Scam alertGlobal
“Your Card Could Not Be Verified” — the Fake Message Inside Your Real Hotel Booking
Posted 28 Oct 2026
This one is unusually convincing because nothing about it is fake except the link. You booked a real hotel. The message arrives in the real booking thread on Booking.com or a similar platform, from the property’s own account, with your name, your dates, and your room type. It says your card could not be verified and the reservation will be cancelled within 24 hours unless you confirm your payment details.
Behind it, criminals have taken over the hotel’s account on the booking platform — usually by sending staff malware disguised as a guest complaint or a request with “photos” attached. Once inside, they can see every upcoming reservation and message each guest directly, through the channel the guest trusts most.
The link leads to a convincing payment page, often branded to match the platform. Card details entered there are used or sold within hours, and some victims are asked to “confirm” with a one-time code, which authorises a real payment.
Holiday booking season is when this peaks: a lot of reservations, a lot of anxious travellers, and plenty of hotels short of staff to notice their account is being misused.
What to Do
- Do not click a link to verify, re-confirm, or re-enter card details — even inside the official app, and even from the hotel itself. Booking.com says it will never ask for card details this way.
- Check your reservation in the booking app or website directly. If there is a genuine payment problem, it will show there.
- Call the hotel on a number from its own website or a map listing — not one from the message — and tell them their account is sending this.
- Report the message to the platform’s support from inside the app, so it can lock the property account and warn other guests.
- Already entered your card? Call your card issuer now, have the card cancelled and replaced, and dispute any charges. Never read out or enter a one-time code to “confirm”.
- Report it — reportfraud.ftc.gov and ic3.gov in the US, Action Fraud in the UK, 1930 / cybercrime.gov.in in India, Scamwatch in Australia.