# Fake Booking.com reservation emails and messages: how to tell if your booking is at risk

URL: https://iblockspam.com/blog/fake-booking-com-reservation-phishing
Last updated: 2026-11-02
Published: 2026-11-02
Topic: Phishing & threats
Author: iBlockSpam Team

> How fake Booking.com reservation messages steal card details, what Booking.com says it never asks for, how to check a booking and what to do if you paid.

## Short answer

A fake Booking.com reservation message claims your booking will be cancelled unless you re-enter card details or pay through a link. Booking.com says it never asks for card details by email, phone, text or WhatsApp. Don't click. Open the Booking.com app or website yourself, check the booking and its payment policy, and contact Customer Service there.

"Your reservation will be cancelled within 24 hours unless you verify your card." Messages like this reach travelers by email, text, phone and WhatsApp, and they often name the right hotel, dates and price. They're designed to make you pay twice or hand over your card. This guide shows how to check any Booking.com message, what Booking.com says it never asks for, what to do if you already paid, and how hotels and businesses should respond.

## What is a fake Booking.com reservation email?

A fake Booking.com reservation email is a phishing message that pretends to come from Booking.com or from the property you booked. It says there's a problem with your reservation, such as a failed card check or an unconfirmed payment, and asks you to "verify" or "re-confirm" through a link. The link leads to a fake payment page that captures your card details.

Booking.com describes the pattern on its [traveler safety page](https://www.booking.com/trust_and_safety/travellers.html). It says phishing messages "most often claim to come from the accommodation or sometimes even Booking.com", "include convincing details about the dates and cost of your stay", and "typically come with urgent requests to (re)share payment information in order to retain your booking." It also notes these messages arrive through channels like WhatsApp, phone and email, not only email.

### Common versions of the lure

| Lure | What it says | What it wants |
|---|---|---|
| Card verification | "Your card could not be verified. Confirm it within 24 hours or your booking is cancelled." | Card number, expiry date, security code |
| Prepayment request | "The property requires prepayment. Pay here to keep your room." | A second payment for a booking you already have |
| Bank transfer | "Our card terminal is down. Please pay by bank transfer to this account." | A transfer to the criminal's account |
| Account security | "Unusual activity on your Booking.com account. Sign in to secure it." | Booking.com password |
| Refund or discount | "You're owed a refund. Enter your card to receive it." | Card details |

### Example of a fake Booking.com payment message

This is an **example** written for this guide. It is not a real Booking.com message.

```
From: Booking.com Reservations <reservations@booking-confirm-guest.com>
Subject: Action required: reservation 4182XXXXXX at Hotel Marina

Dear Guest,

Your reservation at Hotel Marina (12–15 March, 3 nights,
EUR 486.00) could not be guaranteed because your card
failed our security check.

To avoid automatic cancellation, please verify your card
within 12 hours:

[ Confirm payment ]

After this period the property may release your room.

Booking.com Customer Support
```

The giveaways: a domain that isn't Booking.com's, a short deadline, and a request to re-enter a card. Notice that it includes believable dates and a price. As Booking.com warns, those details don't make it real.

## How do I know if a Booking.com email is real?

Open the Booking.com app or type booking.com into your browser, sign in, and look at the reservation yourself. Check the payment policy in your booking confirmation. If the app shows no problem and the message asks for a payment or card details the policy doesn't mention, it's a scam. If you're unsure, contact Booking.com Customer Service from its [help center](https://secure.booking.com/help.html), not from the message.

Booking.com's own tips on recognizing phishing are short and specific ([Booking.com](https://www.booking.com/trust_and_safety/travellers.html)):

- "We'll never ask you to share credit card details by email, over the phone, through text or WhatsApp."
- "We'll never ask you to make a bank transfer that is different from the payment policy details in your booking confirmation."
- If an email appears to come from the property or Booking.com, double-check the details in your booking confirmation before clicking any links.
- If in doubt, contact Customer Service before taking any action.

Booking.com's traveler page doesn't publish a list of its sender addresses, so the request matters more than the address. Check the address anyway, because an obvious lookalike settles the question quickly; our guides to [display name spoofing](https://iblockspam.com/blog/display-name-spoofing) and [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing) explain the tricks.

