Hotel Booking Data Leaked. Here's How to Spot a Fake Payment Request.

In late September 2026, German hotel software company HotelNetSolutions said attackers had pulled guests' booking details through a flaw it closed on September 19, and that the details were being used for very convincing phishing messages to hotel guests. In Japan, the MIMARU hotel chain said its reservation-system provider, Temairazu, reported unauthorized access on September 21, and that guest information may have leaked after some guests received suspicious messages. For anyone with a trip booked, that means a message quoting your real name, dates and booking number no longer proves it came from your hotel: check any payment request in the booking app or with the property before entering a card number.

Key takeaways

HotelNetSolutions lists the data that may be affected as hotel name, booking number, guest name, email, phone number, arrival and departure dates and the booking total. It says it has no indication that card data leaked.
Losses reported to the FTC in its "travel, vacations and timeshare plans" category rose from $104 million in 2022 to $122 million in 2023 and $274 million in 2024, while the number of reports in 2024 was about 7% below 2022. The 2024 jump came as the share of travel reports listing a loss went from 22% to 67%, with sharp jumps in several other FTC categories, so part of it may reflect how reports were collected.
The FBI's Internet Crime Complaint Center counted $275.1 million in real estate fraud losses in 2025, up from $173.6 million in 2024. That is not a travel measure: the category covers real estate investment fraud as well as rental and timeshare fraud.
Platform protections depend on paying through the platform. Airbnb says paying outside it loses AirCover, and VrboCare applies only to bookings completed through Vrbo Checkout.
If you paid a scammer with a credit card, call the issuer right away. Under federal law, a written billing dispute must reach the issuer within 60 days after the first statement showing the charge was sent to you.

What it means for you

If you book hotels through Booking.com, Expedia or similar sites: the main risk is a message that looks like it comes from your hotel. Check it against the payment policy in your own reservation (see "Red flags and a two-minute check").

If you rent vacation homes: stay on the platform from first message to final payment. A host asking to move to WhatsApp or take a bank transfer is a clear warning sign, and paying that way can cost you the platform's protection (see "What the platforms promise").

If you find deals through social media posts or search ads: the FTC warns that scammers buy paid ads that put their own phone number next to a well-known company's name, and Congress's Joint Economic Committee warns against using links or contact details from ads, sponsored results, texts or social media. Type the platform's address yourself, or open its app (see "How the main scams work").

If you already got a "verify your card" message from a hotel or host: don't click the link or reply. Open the app yourself and check the reservation. If you already entered card details, go straight to "If you already paid a scammer."

What the numbers actually show

FTC figures come from the Consumer Sentinel Data Books for 2022, 2023 and 2024, each year from its own edition. FBI figures come from the three-year tables in the 2025 IC3 annual report.

Measure	2022	2023	2024	2025
FTC travel, vacations and timeshare: reports	62,445	55,063	58,347	Not published
FTC travel category: reported losses	$104 million	$122 million	$274 million	Not published
FTC travel category: share of reports with a loss	17%	22%	67%	Not published
FTC travel category: median loss	$1,259	$1,187	$922	Not published
FBI IC3 real estate fraud (investment, rental and timeshare): complaints	Not in this report	9,521	9,359	12,368
FBI IC3 real estate fraud: losses	Not in this report	$145.2 million	$173.6 million	$275.1 million

FTC travel losses rose about 17% from 2022 to 2023 and about 125% from 2023 to 2024, while reports in 2024 were still about 7% below 2022. The 2024 increase came from a much larger share of reports with a loss, not from more complaints or bigger individual losses: the median loss fell.

That shift was not limited to travel. In the same two editions, the share of reports with a loss rose from 53% to 76% for online shopping, from 7% to 51% for health care, and from 27% to 38% for all fraud reports. The 2024 Data Book also says some categories were renamed or consolidated and that totals for earlier years can differ between editions. The FTC gives no explanation for the jump, so the 2023-to-2024 change may partly reflect how reports were collected rather than a change in the scams.

Both categories are also broader than booking sites. The FTC's covers "free" or low-cost vacation offers, cut-rate student travel packages and timeshare pitches. The FBI's mixes rental and timeshare fraud with real estate investment scams. IC3 losses in that category rose about 59% from 2024 to 2025, and complaints about 32%.

We could not find a 2025 FTC Data Book on the agency's website as of October 4, 2026. In March 2026 testimony to Congress, the FTC reported $15.9 billion in total 2025 fraud losses across all categories, up from over $12 billion in 2024, but gave no figure for travel. It named social media as the contact method with the highest reported losses: more than $2 billion in fiscal year 2025.

What the companies report

These figures are company data, not independently audited, and they point in different directions. Congress's Joint Economic Committee, in its December 2025 travel-scam alert, said Booking.com reported in 2024 a 500% to 900% increase in travel scams over 18 months.

