Is this message from your hotel real?

It's 9:40 on a Tuesday night. Your flight is in three days. Your phone buzzes with a WhatsApp message from "Casa Lumen Reservations". It has your name, your dates, even part of your booking number.

Dear Maria, due to a payment error your reservation will be cancelled at midnight unless you confirm your card using the link below.

The room you spent an evening choosing is suddenly at risk, and you have two hours. That feeling in your stomach is exactly what the message was written to cause.

Here's how this usually goes, why careful people still fall for it, and how to check any hotel message in about two minutes. If you've already clicked or paid, skip straight to what to do now.

On this page: Why it works · Five red flags · Try it yourself · If you already clicked · Questions

Why careful travellers still fall for it

The old advice was to look for bad spelling and a generic "Dear customer". That stopped working. These messages often use your real name and your real dates, and some arrive inside a booking site's own chat after a hotel's account has been taken over. So the message looks right, and it feels right, because the details are true.

What gives it away is what the message asks you to do. Every version leans on the same three levers: a clock that's running out, the fear of losing something you already paid for, and a name you recognise. Once you know the levers, the messages start to look alike.

Five red flags, with examples

1. A deadline you never agreed to

Your reservation will be CANCELLED within 24 hours unless you act now.

A confirmed booking doesn't get cancelled by a chat message with a countdown. The deadline is there so you act before you think. What to do: close the message and open the app or site you booked with. If the booking says confirmed there, it's confirmed.

2. A payment link, a QR code or a "new" bank account

Due to a system update, please transfer the remaining €342 to our new bank account below. Payment must be received today or the room is released.

Hotels don't move their bank account by email, and you never need a link from a chat to pay for a stay. A QR code is the same trick with the address hidden. What to do: pay only on the booking site itself, or at the front desk when you arrive.

3. A request for card numbers, one-time codes or ID photos

To receive your refund, reply with the 6-digit code we just sent to your phone. The code expires in 10 minutes.

That code is your bank's way of confirming that you approve a payment. Whoever has it can spend your money in minutes. The same goes for a photo of your passport or a selfie holding your card. What to do: never send these in a chat, to anyone, for any reason.

4. Being moved off the booking app

Our app chat is unavailable. Please continue on WhatsApp and have your card ready to verify your identity.

Once you leave the platform you booked with, its protection goes with it. A personal WhatsApp number or a "manager's" personal account is a reason to stop. What to do: keep every conversation about money inside the booking app.

5. A sender that doesn't match

A random mobile number, a web address with extra words like "secure-pay" or "verify" bolted onto the hotel's name, or no hotel name at all. What to do: find the hotel's official website yourself, from a search, and call the number listed there. Never the number in the message.

Try it yourself: scam or real?

Read each message and decide before you open the answer.

Message A (email): Thanks, Daniel. Your stay from 14 to 16 November is confirmed. You'll pay at the property when you arrive. You can view or change this booking in the app you booked with.

Show the answer

Real. No link to pay, no deadline, nothing sensitive asked for, and it sends you back to your own app.

Message B (text): Your card was declined for booking #77104 at Seaglass Inn. Re-enter your card within 2 hours using the short link below.

Show the answer

Scam. A random number, a two-hour clock and a short link that hides where it goes. If a card really fails, the booking site tells you inside the app.

Real message or fake? The quick comparison

If you already clicked or paid

Take a breath. Acting in the next hour matters more than how it happened. Do these in order:

1. Stop replying. Don't argue and don't send anything else. Take screenshots of the messages first.
2. Call your bank on the number printed on the back of your card. Ask them to block the card and dispute the payment. Banks move faster the sooner they hear.
3. If you typed a password on the linked page, change that password now, and anywhere else you use it.
4. Tell the booking site through its app, so it can warn the hotel and flag the account that messaged you.
5. Check your booking in the app. In most cases it's still there and still confirmed.
6. Watch your statement for the next few weeks for small test charges.

Questions people ask

Is it safe to pay a hotel over WhatsApp?

No. Pay on the booking site or at the property. A real hotel will never insist on WhatsApp payment.

Can a hotel cancel my booking by text message?

A confirmed booking is cancelled through the booking site, and you'll see it there. A message threatening cancellation unless you pay through a link is the scam itself.

Why does the scammer know my name and dates?

Sometimes a hotel's account on a booking site gets taken over, and the scammer reads real reservations. That's why the details look right. Judge the message by what it asks you to do.

Should I ever pay a deposit by bank transfer?

Only when the booking site itself shows that payment method on the booking page. Never because a message asked you to.

Book where the price is on the page

Rates by Room shows the nightly rate read from the booking partner for 2359 hotels in 91 cities. You book and pay on the partner's own site, with the price in front of you, and nothing ever asks you to pay through a message.

Compare real hotel rates

We earn a commission from the partner when a booking completes. It doesn't change your price.