### Real vs fake Booking.com messages

| Check | Real Booking.com or property message | Fake message |
|---|---|---|
| Asks for card details by email, text, phone or WhatsApp | Never, per Booking.com | Almost always |
| Asks for a bank transfer outside your confirmation's payment policy | Never, per Booking.com | Common |
| Asks for gift cards | Never, per Booking.com | Sometimes |
| Visible when you open the booking in the app | Yes | No, or doesn't match the policy |
| Deadline threatening cancellation | Rare | Common |
| Support asks for your password | No; only reservation ID and/or PIN | Often |

## Can a fake Booking.com message come through WhatsApp or text?

Yes. Booking.com says phishing reaches travelers "through channels like WhatsApp, but also phone or email", and that any attack that results in the compromise of traveler data "may be used for fraud such as phishing" ([Booking.com](https://www.booking.com/trust_and_safety/travellers.html)). So a message about your real booking, with real details, can arrive on a channel you didn't expect. Our guide to [phishing vs smishing vs vishing](https://iblockspam.com/blog/phishing-vs-smishing-vs-vishing) explains the text and phone versions.

The rule doesn't change with the channel. A request to pay outside the payment policy in your confirmation, or to share card details, is a reason to stop and contact Customer Service. Booking.com says no legitimate transaction, such as a payment or reservation change, "will ever need you to pay specifically with gift cards" or to give card details by phone, text message or email.

## What should I do if I clicked or paid?

Booking.com's guidance under "I clicked on a link. Now what?" is clear: contact Customer Service immediately and report that you may have been scammed, so the information reaches its security team ([Booking.com](https://www.booking.com/trust_and_safety/travellers.html)).

### Do this now

1. **Call your bank or card provider.** Booking.com advises asking them to block your current cards and issue new ones. Ask about disputing any payment you made to the scammer.
2. **Contact Booking.com Customer Service** through the app or [help center](https://secure.booking.com/help.html) and say you may have been scammed.
3. **Reset your Booking.com password** and turn on two-factor authentication in your account's Security settings. Booking.com says 2FA sends a verification code to your mobile device before granting access.
4. **Watch your statements** and flag unrecognized charges to your bank right away.
5. **Report it.** In the US, report the scam to the FTC at ReportFraud.ftc.gov, as the [FTC's phishing guidance](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams) recommends.

If you typed a password that you also use elsewhere, change it everywhere. Our checklist for [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link) covers the device side, and [how to report a phishing email](https://iblockspam.com/blog/report-phishing-email) lists where reports go.

## How are hotels targeted with fake Booking.com emails?

Hotels and rental hosts face a different version: fake Booking.com messages aimed at the staff who manage the property's account. Microsoft Threat Intelligence documented a campaign, starting in December 2024, that impersonated Booking.com with lures such as "negative guest reviews, requests from prospective guests", online promotion opportunities and account verification ([Microsoft Threat Intelligence](https://www.microsoft.com/en-us/security/blog/2025/03/13/phishing-campaign-impersonates-booking-com-delivers-a-suite-of-credential-stealing-malware/)).

The link led to a fake CAPTCHA over a Booking.com-style background that told staff to open the Windows Run window and paste a command. That technique is called ClickFix; see our [ClickFix fake CAPTCHA guide](https://iblockspam.com/blog/clickfix-fake-captcha-emails). Microsoft says the resulting malware payloads "include capabilities to steal financial data and credentials for fraudulent use." When a property's own login is stolen, messages that seem to come from that property become much harder to doubt.

The defenses for staff are covered in our guide to [email security for hotels and hospitality](https://iblockspam.com/blog/email-security-for-hotels-hospitality). In short:

1. **Open the extranet from a bookmark**, never from an email link, and check whether the complaint or request exists there.
2. **Never run a command a web page asks you to paste.** No real verification page asks for that.
3. **Turn on two-factor authentication** for every person who signs in to the property's account, with one login per person.
4. **Don't take card numbers by email.** The PCI Security Standards Council says PCI DSS Requirement 4.2.2 prohibits sending unprotected card numbers through end-user messaging such as email, chat and SMS ([PCI SSC FAQ 1085](https://www.pcisecuritystandards.org/faq/articles/Frequently_Asked_Question/can-unencrypted-pans-be-sent-over-e-mail-instant-messaging-sms-or-chat)). That also means a guest should never be asked for one.