In March 2026, Booking.com's chief security officer, Marnie Wilking, told IT Brew that the company detected and blocked about 1.5 million phishing-related fake reservations in 2023, and 250,000 in 2024 after new controls. That one measure fell about 83%.

The security firm Check Point counted 47,318 new travel-related web domains registered in May 2026, and classed 1 in 112 of them, or about 420, as malicious or suspicious. That is a one-month snapshot, not a trend.

No single source measures booking-site scams over time. What the data does show is that booking information can now leak from several places: hotels' own platform accounts and software that the big booking sites don't run.

How the main scams work

Hijacked hotel accounts and leaked booking data

The attack often starts at the hotel. Microsoft described a campaign starting in December 2024 in which hotel staff got fake Booking.com emails, about guest reviews or account checks, that installed password-stealing malware.

The security firm Sekoia traced the next step in a campaign active from at least April 2025. Using hotels' compromised booking accounts, attackers contacted guests by WhatsApp or email, quoted the real reservation and claimed a problem verifying the guest's bank details. Sekoia found the Expedia brand impersonated in the same campaigns.

Booking.com's own guidance for hotel partners acknowledges that its messaging channel can be abused this way. It says that when it detects suspicious activity on a hotel's account, it immediately turns off links in that hotel's messages to guests.

In April 2026, a Booking.com spokesperson told TechCrunch that unauthorized third parties had been able to access some guests' booking information, and that the company had updated the PINs for those reservations. It did not say how many guests were affected or how the access happened. The September incidents show the same kind of data can also leak from software the big platforms don't run.

Fake and hijacked listings

The FTC's rental listing scams guide describes two versions. In one, scammers copy a real listing's photos and description, swap in their own contact details and repost it on another site. In the other, they invent a property, often with an unusually low price.

Booking.com's traveler safety page says its checks block the majority of fake properties before they affect anyone, but that tactics are "becoming increasingly sophisticated." Its security chief told IT Brew that generative AI makes it easy to produce "beautiful-looking images" and well-written emails in any language.

Lookalike sites and fake support numbers in search ads

The FTC's June 17, 2026 travel alert warns that scammers buy paid ads that put their own phone number next to a well-known company's name, or link to sites that only look like a hotel brand or airline. Congress's Joint Economic Committee gives the same warning about sponsored search results, ads, texts and social media: the numbers they show can lead straight to scammers.

Requests to pay or talk off the platform

Airbnb's policy on paying and communicating through Airbnb bars hosts from asking guests to book off the platform, or to talk by WhatsApp, text or other channels before booking. It warns that paying by wire or bank transfer "may be a fraudulent reservation." The FTC's travel alert says only scammers insist on wire transfers, gift cards, payment apps or cryptocurrency, because the money is almost impossible to recover.

Red flags and a two-minute check

Each of these is a reason to stop and check:

A deadline, for example: "re-verify within 12 hours or the booking will be canceled."
A request to re-enter card details, or a "failed payment" you weren't told about inside the app.
A link to a domain that isn't the platform's own, or a message from a personal or foreign phone number.
Any payment not described in your booking's payment policy. Booking.com says it will never ask for card details by email, phone, text or WhatsApp, or for a bank transfer that differs from that policy.
A host who wants to move the conversation or the payment off the platform.
A price well below similar places nearby.

The check takes a couple of minutes:

Close the message. Open the app, or type the site's address yourself, and sign in.
Open the reservation. Compare the message with the payment policy there: when you pay, how, and whether anything is outstanding.
If something is still unclear, call the property on a number from its official website. Don't use a number from the message or a search ad. HotelNetSolutions now tells both hotels and guests that a correct name, stay dates or booking number is no proof a message is genuine.
Report the message to the platform from inside the app.

What the platforms promise

Each program covers only what its terms list. The table summarizes each platform's published terms as of October 4, 2026.

Platform	What it says it will do	Key conditions and limits
Airbnb (AirCover for guests)	If your home host cancels before check-in, you can't reach your host when there's a problem, or the listing is significantly different from what was advertised and the host can't fix it, Airbnb helps you rebook a similar place or gives a full or partial refund, including service fees.	Document the problem and notify the host within 72 hours of discovering it, then contact Airbnb if the host doesn't resolve it. Minor inconveniences are excluded, and AirCover "is not an insurance policy." Paying for a booking outside Airbnb loses AirCover.
Vrbo (VrboCare, formerly Book with Confidence)	Lists four "protected incidents," and says they are the only ones: internet fraud involving Vrbo Checkout (where Vrbo judges a payment was taken fraudulently), host denial of entry or host cancellation, material defects and misrepresentation, and wrongful refusal to return payments or deposits.	Applies only to qualifying vacation rentals booked on Vrbo, not hotel stays, and only if the booking was completed through Vrbo Checkout. Where applicable, you must first try to resolve the issue with the host and seek recovery from your bank, card issuer or payment provider, and provide proof of payment and of any refund or chargeback attempts. Vrbo may decline if these conditions aren't met. It says VrboCare is not a "money-back guarantee."
Booking.com (traveler safety page)	If you clicked a link or shared details, contact Customer Service, which passes the case to its Security team. It also advises resetting your password, turning on two-factor authentication and asking your bank to replace the card.	We found no published guarantee that reimburses money lost to a phishing message.
Expedia (terms of service, last revised August 10, 2026)	Its customer service will never ask for a gift card, ask for your password by phone or email, or request wire transfers or payment details by text. Report impostors to its Brand Fraud Prevention and Action Team.	We found no published guarantee that reimburses money lost to phishing.

