The vacation season traditionally becomes a peak time not only for tourists, but also for scammers. One of the most dangerous schemes in recent years targets users of hotel booking services. What makes it particularly dangerous is that the scammers’ message may arrive through an official communication channel and contain real details about your trip.
Mechanics of the Scam: From Hacking a Hotel System to Stealing Money
- Hacking the Hotel System: Scammers gain access to the hotel's operational system, which employees use to manage bookings on Booking.com. As a result, the criminals can see real customer data: names, selected hotels, dates of stay, and other information.
- A Convincing Message: After gaining access to this data, the scammers send the customer a message through Booking.com's built-in chat, meaning that it appears to come directly from the hotel via an official communication channel. The message states that an error occurred while verifying the bank card and that the reservation may be canceled unless the customer urgently confirms their payment details.
- A Fake Payment Page: The link leads to a website visually indistinguishable from the real Booking.com - featuring the same room photos, identical branding, and sometimes even fake notifications claiming that "nearby hotels are fully booked."
- Theft of Money: As soon as the victim enters their bank card details, the information goes straight to the scammers and can be used to drain their funds.
A Crucial Detail
The official communication channel is precisely what makes this scheme so dangerous: messages arrive directly within the actual Booking.com app and contain the exact dates and details of your trip, making them far more convincing than a standard scam message.
Urgency serves as an additional pressure tactic. You are told that your reservation will be canceled immediately and that almost no rooms are left. Fearing the loss of their long-awaited vacation, the victim enters their details before even having a chance to double-check the link.
Legal Trap
If a user manually enters their card details on a phishing page and then confirms the transaction with a one-time SMS code, banking systems view the payment as authorized by the cardholder. Blocking the transaction or recovering the stolen funds in such situations is extremely difficult.
IDBank recommends:
- Do not follow links contained in booking emails or messages. Open Booking.com only via the official app or by manually typing the web address into your browser.
- Check the website address. The legitimate domain is booking.com. Any variations involving hyphens or extra words are a red flag for fraud.
- If in doubt, call the hotel directly. Do not continue communication through the built-in Booking.com chat: if the system has been hacked, that is precisely where scammers are reading the messages.
- Never re-enter your card details for "verification." Legitimate booking services never ask you to confirm a card already linked to your account via a link in a message.
- If you have already entered card details on a suspicious site, contact your bank immediately: prompt card blocking may prevent unauthorized withdrawals.
Remember: A professional-looking email and a familiar interface are no guarantee of authenticity. Do not let the fear of losing your hotel reservation drive you to lose your money. Your vigilance is your best protection, even during the peak vacation season.
THE BANK IS SUPERVISED BY THE CBA
