The message has your name, your hotel and your dates right. That's the whole point.

If you have already tapped the link and entered your card, skip to if you already paid — the first call to your bank is the one that matters.

Read the message again. Almost every word is true.

Most phishing fails the moment you stop and look: a bank you don't hold an account with, a parcel you never sent, a fine for a road you've never driven. The Booking.com message does the opposite. Stop and look, and the details hold up — because they were lifted from a real reservation system.

In April 2026, Booking.com began telling customers that unauthorised third parties had accessed guest data through compromised hotel partners. The exposed information included names, email addresses, phone numbers and booking details — in the words of one analysis, "essentially everything you'd need to convincingly impersonate a hotel contacting a guest." So when the message names your property, your check-in date and your confirmation code, it isn't guessing. It's reading them back to you. Recognition feels like proof, and the scam runs entirely on that feeling.

Which means the usual advice — "check for spelling mistakes," "look for details that don't match" — quietly stops working here. The details match. So the tell has to be something the criminals couldn't copy, and there's exactly one: what the message asks you to do.

The one thing the breach didn't leak

Here is the detail that turns a data leak into a payment scam. By Booking.com's account, the stolen data was contact and reservation information — not card numbers. The criminals can sound exactly like your hotel, but they don't have the one thing they actually want.

So the message is engineered to make you supply it. A "failed authorisation," a card that "needs re-verifying," a small charge to "secure" the room before midnight — every version invents a reason for you to type the card in. The thing it asks you to confirm is precisely the thing the breach couldn't hand over. Once you see that, the whole category collapses into a single question: is this message trying to get a payment or a card out of me? If yes, it doesn't matter how much of it is accurate.

"If there is no pre-payment policy or deposit requirement outlined, but you're asked to pay in advance to secure your booking, it is likely a scam."

Where the message actually comes from

It's tempting to picture the breach as something that happened to you. It didn't — at least not first. You're the last link in a chain that started inside a hotel.

Microsoft attributes the activity to a criminal group it tracks as Storm-1865, and the entry point wasn't Booking.com's core systems — it was the people working at its partner properties. Hotel staff were lured with fake CAPTCHA or "verify you're human" pages and tricked into running a copy-paste "fix," a technique known as ClickFix, which quietly installed remote-access malware (reported as XWorm and VenomRAT). With a foothold in a property's booking account, the attackers could read genuine guest reservations — and message those guests from a position that looks, to you, indistinguishable from the hotel.

The test that beats every version of it

The wording will keep changing — "authorisation failed," "confirm your card," "a €1 verification charge," "your booking will be released in 12 hours." Chasing each new script is a losing game. One test sits underneath all of them and doesn't move.

Put plainly: judge the ask, not the recognition. The recognition was bought in a breach. The ask is the only thing the criminal had to invent — so it's the only thing worth trusting your decision to.

If you already entered your card — the first hour

Typing your card into the page is not the end of it, but speed decides how it ends. Work in this order:

Will you get the money back?

It turns on one distinction. If criminals captured your card and then spent on it without your say, those charges are unauthorised — and most card networks and banks will refund unauthorised transactions, which is why blocking the card fast matters so much. If instead you were deceived into authorising a payment yourself, recovery is harder and depends heavily on where you are: the UK now forces banks to reimburse most authorised push-payment fraud, while much of the world still has no equivalent rule.

One rule, end to end

If you take one habit from this piece, take this: a real booking never asks you to re-enter your card through a message. The details a scammer recites were stolen, not earned — so let the request, not the recognition, decide. When something feels off, close the message, open the app you actually booked on, and look. If the problem is real, it'll be sitting right there in your reservation. If it isn't, you just walked past the most convincing travel scam of the year.