Booking.com / Expedia Host or Guest Phishing
Compromised hotel/host accounts (or spoofed platform messages) send guests real-looking 'reconfirm your payment' links that steal card details.
Think a message like this reached you? You can check it right now.
What this scam is
Scammers phish hotel or host accounts on booking platforms, then message guests through the platform's real system saying their payment failed or needs reconfirming, with a link to 'verify your card.' Because the message comes through a genuine booking you made, it's very convincing, but the payment link is a scammer's page that captures your card. Legitimate platforms process payment within the app and won't ask you to re-enter full card details via a chat link.
What it usually looks like
- A platform message that your payment failed or needs reconfirming.
- A link to 'verify your card' to keep the booking.
- Urgency about losing your reservation.
- A convincing message tied to a real booking.
Common warning signs
- Being asked to re-enter full card details via a chat link.
- Payment 'verification' outside the normal checkout.
- Pressure to act to avoid cancellation.
- A payment page whose address isn't the platform's.
Example wording scammers use
“Your payment could not be verified. Confirm your card within 12 hours or your reservation will be cancelled: [link].”
“The property requires payment reconfirmation — please re-enter your card details here.”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- Your full card details.
- To exploit a real booking's credibility.
- A fast, fearful re-entry of your card.
What to do
- Handle all payment inside the platform's normal, official checkout.
- Don't re-enter card details via a chat message link.
- Contact the platform's official support to verify any 'payment failed' message.
- Report the message to the platform.
What to do if you already responded
- Call your card issuer to freeze the card and dispute charges.
- Report to the booking platform.
- Report at reportfraud.ftc.gov.