The message looks entirely routine. It names the hotel you booked. It gives your exact check-in date. It may even quote your reservation number. There is just one small problem with your payment, and the hotel needs you to confirm your card details through a link, or the booking will be cancelled.
It is not from your hotel.
Security researchers are warning about a new kind of travel fraud that uses real booking details to trick guests into handing over their money. Because the scammers already know so much about the trip, the usual warning signs are almost impossible to spot.
What Is Reservation Hijacking?
Researchers at Gen, the company behind the Norton antivirus brand, have named it the Reservation Hijack Scam. It is a form of targeted phishing in which criminals use genuine hotel booking details to make fraudulent messages look legitimate.
Older scam emails tended to give themselves away with poor spelling, generic greetings or an obviously fake sender. These do not. They are built around a specific traveler’s real trip, which makes them feel like ordinary customer service.
They can arrive by email, text message or WhatsApp. In some cases they arrive inside the messaging system of a booking platform the guest already trusts, in the same conversation as their genuine reservation confirmation.
At Least 350 Hotels Caught Up
The scale is significant. Norton’s analysis found that at least 350 hotels, vacation rentals, motels and guesthouses in 50 countries have been caught up in reservation hijacking scams.
The researchers say criminals typically get in through hotel staff, not through the guest. They send phishing emails to hotel reservation inboxes, often posing as a guest complaint or a booking query. Once a staff member clicks, the attackers can gain access to the hotel’s booking systems and read the reservations inside.
Every new booking at a compromised property then becomes a fresh target, and the scam can keep running until the hotel discovers the break-in.
Booking platforms have also been affected. In April 2026 Booking.com warned that unauthorized parties had accessed some customers’ booking information, including names, contact details and reservation data. The number of customers affected was not disclosed.
Why Travelers Fall for It
These scams work because they exploit the moment when travelers are most likely to act quickly.
Norton notes that the messages often arrive close to departure, when a threat of cancellation creates intense pressure to fix the problem immediately. A traveler juggling packing, flights and airport transfers is unlikely to stop and question a message that correctly names their hotel.
Travel expert Jürgen Himmelmann of Global Work & Travel describes the newer scams as hard to spot because they resemble the normal paperwork of a trip. He calls the pattern the “four-tap scam”: the victim scans or opens a link, enters their details and approves a payment, all before checking who they are actually paying.
The QR Code Trap Waiting at the Airport
A related scam is spreading in the physical world too. Fraudsters stick fake QR codes over genuine ones at airports, hotels and taxi ranks.
Scanning one can lead to a fake payment page or login form that looks almost identical to the real thing. The practice is known as “quishing,” and it targets the same tired, distracted traveler.
Your Travel Insurance May Not Help
Victims who assume their travel insurance will cover them could be in for a shock. Policies may not cover money lost through payments the traveler authorized, phishing, or details they entered willingly.
Because the victim technically approved the transaction, banks can also be harder to persuade. Falling for one of these scams can mean more than a single bad charge, since stolen card details can be used again.
Before You Panic: Your Real Hotel Is Probably Fine
Most hotel messages are genuine, and most bookings are never affected. Hotels and booking platforms do sometimes need to contact guests about payment, so not every message about a card is a scam.
The protection is simple. Never act on the link in the message. Check through a channel you already know is genuine.
How to Protect Yourself
These rules will stop the vast majority of booking scams:
- Never pay through a link in a message. However genuine it looks, and even if it quotes your booking number, close it.
- Check your booking independently. Open the booking platform’s official app or type the hotel’s website address into your browser yourself, and look for any payment request there.
- Call the hotel directly. Use the phone number from the hotel’s official website, not one supplied in the message.
- Treat urgency as a red flag. A threat that your booking will be cancelled within hours is the scammer’s main tool, so stop and verify before doing anything.
- Don’t scan QR codes on public signs. At airports and taxi ranks, type the website address yourself or pay through an official app.
- Use a virtual card for travel bookings. Many banks offer virtual card numbers or travel cards with spending limits, which keep your main account away from unfamiliar payment pages.
- Call your bank immediately if you are caught. Contact your card provider before anyone else, so that the card can be stopped and the charge disputed.
The Bottom Line
The oldest advice about scams was to watch for messages that seemed generic or out of place. Reservation hijacking turns that on its head, because these messages fit perfectly. For travelers, the only safe rule now is that no payment request, however convincing, should be acted on until it has been checked through a channel you already trust.
Source: Research by Gen and Norton on the Reservation Hijack Scam, with additional reporting from Wired via AI Topics, eSecurity Planet and Zawya.
Amanda O’Brien is the creator and editor of The Boutique Adventurer. She has visited 80 countries and is a member of the British Guild of Travel Writers as well as the IFTWTA. She is passionate about wine had has just completed Level 3 of the WSET. Born in Australia, she lives in London.