ACCOMMODATION BOOKING SCAM ALERT: Travellers and Operators Worldwide Are Being Targeted

From five-star hotels and luxury resorts to roadside motels, holiday parks and camping grounds, sophisticated booking scams are putting travellers' money and accommodation businesses' reputations at risk. Here's what both sides need to know.

Your Next Holiday Could Come With an Unwelcome Surprise

Imagine you've booked a beachfront resort in Thailand, a hotel in London or a caravan park on Australia's east coast.

Everything's organised. Then an email or WhatsApp message arrives claiming there's a problem with your booking.

It knows your name, reservation number, arrival date and accommodation details. It looks legitimate.

There's just one problem. The person sending it might be a criminal.

And they're hoping you'll hand over your credit card details before you realise what's happening.

Welcome to one of the accommodation industry's increasingly troublesome scams.

It's Not Just Holiday Parks – It's Worldwide

In October 2026, Australian accommodation technology provider RMS Cloud confirmed unauthorised access involving some guest contact and booking information.

RMS provides booking and property management technology to more than 6,000 hotels, holiday parks and serviced apartments worldwide.

Australian operators linked to the incident include BIG4, Discovery Parks, G'day Parks and Reflections Holidays, alongside hotel businesses including Wrest Point in Tasmania.

RMS says payment card information was not exposed through the incident, although investigations are continuing.

But this problem extends well beyond one software provider.

Booking.com customers have faced similar attacks involving compromised accommodation accounts. Britain's Action Fraud reported £370,000 in losses across 532 reports between June 2023 and September 2024.

In Singapore, police reported at least 148 hotel-booking phishing cases and S$185,000 in losses during 2026 up to their October warning.

This is an international problem affecting accommodation businesses large and small.

How the Scam Works

The approach is frighteningly simple.

Criminals obtain booking information or access legitimate accommodation messaging accounts, then impersonate the property or booking platform.

Guests receive messages claiming their payment has failed, their credit card needs verification or their reservation will be cancelled.

A link leads to a convincing but fraudulent payment page.

With artificial intelligence helping criminals produce polished communications, dodgy spelling is no longer the giveaway it once was.

And even a message appearing inside a legitimate booking platform isn't automatically trustworthy.

Travellers: Five Things That Could Save Your Holiday

Whether you're booking a luxury suite or somewhere to park the caravan, remember:

• 1. Question unexpected payment requests. Especially those threatening immediate cancellation.
• 2. Don't trust booking details alone. Criminals may already know your name, dates and reservation number.
• 3. Avoid suspicious links. Access the hotel's or booking platform's official website independently.
• 4. Check WhatsApp and SMS messages. An unexpected message requesting payment deserves particular scrutiny.
• 5. Contact the property directly. Use a verified telephone number, not one supplied in the suspicious message.

Already provided payment details? Contact your bank immediately, secure any compromised accounts and notify the accommodation provider.

Remember, a fraudulent message doesn't automatically mean your genuine reservation has been cancelled.

Accommodation Operators: Your Reputation Is on the Line

For hotels, motels, resorts and holiday parks, the consequences extend beyond guests losing money.

A traveller who gets scammed while supposedly communicating with your business may blame you, even when your own systems weren't compromised.

That's why prevention and communication matter.

Six practical steps every accommodation operator should consider:

1. Warn guests early. Email upcoming arrivals and explain how legitimate payment requests are handled.

2. Publish visible alerts. Use your website, booking confirmations and social media.

3. Train reception and reservations staff. Everyone should recognise suspicious communications and know how to respond.

4. Review digital security. Check staff access, passwords, multi-factor authentication and third-party booking integrations.

5. Monitor suspicious activity. Record reports, preserve evidence and notify relevant technology providers and authorities.

6. Make verification easy. Give guests a reliable contact method and explain your official payment procedures.

Importantly, don't assume your business is immune simply because it hasn't experienced an incident.

Microsoft identified hospitality-focused phishing campaigns across multiple continents during 2025, demonstrating how accommodation operators themselves can become targets.

Microsoft Security Blog

The Real Cost Is Trust

Accommodation businesses spend years building reputations. Travellers spend months saving for holidays.

Neither should be undermined by criminals exploiting the systems connecting them.

For operators, a proactive warning could prevent financial loss and protect valuable customer relationships.

For travellers, an extra minute checking an unexpected payment request could save thousands.

The message is simple: Before you click, verify. Before you pay, confirm.

Because the only unexpected surprise on your next holiday should be the minibar bill.

Useful resources

For travellers and accommodation operators:

• Scamwatch Australia (opens in a new tab)
• Australian Cyber Security Centre (opens in a new tab)
• IDCARE – Identity and Cyber Support (opens in a new tab)
• Booking.com Traveller Safety (opens in a new tab)
• RMS Cloud Security Updates (opens in a new tab)