call the property using a phone number you independently find.
Sources checked: 3 November 2026. AI-generated feature image is a conceptual hotel reception and smartphone warning, not a photograph of a real hotel, person or scam message. This article provides general travel and cybersecurity guidance.
On this page
What happened in the Australian hotel-booking scam?
Australian travellers have been targeted following unauthorised access to reservation data involving RMS, a third-party hotel booking technology provider. In its 28 October incident advisory, RMS confirmed that guest names, contact information and booking details may have been accessed, while payment-card information was not involved, according to its investigation to that point. ABC reporting on 29 October described suspicious messages to Tasmanian hotel guests containing real booking numbers, room types and check-in dates, alongside false claims that payment cards needed urgent verification to prevent cancellation.
Follow-up reporting from Western Australia on 3 November described similar attacks affecting travellers with accommodation booked in the Kimberley region. Guests received messages that seemed convincing because their names and dates matched reservations. RMS said it had contained the unauthorised activity and was investigating its scope; according to the reports, the company said credit-card and payment details were not involved in the breach. That point matters: a criminal can attempt to steal card details later through a fake payment page even if those details were not among the information initially accessed.
This does not mean every hotel or booking platform has been compromised. It also does not mean every message containing accurate booking information originates with the hotel. The latest RMS reports are a specific incident within a broader pattern of reservation-related phishing.
How scammers use genuine reservation details
A typical message arrives after a real reservation has been made. The sender may name the property, arrival date, stay length, guest name or booking reference, then claim that a card was declined, a pre-authorisation failed or the room will be cancelled unless the traveller verifies payment immediately. The link leads to a lookalike page that asks for card numbers, online banking credentials or an authentication code.
That combination — accurate personal details plus urgency — makes the scam hard to spot. Singapore Police warned in October 2026 of phishing messages impersonating hotels and booking platforms, sometimes using legitimate booking information and falsely assuring victims that a card check would not result in a charge. Source: Singapore Police advisory.
Seven warning signs that a hotel message is not trustworthy
- Pressure to act within minutes or hours. The sender threatens immediate cancellation or a large penalty unless you pay.
- An unfamiliar payment link. The URL is different from the address shown in your original booking confirmation, or uses a lookalike domain.
- A WhatsApp or SMS request for card details. A familiar hotel name or profile photo is not proof of identity.
- A request for a one-time security code. Do not give someone your banking or card-verification code to “protect” a booking.
- A payment method outside the agreed booking policy. Unexpected bank transfers, gift cards or cryptocurrency are strong warning signs.
- A different booking reference. Even when the traveller’s dates are correct, secondary identifiers may not match.
- Refusal to let you verify independently. Any sender trying to keep you on its link rather than the hotel’s official contact channel deserves suspicion.
The Australian Signals Directorate’s 2026 cyber-security guidance warns that unexpected contact, urgency, suspicious links and requests for private information can all indicate phishing. A convincing logo or polished writing is not a security guarantee.
What to do if you receive a suspicious hotel message
First, stop. Do not click the link, scan a QR code, call the number inside the message or reply with payment details. A genuine reservation can usually be checked without the sender’s chosen link.
Second, check independently. Open the booking service’s app yourself, sign in and review the reservation and payment conditions. If anything is unclear, call the hotel using a number from its independently located official website or a trusted original confirmation. Ask whether it sent a new payment request and what payment process your original booking allows.
Third, preserve evidence and report. Capture the sender’s number, domain, date and message, then report it to the booking provider, hotel and Scamwatch. Do not forward suspicious links to friends or post your confirmation number publicly.
Can messages inside a legitimate booking app be scams?
Yes. A message displayed in a familiar booking environment should still be checked if it unexpectedly changes your payment instructions. Booking.com’s own traveller-safety guidance warns about phishing messages with accurate dates or prices, and recommends checking reservation details and contacting its support through official channels when in doubt. Its hotel scam guide also advises avoiding requests to pay outside the platform’s documented payment arrangements.
Some genuine properties do have authorised deposits or pre-arrival payment rules. The safe test is not simply whether any payment is requested; it is whether the request matches the terms you agreed to and can be independently verified. Never assume a new, urgent link is authorised just because you booked the property.
Already clicked, entered card details or sent money?
If you entered card information, contact your bank or card provider immediately, request a block or replacement and ask about disputing unauthorised transactions. If passwords or account logins were shared, change them using the official app and enable multi-factor authentication. Monitor booking, bank and email accounts for further suspicious activity. Scamwatch’s recovery guidance explains these steps and identifies IDCARE as a free identity and cyber-support service; its Australian number is 1800 595 160.
If you only opened the link and did not enter anything, close the page, avoid downloads and consider checking your device and account security. If you installed software or supplied authentication codes, contact the relevant provider urgently. Recovery steps depend on the information exposed; avoid anyone promising an instant guaranteed refund.
A quick safety checklist before every trip
- Keep the original reservation, payment rules and booking reference in a secure place.
- Use the official booking app rather than links sent unexpectedly after the reservation.
- Confirm any unfamiliar prepayment request directly with the accommodation.
- Enable multi-factor authentication for your primary email and travel booking accounts.
- Consider bank alerts for card transactions and check statements during travel.
- Do not publish screenshots containing full names, contact information or reservation numbers.
- Share basic phishing precautions with family members travelling together.
How this connects to finding better hotel deals
Comparing prices and booking conditions can save money, but a cheap room is not a bargain if a fraudulent payment link steals your card details. For legitimate ways to compare room rates and cancellation terms, see our NextNews hotel-pricing and travel-deals guide.
Have you ever received an unexpected hotel payment-verification message? What made it look real — and how did you check it? Share your experience without posting personal reservation information.
Sources and disclosure
Sources: RMS primary security advisory, 28 October 2026; ABC Tasmania, 29 October 2026; ABC Kimberley, 3 November 2026; Booking.com official traveller-safety guidance; Booking.com hotel scam guidance; Singapore Police phishing advisory, October 2026; Australian Government cyber-security handbook; Scamwatch recovery guidance and reporting portal.
Disclosure: This article was prepared with AI assistance and checked against the cited sources. It provides general travel and cyber-security information, not a guarantee that a booking or link is safe. The original AI-generated editorial image is illustrative and does not depict an actual hotel guest, screenshot or incident. Cyber incidents and their investigations can develop after publication. See the NextNews website disclaimer for general terms.
More in Travel News
Disclaimer
NEXTNews aims to keep its reporting accurate and up to date. Sources and dates are included where practical; information can change after publication. To flag an error or request a correction, contact our team. For important decisions, check the original source and see our full disclaimer.