Card details, a code or your passport by message? Stop here
Imagine a text from an unknown number: your card was declined for booking #77104 at Seaglass Inn, please re-enter it within two hours. Or a WhatsApp from the "Refund Team" offering $120 back if you just reply with the six-digit code they sent.
This page walks through three versions of the same trick: getting you to hand over the one thing that lets someone act as you. You'll know what to say no to, and why.
Why careful people still fall for it
Each request sounds small and sensible on its own. Re-enter a card that failed. Read back a code to get a refund. Send ID for faster check-in. You'd do all three for a real company in the right setting.
The difference is the channel. A code, a card number or a passport photo sent by message goes to whoever is on the other end, and that's all they need to empty an account or open a new one in your name.
Three requests that hand over your identity
"Your card was declined, re-enter it within 2 hours"
SMS · +44 7451 902 118Your card was declined for booking #77104 at Seaglass Inn.Re-enter your card within 2 hoursbit.ly/seaglass-pay
- Random mobile number, not hotel
- 2-hour deadline
- Short link hides the address
A random mobile number, a two-hour clock and a short link that hides the address. If a card really failed, the booking site tells you inside your booking and you update it there.
Do this: don't tap the link. Open your booking and look for a payment message from the booking site itself.
"Reply with the 6-digit code to receive your refund"
WhatsApp · Refund Team - Alder HotelGood news! You were overcharged $120 on your last stay.To receive the refund, reply with the 6-digit code we just sent to your phone.Code expires in 10 minutes.
- Surprise refund = bait
- Never share a one-time code
- Rush so you don't think
That code is the second half of your login for some account, often your messaging app or your bank. The "refund" is the bait; the code is the prize.
Do this: never read a one-time code to anyone, for any reason. Real refunds don't need one.
"Send a photo of your passport and a selfie holding your card"
WhatsApp · Check-in Desk - Hotel VelaroHi! For express check-in we need some documents.Please send a photo of your passport (both sides)and a selfie holding your credit card.Reply within 1 hour to keep your room.
- ID photos sent to a stranger
- Card selfie = identity theft
- 1-hour pressure
A passport photo plus a card selfie is a full identity kit. Hotels check ID in person at the desk, where you can see who is looking at it.
Do this: keep your ID for the front desk. If a hotel needs details before arrival, its booking system asks for them, not a chat.
What happens if you go along with it
Say you read back the six-digit code. A minute later you're logged out of your messaging app, and your contacts start getting messages from "you" asking for money. Or, with card details, purchases start within the hour.
Passport photos take longer to bite. They're used to open accounts or pass identity checks weeks later, which is why it helps to act on the day, even if nothing seems to have happened yet.
Real message or fake? Side by side
| Fake | Real |
|---|---|
| Asks you to re-enter or confirm your card by link | Asks you to update payment inside your booking |
| Wants a one-time code read back | Never asks for a code |
| Wants passport or card photos in a chat | Checks ID in person at the desk |
| Unknown number, short link, deadline | Hotel or booking site name, no link to click, no rush |
Take the scam-or-real quizCheck a message you got
If you already clicked or paid
- Typed in card details: call your card provider now, block the card and dispute anything you don't recognise.
- Shared a code: change the password of the account that code belongs to, sign out other devices and turn on two-step sign-in.
- Sent passport or ID photos: keep watch for new accounts in your name and, where your country allows, set up a fraud alert.
- Report the message in the booking app and tell your bank what happened.
Questions people ask
My card really might have failed. How do I check?
Open the booking in the app or site you used. A real payment problem shows there, with a way to fix it in the same place.
Why would a scammer want a code if I haven't given my password?
Many accounts send a code to your phone when someone tries to sign in or reset the password. Giving the code lets them finish taking over.
Do hotels ever ask for ID before arrival?
Some ask for details through their official booking system or online check-in. They don't ask for passport photos or card selfies over WhatsApp.
Is it safe to give my card to the hotel at check-in?
Yes, in person at the desk, and many hotels place a hold for incidentals. The risk is the channel, not the card.
Book where the price is on the page
Rates by Room shows the nightly rate read from the booking partner for 2359 hotels in 91 cities. You pay on the partner's own checkout, with the price in front of you, so there's no message to second-guess.
We earn a commission from the partner when a booking completes. It doesn't change your price.