Anatomy of a fake card check

Illustrative example: a hypothetical traveler books three nights at $210 a night, $630 in total, for October 17 to 20. The booking was made on a large booking site with a "pay at the property" policy. The timeline shows what the scammer sends and what the real reservation shows at the same moment.

Time	What the scammer sends	What the real reservation shows
Sept. 30, 9:12 p.m.	A WhatsApp message from a foreign number with the traveler's full name, the hotel, the dates and the booking number. "Your card verification failed. Re-verify within 12 hours or your reservation will be canceled."	Status: confirmed. Payment: at the property. Nothing outstanding.
9:14 p.m.	The same text appears in the app's message thread from the hotel, because the hotel's account has been taken over and the platform has not yet detected it.	The payment policy is unchanged. No new charge or payment request appears in the reservation itself.
9:20 p.m.	The link leads to a "secure payment" page on a lookalike domain. It asks for the card number, expiry date, security code and a one-time code from the bank, and shows $630.	The platform's own pages run on its own domain, and it says it never asks for card details by email, phone, text or WhatsApp.
Oct. 17, check-in	The scammer has disappeared.	The hotel still charges $630, because it never received the first payment.

If the traveler pays through the link, the stay costs 2 × $630 = $1,260 unless the card issuer reverses the scam charge, and the card details are in criminal hands for further charges. That is the "I paid twice" pattern Sekoia named its report after. The only evidence the message offered, the correct booking details, is exactly what leaked. The reservation page showed nothing due the whole time.

Frequently asked questions

Can a property legitimately charge me before I arrive?

Yes, if the payment policy says so. Booking.com tells travelers to check the payment and damage-deposit policies and their confirmation, and not to send any payment that isn't described there. Airbnb says hotels listed on its platform may take a card at check-in for incidentals or a security deposit, but only if this is disclosed in the listing or the price breakdown. The warning sign is a payment that isn't in those documents, not the charge itself.

How can I tell whether a link really goes to the platform?

Airbnb's guide to spotting fake messages says genuine links start with https://www.airbnb.com or a country version such as airbnb.es, and warns about misspelled addresses. It also lists the email domains Airbnb sends from. Booking.com tells its hotel partners not to click any link whose destination doesn't end in ".booking.com"; on a phone, tapping and holding a link shows where it goes. Opening the app directly avoids the question entirely.

Were card numbers exposed in the 2026 breaches?

The companies say no. Booking.com told The Guardian in April 2026 that financial information was not accessed, TechCrunch reported. HotelNetSolutions says it has no indication that card or other payment data leaked, and MIMARU says neither it nor Temairazu handles or stores card information. That is why these scams try to get you to type the card number in yourself.

Does two-factor authentication stop these scams?

It helps protect your account: Booking.com recommends turning it on, and resetting your password, if you think you clicked a phishing link. It cannot help if you read a one-time code out to a scammer or type it into a fake page. Airbnb says it will never call to ask for one-time codes, passwords or payment details, and that caller ID can be faked to look like Airbnb.

Do the FTC's figures cover only booking-site scams?

No. The FTC's travel category also includes "free" or low-cost vacation offers, cut-rate student travel packages and misleading timeshare offers, according to the Data Book's category definitions. Read it as a rough signal of reported losses, not a count of booking-site fraud, and compare years with care because figures can be revised between editions.

If you already paid a scammer

This section is general information, not legal or financial advice. Your card agreement and each platform's terms decide what you can recover.

Call your card issuer now. Ask it to block the card, issue a new one and dispute the charge. Under the Fair Credit Billing Act, a written dispute must reach the issuer within 60 days after the first bill with the error was sent to you. Your liability for unauthorized credit card charges is capped at $50, according to the FTC's guide to disputing charges. Debit cards follow different rules, under which your liability depends on how quickly you report.
If you paid by bank transfer, Zelle or another payment app, call your bank the same day. Protections for payments you sent yourself are much narrower than for cards.
Tell the platform from inside the app or its help center. With Expedia, impostors can also be reported to brandfraudreport@expediagroup.com.
Secure the account. Change the platform password, turn on two-factor authentication, and check that your reservation is still intact.
Keep the evidence. Save screenshots, the sender's number or address, the link and the times, the same details HotelNetSolutions asks hotels to keep for suspected cases.
Report it. File with the FTC at ReportFraud.ftc.gov and with the FBI at ic3.gov, and let the hotel know, so it can secure its account.