Scam or real? Test yourself on 10 hotel messages

It's the night before check-in and "the hotel" messages you, with your name and dates, asking for one small thing before midnight. Would you tap the link? Here are ten messages like the ones travelers post asking "is this legit?", drawn at random from 44 each time you play. Some are scams and some are real hotels doing their job, and the mix changes every round. Pick an answer and we'll show what gives each one away.

The five red flags, with the exact lines from the quiz

Every scam above leans on the same five moves. Here they are with lines lifted word for word from the messages you just saw, why each one gives the game away, and what to do when you meet it.

1. A clock you never agreed to

"Your reservation will be CANCELLED within 24 hours"
"Code expires in 10 minutes."

A confirmed booking doesn't expire because a stranger says so. The deadline is there for one reason: to stop you from opening the booking app and checking. Real hotels give you days, not minutes, and they say it on the booking page.

What to do: slow down on purpose. Open the app or site you booked with. If the reservation shows as confirmed, the deadline is fake.

2. Money that leaves the booking site

"please transfer the remaining €342 to our NEW bank account below"
"Scan the QR code below to pay."

A new IBAN, a QR code or a payment link sent by message all do the same thing: they move your money somewhere the booking site can't see or refund. A hotel that changed banks would update it on the booking platform, not in an email to you.

What to do: pay only on the booking site's own checkout page or at the front desk. If you're told you owe money, look for it in your booking, not in the message.

3. A request for your card, a code or your ID

"reply with the 6-digit code we just sent to your phone"
"send a photo of your passport (both sides) and a selfie holding your credit card"

That six-digit code is the key to one of your accounts; whoever asks for it is trying to sign in as you. A passport photo plus a card selfie is everything needed to open accounts in your name. No hotel needs either before you arrive.

What to do: never read out a one-time code, to anyone. Show ID at the front desk in person, where you can see who is holding it.

4. "Let's continue somewhere else"

"Our app chat is unavailable. Continue on WhatsApp: wa.me/447700912233"

The booking app keeps a record and can block a bad account. Off the app, nobody is watching, and that's why the scam needs you there. Booking platforms flag this move themselves as a warning sign.

What to do: keep every conversation in the app you booked with. Anything real can be said there.

5. A sender or link that doesn't match

From "+44 7451 902 118": "Re-enter your card within 2 hours bit.ly/seaglass-pay"
"harborview-secure-pay.com/confirm"

A random mobile number, a short link that hides the address, or a web address that sounds like the hotel but isn't its website. Scammers can copy a hotel's name in seconds; they can't send from the hotel's real address or the booking app.

What to do: don't tap. Type the hotel's name into a search engine yourself, or call the number printed on its own website.

What a real message looks like

From Seaglass Inn: "check-in at Seaglass Inn is from 3 PM. Reply with your arrival time if you like. Questions? Call the number on our website."

It asks for nothing sensitive, has no link, sets no deadline, and points you to the official contact. That's the bar: a real hotel message is boring. Anything that makes your heart rate jump deserves a second channel before you act on it.

Watch one in seven seconds

Why careful people still get caught

The message often has your real name, dates and booking number, because the scammer reads them from a hotel account they've broken into. Then it adds a clock: cancelled at midnight, code expires in ten minutes. The detail makes you trust it, the clock stops you from checking. That's the whole trick, and it's why the answer is never "look closer at the message". Check it somewhere the scammer can't reach.

If you already clicked or paid

1. Card details sent: call the number on the back of your card now and ask them to block it and dispute the charge.
2. Paid by bank transfer: call your bank today and ask for a recall. The first hours matter most.
3. Shared a code or password: change the password of the account that code belongs to, then turn on two-step sign-in.
4. Worried about the booking itself: open the app or site you booked with. If the reservation is there and confirmed, it stands.
5. Report the message inside the booking app so the hotel's account gets locked.

Questions people ask

Is it safe to pay a hotel through WhatsApp?

No. Pay on the booking site or at the front desk. A real hotel can answer questions on WhatsApp, but it won't send you a payment link there.

The hotel messaged me in the booking app, then asked me to continue on WhatsApp. Is that normal?

Moving you off the app is one of the most common first steps of these scams. Keep the conversation where you booked; anything real can be said there.

One site is far cheaper than the hotel's own website. Is it legit?

Sometimes, because sites get different deals. Check that you pay on the site's own checkout page and that the booking then shows up in your account. A "deal" that ends with a bank transfer or a payment link sent by message is not a deal.

How can I tell a hotel is real before I book?

Look it up on a map, check that it has recent reviews from more than one site, and call the number on its own website. Fake listings usually fail at least one of those.

Book where the price is on the page

Rates by Room shows the nightly rate read from the booking partner for 2359 hotels in 91 cities. You pay on the partner's own checkout, with the price in front of you, so there's no message to second-guess.

Compare real hotel rates

We earn a commission from the partner when a booking completes. It doesn't change your price.