Scams · 4 min read
Fake hotel payment pages now show your real name, dates and room price
Netcraft found a phishing kit that fills fake Booking.com-style pages with real reservation details to collect card numbers. Singapore says hotel booking scams have cost at least $185,000 this year.
You booked a hotel. Now a message says your reservation needs a quick card check, and the page it links to shows your name, your email, your phone number, the hotel, your dates and the price. It looks exactly like your booking. It can still be a scam.
The internet security company Netcraft has described a phishing kit built for this, and on November 10 Singapore’s Ministry of Home Affairs gave new figures on scams that use guests’ genuine booking details.
What Netcraft found
In a report published November 6, Netcraft says a single phishing kit is being used across many sites that impersonate Booking.com and other hotel reservation services. Its fingerprint appeared in roughly 1,000 scans. Booking.com and the hotels shown aren’t involved; their names are being borrowed.
What makes it convincing:
- Real booking details. Pages came pre-filled with the guest’s name, email address, phone number, hotel, stay dates and price, so they look like an existing reservation that just needs confirming.
- Two looks, one engine. One version copies Booking.com’s blue design and checkout steps. Another uses a generic “Best Hotel Reservation” brand and puts the hotel front and centre. Both run the same code.
- Card checks in real time. The page rejects obviously fake card numbers before letting you continue, which suggests the operators want working cards.
- It keeps going after you pay. After the card is entered, the page can show extra “verification” steps sent live by the scammers, plus a fake support chat. Netcraft says some of the code may be built to imitate the extra card checks banks use, though it couldn’t confirm it relays real ones.
- Many languages. Most pages featured hotels in Japan, priced in yen, with some European properties in euros. The kit can switch to more than a dozen languages, including English and French.
What Singapore says
Answering a question in Parliament, Minister for Home Affairs K Shanmugam said victims typically get messages with phishing links impersonating hotels or booking platforms, asking them to verify card details or confirm an upcoming stay. They usually find out only after unauthorized charges appear, or when they check with the hotel. Since January 2026, Singapore police have recorded at least 148 hotel and booking platform phishing cases, with losses of at least S$185,000. The minister said police don’t track how scammers got the genuine booking details.
How do scammers know your booking? Netcraft doesn’t say for this kit. In other cases, booking data has come from breaches at hotel software providers, like the RMS breach we covered this month, where guests then got scam messages quoting their real reservations.
How to spot it
- Real details don’t prove a message is real. Treat any request to “verify” or “re-enter” a card for a booking you already made as suspicious, however accurate it looks.
- Check inside the official app or website. Open the Booking.com app, or the hotel’s own site, by typing the address yourself. If there’s a real payment problem, it will show there.
- Look at the address bar. Netcraft says the scam pages sit on unrelated, often newly registered domains, not booking.com.
- Call the hotel using the number on its official website, not one in the message.
- Don’t share one-time codes or approve bank prompts you didn’t start. A real booking doesn’t need you to approve a charge through a link.
- If you entered your card, call your card issuer right away to block it and dispute charges. If you entered a booking account password, change it on the real site and turn on two-step verification. In Canada, report it to the Canadian Anti-Fraud Centre.
How Frame helps
Scams like this often start with details from data breaches. Frame can look up your verified emails in Have I Been Pwned’s breach database so you know which of your details are already out there, and Frame’s breach checklists explain what each one exposed. Frame never collects or stores the leaked records themselves.
Related coverage
- Scam messages quote real hotel bookings after a breach at booking software maker RMS: how stolen booking data turned into scam messages to guests.
- Wyndham’s Android app held a password that opened a customer database: another way hotel guest details can end up exposed.
- Fake package-delivery texts spike with holiday shipping: how to spot them: another seasonal scam that uses a believable story to get your card.
- Frontier Airlines is warning customers about fake refund and payment emails: a related travel scam that asks you to re-enter card details for a ticket instead of a hotel stay.
Sources
- Netcraft, Hospitality Phishing Cluster uses Personalized Hotel Reservations and Interactive Card Verification, November 6, 2026
- Singapore Ministry of Home Affairs, Addressing hotel booking phishing cases involving genuine booking details and obligations of hotels and booking platforms to notify affected customers, November 10, 2026
More stories
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.