## What should a business admin do about fake Booking.com emails?

Fake Booking.com emails reach any company whose staff travel, and travel bookers and executive assistants handle many reservations. When one is reported:

1. **Find every copy.** Search by sender domain and subject with [Microsoft 365 message trace](https://iblockspam.com/blog/microsoft-365-message-trace) or [Google Workspace email log search](https://iblockspam.com/blog/google-workspace-email-log-search), and remove them; see [removing a phishing email from all mailboxes](https://iblockspam.com/blog/remove-phishing-email-from-all-mailboxes-microsoft-365).
2. **Block the sender and link domains.** Don't block Booking.com's own domain, or you'll lose real confirmations.
3. **Find out who entered card details.** Company cards used on a fake page should be cancelled through the card issuer the same day.
4. **Reset any password** typed into a fake page, and check that mailbox for the [signs of a compromised account](https://iblockspam.com/blog/signs-email-account-compromised).

To check where a suspicious message really came from, paste its headers into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). An MX-level inbound filter that checks for phishing, spoofing and lookalike senders, with a quarantine each user can review, stops many of these before staff see them; our [small business email security page](https://iblockspam.com/solutions/small-business) explains how that layer works.

## Next steps

1. Share the one rule: Booking.com never asks for card details by email, phone, text or WhatsApp, so check every payment request in the app.
2. Turn on two-factor authentication for your Booking.com account, and for every staff login if you run a property.
3. Keep your bank's card-blocking number where you can find it while traveling.
4. Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on your own domain, and if travel and booking scams keep reaching staff, see how iBlockSpam protects [small business email](https://iblockspam.com/solutions/small-business).

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Does Booking.com ever ask you to confirm your card details by email?

No. Booking.com's traveler safety page says "We'll never ask you to share credit card details by email, over the phone, through text or WhatsApp." It adds that no legitimate payment or reservation change requires gift cards. A message asking you to re-enter card details to keep a booking is a scam, even if it names your hotel and dates.

### Why does a fake Booking.com message know my hotel and dates?

Booking.com warns that phishing messages often claim to come from the accommodation and "include convincing details about the dates and cost of your stay". Knowing your booking is not proof the message is genuine. Judge it by what it asks for: a new payment, a card number or a different bank account means stop and check in the app.

### What should I do if I paid through a fake Booking.com link?

Call your bank or card provider straight away, ask them to block the card and issue a new one, and dispute the charge. Then contact Booking.com Customer Service through its help center, reset your Booking.com password and turn on two-factor authentication. Watch your statements for further unrecognized charges and flag them quickly.

### Does Booking.com customer service ask for my password?

No. Booking.com says its Customer Service representatives will only ask you to share your reservation ID and/or reservation PIN, and that you shouldn't be asked for your Booking.com password or sensitive financial information such as your credit card number. Anyone asking for those is not genuine support.

### How do hotel staff spot a fake Booking.com guest complaint?

Open the extranet from a bookmark and check whether the complaint or request exists there. Microsoft documented a campaign that used fake guest reviews and booking requests to lead hotel staff to a fake CAPTCHA, which told them to paste and run a command. No real Booking.com page asks you to run anything in Windows.

## Sources

- [Booking.com: Safety tips for travelers (how to recognize phishing)](https://www.booking.com/trust_and_safety/travellers.html)
- [Booking.com Customer Service help center](https://secure.booking.com/help.html)
- [Microsoft Threat Intelligence: Phishing campaign impersonates Booking.com, delivers a suite of credential-stealing malware (March 2025)](https://www.microsoft.com/en-us/security/blog/2025/03/13/phishing-campaign-impersonates-booking-com-delivers-a-suite-of-credential-stealing-malware/)
- [FTC: How to Recognize and Avoid Phishing Scams](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)
- [PCI Security Standards Council FAQ 1085: Can unencrypted PANs be sent over e-mail, instant messaging, SMS, or chat?](https://www.pcisecuritystandards.org/faq/articles/Frequently_Asked_Question/can-unencrypted-pans-be-sent-over-e-mail-instant-messaging-sms-or-chat)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/fake-booking-com-reservation-phishing (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt