The Hotel Booking Scam That Knows Your Real Reservation

In October 2026, scammers used stolen hotel booking data to send messages with guests' real reservation details. Here is how it works and how to stay safe.

1. The breach

RMS Cloud, booking software used by hotels, motels and holiday parks, confirmed that guest names, contact details and booking information were accessed. It says card and payment details were not.

2. The message

WhatsApp, SMS or email quoting your genuine booking (hotel, dates, reference number) and asking you to confirm payment within 24 hours or lose the room.

3. The trap

The link opens a page that looks like Booking.com, showing your room, with a chat window telling you not to close it. Entering a card hands it to the scammers.

4. It's not just one company

Travellers report the same scam with Booking.com, Agoda and Trip.com bookings.

5. What to do

Don't click or pay. Call the hotel using the number on its official website. If you entered a card, call your bank right away.

Sources

The Nightly (October 29, 2026), The New Daily and Cyber Daily.

FAQ

If they know my booking, isn't it real?

No. The details were stolen. Real hotels don't ask you to re-enter your card through a WhatsApp link with a countdown.

Was my card stolen in the breach?

RMS says card and payment details were not accessed; the risk is typing your card into the scam page.