Fake messages from your accommodation on Booking.com and Airbnb

Why the fake one knows your booking

These messages are convincing because they often carry real details: the name of the property, your dates, sometimes the reservation number. Booking.com's safety page for travellers warns that phishing messages may claim to come from the accommodation, include convincing details about your stay and push you to act quickly, typically asking you to share payment information again to keep the reservation.

Sometimes the message even arrives inside the official app. INCIBE, Spain's national cybersecurity institute, published the case of a traveller who received several notifications in a booking platform's own messaging service with links to confirm the reservation, followed the steps and saw two unauthorised charges on the card. The hotel later told him its account on the portal had been hacked and was being used to message other guests. So the channel proves nothing: a message in the right chat can still come from the wrong person.

What the two platforms say they never ask

Booking.com is specific. It says it will never ask you to share card details by email, phone, text or WhatsApp, never ask for a bank transfer that differs from the payment policy in your booking confirmation, and that no legitimate payment or reservation change needs gift cards. Its customer service only asks for your reservation number and PIN, not your password or card number. It also lists as suspicious any demand to pay within a short deadline and any property that insists on talking outside the platform.

Airbnb's help centre says that all mandatory charges must appear in the price breakdown at checkout, that paying outside Airbnb means losing its AirCover protection, and that a reservation paid by wire or bank transfer may be fraudulent. Airbnb also says it will never call to ask for one-time codes, passwords or payment details, and that urgent messages threatening the loss of a reservation are a warning sign.

Checking it on your phone without the link

• Close the message without tapping anything in it.
• Open the Booking.com or Airbnb app from your home screen, not from the message, and go to the reservation.
• Compare the request with what the booking itself says. On Booking.com, the payment and damage deposit policies of the property are in its House rules; anything outside them is a red flag.
• For an email, look at the full sender address, not the name shown. Airbnb publishes the domains it sends from, all ending in airbnb.com apart from a few survey and support services, and says that anything else is not Airbnb.
• For a link, look at where it goes. Airbnb says a real one starts with https://www.airbnb.com or a country version of it. On iPhone, touching and holding a link shows its address before the page opens.

If you still have doubts, contact the property using a phone number you found yourself on its official website, not the one in the message. INCIBE adds that a logo or a familiar channel is no guarantee, and that a threat to cancel the booking is a reason for more suspicion, not less.

When it arrives on WhatsApp or by text

INCIBE has also warned about criminals posing as hotels on WhatsApp, with real stay details and a link to confirm or validate the booking, and notes that the same trick can arrive by email or phone call. Its advice is not to tap the link, not to continue the conversation, to block the sender and to check the booking only through the official website or app.

On a trip, remember where these messages land. WhatsApp and text messages go to your phone number, which lives on your usual line. A data-only eSIM like the ones Snoozim sells has no number, so a text you receive abroad was sent to your home number, whatever line you use for data. The general patterns of fake parcel, toll and fine texts are in our guide to scam texts while travelling.

If you already paid or typed your card

Act in this order. If you only opened the page and typed nothing, close it and do not go back. If you entered card details, call your bank through its app or the number on the back of the card and ask for the card to be blocked; INCIBE recommends cancelling it. Booking.com also asks you to contact its customer service, reset your password and turn on two-step verification. Airbnb asks you to contact it to secure your account, and has a form for reporting fake websites that imitate it.

Keep evidence before deleting anything: screenshots of the messages, the sender's number, the link and any payment receipt. In Spain, INCIBE recommends reporting it to the Policía Nacional or the Guardia Civil, opening a claim with your bank and, if the bank refuses to refund, going to the Banco de España. Its free helpline, 017, can advise you. Our guides to two-step verification on a trip and bank SMS codes abroad cover the account side.

Three habits for the rest of the trip

Pay and change bookings only inside the app where you booked, and keep the confirmation saved on the phone so you can compare any later request with it; our guide to keeping travel documents offline explains how. Do payments and logins on mobile data rather than on a network you cannot identify, as explained in is public wifi safe.

And keep your usual line switched on, even with its data off, so the genuine codes from your bank keep arriving. A real problem with a payment will always be visible in your reservation inside the app. If it is not there, the message is the problem.