Scam messages quote real hotel bookings after a breach at booking software maker RMS

Imagine getting a WhatsApp message from the hotel you booked for next month. It has your full name, your real dates and your room type, and it says your card was declined and the booking will be cancelled unless you confirm your payment details. That is happening to travellers after a breach at RMS, an Australian company whose booking software runs more than 6,000 hotels, holiday parks and serviced apartments around the world. The messages aren’t from the hotel or from RMS. Here’s what happened and how to tell the difference.

What happened

According to RMS’s incident page:

• October 26: RMS identified unauthorised access to a limited part of its environment.
• October 27: it began investigating reports of guests getting WhatsApp, text and email messages that quoted genuine booking information and asked them to confirm payment details or make a payment. It issued new credentials to integration partners as a precaution.
• October 28 and 29: it said a subset of guest booking information was involved, including guest contact information and booking details, and that card and payment details were not.
• October 30: it notified the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and the National Office of Cyber Security.
• November 2: it said independent forensic investigators had confirmed the unauthorised activity was contained. It is still rotating credentials used by integrations, which has interrupted some connected services, and is assessing its notification obligations “in the relevant jurisdictions.”

The incident page lists RMS services in Australia, North America, Europe and China among those affected, so this isn’t only an Australian story, though most reports so far come from Australia.

What was taken, and what wasn’t

RMS’s help centre article lists what was accessed: guest names, guest contact details and booking details. It says credit card and payment details were not accessed. RMS hasn’t said how many guests are affected.

The scam messages show how much those booking details are worth to a scammer. RMS says they:

• quote real booking details, such as the guest’s name, stay dates or confirmation number
• ask the guest to confirm card details or make a payment
• warn that the booking will be cancelled unless the guest acts quickly
• link to a website that isn’t run by RMS or the property

RMS has also had reports of automated phone calls about bookings.

Who is affected

ABC News reported that guests of Federal Group’s Wrest Point in Hobart received a convincing email with their real booking number, room type and dates, claiming their card had been blocked. ABC named other affected operators including ALH Hotels (Nightcap and Nightelier), Discovery Parks, and, it understands, BIG4, Reflections and G’day Parks.

In Western Australia, ABC spoke with a traveller who got a WhatsApp message about his upcoming stay at Cable Beach Club in Broome, with his full name and correct dates. “I work in tech, so I’m pretty savvy towards scams, but because it had some authentic details I thought it could be real,” he said. He started entering card details before the page timed out, and later noticed the message came from an international number and the reservation code didn’t match. Kimberley Accommodation Group, which also uses RMS, said its guests got similar messages.

Why it matters

A booking confirmation is about as believable as a scam can get. It arrives around the time you expect to hear from the hotel, it has details only the hotel should know, and a cancelled holiday is a scary thing to lose. A third-party breach like this one also means the hotel did nothing wrong itself, which can make guests trust the message even more. The same pattern showed up in our coverage of the Amadeus airline booking breach, where a shared travel system put many brands’ customers at risk at once.

What you can do

1. Treat any message about payment for a booking as suspect, even if every detail is right. Real booking details no longer prove a message is real.
2. Contact the property yourself using the phone number or email on its official website or your original confirmation, not anything in the message. RMS’s template for hotels tells guests their booking is unchanged and no action is needed.
3. Don’t pay or enter card details through WhatsApp or a link in a text. RMS says it will never ask for card details or payment through WhatsApp.
4. Hang up on unexpected calls about your booking and call the property back on a number you looked up.
5. If you entered card details, call your bank right away. If you clicked a link, RMS suggests running an antivirus scan and changing your passwords.
6. Learn the patterns. See how scammers use leaked data to make phishing personal.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each booking site its own address, so you can tell where a scam got your address and turn it off. Frame never collects or stores the leaked records themselves.

Related coverage

• Amadeus breach: airline booking records accessed, including JAL, Korean Air and Asiana: another travel supplier breach that reached many brands’ customers at once.
• How scammers use leaked data to make phishing personal, and how to spot it: why a message with your real details isn’t proof it’s genuine.

Sources

• RMS, Phishing messages referencing RMS booking details (incident page), updated November 2, 2026
• RMS, Security Incident Alert: WhatsApp Phishing Scam, October 28, 2026
• ABC News, Scammers target Kimberley travellers after international hotel booking data breach, November 3, 2026
• ABC News, RMS hack sees ‘convincing’ phishing scam emails using real hotel booking numbers sent to customers, October 29, 2026