The Hotel Message That Knows Too Much

By Evan · Monday, October 19, 2026 · 2-minute read

A phone chat asks you to verify your card. A red stamp says SCAM. Beside it, a green check says CALL THE HOTEL.
Illustration by What You Missed.

The short version

You book a hotel, and a WhatsApp message pops up. It knows your hotel. It may even know your dates. It asks you to click a link to secure your booking. Booking.com says it will never ask for your card by WhatsApp, text, email, or phone.

A knock at the door

Imagine someone knocks on your front door wearing a hotel uniform. They know your name. They know which hotel you booked, and when. They just need your credit card “to confirm.”

You’d probably believe them. That’s exactly why this scam works.

How the scam works

Police in Singapore warned about a surge in this scam on October 9.

Here’s what they say happens:

  • A message arrives, usually on WhatsApp, or sometimes by email. It looks like it’s from a hotel or a booking website.
  • It asks you to “verify” your card or confirm your upcoming stay.
  • Sometimes the message includes your real booking details. That makes it feel genuine.
  • It sends you a link to “secure” your booking and promises no money will be taken.
  • You type in your card details and approve it.
  • Later, charges you never approved show up on your card. Many people only discover the trick after that, when they contact the hotel directly.

How do scammers know your plans?

In April, the BBC reported that criminals got into Booking.com customer data. Booking.com said they accessed customers’ names, email addresses, phone numbers and booking details. It said customers’ financial information was not taken from its systems.

A security expert at Norton, Luis Corrons, explained why that matters. He said the stolen data lets criminals mention “the real property, the real travel dates,” so the scam feels like normal customer service.

How big is it?

In Singapore alone, police have counted at least 148 cases since January 2026, with losses of at least 185,000 Singapore dollars.

That’s just one country’s count.

The golden rule

Booking.com says it will never ask you to share credit card details by email, phone, WhatsApp or text.

Singapore police give two simple tips:

  • Check with the hotel using the phone number or email on the hotel’s own website, not the one in the message.
  • Don’t click links in messages you weren’t expecting.

Sources

  • Singapore Police Force, “Police Advisory On Phishing Scams Involving Hotels And Hotel Bookings Platforms” (Oct. 9, 2026): police.gov.sg
  • BBC News, “Booking.com customers warned of ‘reservation hijacking’ after hack” (April 15, 2026): bbc.com

This story was in the issue of Monday, October 19, 2026.