The Rise of Hotel Booking Scams on WhatsApp

For hotels and travel brands, the time between a booking and a guest’s arrival is when guests expect to hear from you. Confirmations, check-in details and payment reminders are all a normal part of a stay, and most guests don’t think twice when a message from their hotel comes through.

That expectation is now being used against them. Scammers are messaging guests on WhatsApp while posing as the hotel, and sending them to cloned Booking.com payment pages to “confirm” or “re-pay” for their stay. These campaigns have been reported across Europe and Asia this year, and Australian travellers have received them too. For the hotels being impersonated, the damage lands on their name, even though they had nothing to do with the message.

How the Scam Reaches Guests

The guest has a genuine booking. A few days before arrival, they get a WhatsApp message from a profile using the hotel’s name, and sometimes its logo or photos. The message says the payment didn’t go through, or the booking needs to be verified, and includes a link: “here’s the booking link for our hotel.”

Some of these messages include the guest’s real name, dates and reservation number, which makes them very hard to question. Public reporting has linked this to hotel partner accounts being compromised through phishing, and to booking data being accessed by unauthorised third parties. Booking.com confirmed in April that some booking information had been accessed, and has reminded customers it will never ask for card details by phone, text or messaging apps.

How the Campaign Is Set Up

These campaigns tend to follow the same pattern.

Why It Works

None of these details look unusual on their own, which is what makes the scam effective.

The message arrives when guests expect to hear from their hotel, and it points to a page that looks like a platform they’ve already trusted with their booking. The link includes words like hotel, guest or arrival, so it reads like part of a normal check-in process.

When the message also includes the guest’s real name, dates or reservation number, there’s little reason to doubt it. A short deadline to confirm payment adds pressure and leaves less time to check with the hotel directly.

The Bigger Picture

This isn’t one isolated campaign. In February, researchers at Bridewell described hotel partner accounts being taken over, with guests then messaged on WhatsApp and sent to a fake Booking.com payment page behind a Cloudflare CAPTCHA. In June, HKCERT warned of Booking.com-themed WhatsApp and email messages using genuine booking details. Spanish authorities said in August that the campaign was still active.

In Australia, scams cost people $2.18 billion in 2025, with $97.6 million lost to phishing, according to the National Anti-Scam Centre. Travel scams like this one may not appear as their own category, but they sit squarely within those phishing losses.

Protecting Your Guests and Your Brand

Unphish is a threat detection and disruption platform built to identify and take down phishing, scams and brand impersonation. We monitor for lookalike domains, cloned websites and fake payment pages, along with impersonation profiles across social media and messaging. When a threat is found, our team captures the evidence and works with registrars, hosts and platforms to take it down quickly.

If your hotel or travel brand is being impersonated, book a personalised platform demonstration to see how Unphish can help.