Do not pay or share card details through a WhatsApp message claiming to verify, protect, or prevent cancellation of a Booking.com reservation. Open the Booking.com app or type its website address yourself, compare the request with your confirmation, and contact the property and Booking.com through independently obtained official channels.
How the WhatsApp Booking.com scam works
Criminals impersonate a hotel, Booking.com, or a customer-service agent. They may know your name, property, dates, reservation number, or amount, making the message look authentic. Typical messages say a reservation will be canceled, a card failed, or payment must be “verified” within a short deadline. The conversation then moves to WhatsApp or an external page that asks for card details, a password, a one-time code, or a transfer.
Reported campaigns have involved impersonated hotels, compromised booking-system or partner accounts, stolen credentials, and information exposed elsewhere. Those reports do not establish that every incident came from a Booking.com breach. Possible sources include a compromised property account, your email account, reused passwords, malware, a data leak, or social engineering. See the warnings from Switzerland’s National Cyber Security Centre and HKCERT.
A fake page may harvest card numbers and CVV codes, Booking.com credentials, or one-time verification codes. It may also try to make you download malware. Opening a link does not automatically mean your device was infected; the outcome depends on the device, browser, page, and what you entered or downloaded.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Is a Booking.com WhatsApp message ever legitimate?
A property may use WhatsApp for arrival instructions, directions, or other logistics. WhatsApp itself is not proof that a message is fraudulent or genuine. A legitimate hotel contact still does not authorize a new payment process.
Only consider a post-booking payment request potentially legitimate when it matches the amount, timing, method, and conditions in your original confirmation and you can verify it independently. Booking.com says it will not ask customers for credit-card details by email, phone, text, or WhatsApp, will not request a bank transfer that differs from the booking’s payment policy, and does not require gift cards or card details by phone, text, or email. Its customer-service representatives should ask only for a reservation ID and/or PIN, not your account password or sensitive financial information. Read the Booking.com traveler-safety guidance.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Red flags that mean “do not pay”
- Your reservation will be canceled unless you act immediately.
- Your card “failed” and must be re-entered or verified.
- The requested payment is outside the method or schedule in your confirmation.
- A link leads to a domain outside the official Booking.com app or website.
- You are asked to continue on WhatsApp or another private messenger.
- The sender requests a full card number, CVV, password, one-time code, identity document, or security answer.
- You are told to make a new bank transfer, payment-app transfer, cryptocurrency payment, gift-card purchase, or cash-equivalent payment.
- The sender says not to contact Booking.com directly.
- A professional logo, “verified” profile, matching phone listing, reservation PIN, or exact hotel details are offered as the only proof.
Urgency and accurate reservation information are persuasion techniques, not authentication. A genuine payment deadline can still be copied into a scam message.
Verify the request without using the message
- Stop engaging. Do not click, call, reply, confirm personal information, share a code, enter card details, or authorize a transfer. Screenshot the conversation, sender number, profile, link, and request first.
- Open Booking.com independently. Use the installed app or type the official address yourself; do not follow the message’s link.
- Inspect the reservation. Check its payment status, deadline, cancellation terms, amount, payment method, and messages. The original confirmation and in-account terms are the controlling reference.
- Contact the property independently. Use contact details on the official Booking.com reservation page, the property’s own website, or another trusted source. Ask whether the request matches the reservation policy; do not rely only on the WhatsApp number.
- Contact Booking.com through its app or website. Ask support to verify the request and report suspected phishing or account takeover.
- Preserve evidence, then block and report. Save screenshots, URLs, receipts, and notifications before blocking the WhatsApp account. WhatsApp’s menus vary by device and release; use the current in-app block/report controls. Meta describes newer scam warnings and safety tools at its safety guidance.
What Booking.com will not ask you to do
- Send credit-card details through email, phone, text, or WhatsApp.
- Provide your Booking.com password or sensitive financial information to customer service.
- Make a bank transfer that conflicts with the payment policy in your confirmation.
- Pay with a gift card or an unverified external payment page.
These statements describe Booking.com’s published traveler guidance; a property or separate payment processor may have its own documented arrangements. Verify any exception through the reservation and official support.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If you already clicked, entered information, or paid
Use the branch that matches what happened. Act immediately; do not wait for a charge to appear.
| What happened | Immediate actions |
|---|---|
| Clicked, entered nothing, and downloaded nothing | Close the page, do not revisit it, update the browser and device, and monitor accounts. If a file downloaded, do not open it and run your device’s trusted security checks. |
| Entered a Booking.com password | Change it from the official app or website. Change every account where it was reused, especially email and banking accounts, and enable two-factor authentication (2FA). |
| Entered card or bank details | Call the card issuer or bank using its official number. Ask about blocking and replacing the card, stopping or disputing transactions, and increased monitoring. |
| Sent money | Contact the company that moved the money and your linked bank immediately. Ask whether a hold, recall, reversal, or dispute is possible; recovery is not guaranteed. |
| Lost access to Booking.com | Use official account-recovery channels, tell Booking.com it may be an account takeover, review reservations, saved payment methods, email, phone number, and messages, and warn travel companions. |
Booking.com recommends resetting the password, enabling 2FA, contacting your bank or payment provider, blocking and replacing cards where appropriate, and monitoring for unrecognized charges. Its account-security guidance is at Booking.com traveler safety. 2FA adds protection but cannot prevent every phishing, stolen-code, session, or recovery-channel attack.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Payment-method recovery
- Credit or debit card: Call the issuer immediately and follow its fraud and dispute process.
- Bank transfer: Ask the bank’s fraud department whether a recall or hold is still possible.
- Payment app: Report the transaction to the app and to the linked bank or card provider.
- Wire transfer: Contact the wire company and bank at once; speed matters.
- Gift card: Contact the issuer, keep the card and receipt, and report the scam.
- Cryptocurrency: Notify the exchange or wallet provider, but expect that recovery may be difficult or impossible.
For U.S. readers, the FTC recovery guide advises contacting the payment company quickly and reporting at ReportFraud.ftc.gov. Readers elsewhere should use their bank and national fraud-reporting authority; the UK’s Action Fraud provides one example.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Secure your account before traveling
- Use a unique, long Booking.com password; reused credentials increase takeover risk. Booking.com explains the risk in its privacy notice.
- Enable 2FA in Booking.com account-security settings and secure the email account linked to the reservation.
- Turn on bank and card transaction alerts.
- Keep your phone, browser, and security software updated.
- Review reservations, contact details, saved payment methods, and account messages before departure.
- Tell travel companions how to verify a request so one person’s compromised account does not become everyone’s loss.
A password manager can help create unique credentials, but no security product can decide whether you should voluntarily authorize an off-policy payment. Independent verification remains the decisive safeguard.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Common mistakes to avoid
- Calling the number in the message or clicking “verify” to test it.
- Assuming a matching hotel name, reservation number, or search-result business listing proves identity.
- Sending a small test payment.
- Sharing a one-time code with someone claiming to be support.
- Waiting until the next business day to contact the bank.
- Changing only the Booking.com password when it was reused elsewhere.
- Deleting the conversation before saving evidence.
- Assuming Booking.com will automatically refund an off-platform transfer.
The rule to remember
Verify the reservation from inside the official Booking.com account and through independently sourced contacts—not from a WhatsApp message. If the payment does not match the original policy, or anyone requests credentials, card details, codes, or an urgent external transfer, do not pay until Booking.com and the property have confirmed it through official channels.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
