Skip to main content
Phishing is an increasingly common scam in the travel sector: someone pretends to be the property or the booking platform to ask the guest for a payment or their card details. This guide helps you recognise it and reassure the guest.

​
How to recognise a fraudulent message

  • It arrives by WhatsApp, text message or email from a number or address that is not one the property normally uses. It is often a foreign number.
  • It creates urgency: “confirm within 24 hours or your booking will be cancelled”.
  • It asks the guest to “confirm”, “validate” or pay for the booking through a link, or for card details.
  • The link leads to a website that is neither the property’s nor the booking platform’s.
A message can mention real booking details (dates, booking reference, property name) and still be fraudulent. What gives it away is the channel, the urgency and the link.

​
What to tell the guest

If a guest asks you about a message like this, you can reassure them:
“That message is a scam and has nothing to do with the hotel. Please do not open the link or make any payment. Your booking is confirmed and we look forward to welcoming you on your arrival date.”
If they genuinely have a payment pending, offer to take it through the property’s usual channels so they have no doubts.

​
If the guest has already paid or shared their details

Recommend these steps as soon as possible:
1

Call their bank

To block the card and dispute the charge. The sooner they call, the easier it is to stop it.
2

Keep the evidence

Screenshots of the message, the number or address it came from, the link and the payment receipt.
3

Report it to the police

Banks usually ask for a police report to process the claim.
Recovering the money is handled between the guest and their bank. From the property, the most useful thing is to point them to these steps.

​
How to protect your property

  • Turn on two-factor authentication (2FA) for every Roomdoo user. With it, a stolen password is no longer enough to sign in. See Turn on two-factor authentication.
  • One user per person, and no shared passwords.
  • Do not open links or share passwords or codes from unexpected messages. No one at Roomdoo will ever ask for your password or your authenticator code.
  • Always request payments through your usual channels, so guests know which ones they are and distrust any other.
If several guests receive messages like this in your property’s name, email us at soporte@roomdoo.com with a screenshot of the message.