Hotel booking scam messages: how to spot fake "payment problem" messages before your Japan trip
Checked against 25 official sources. 10 minute read.
What to know first
Treat any message that asks you to re-enter card details, or pay again, through a link as suspect, even if it shows your real name, dates and booking number. Booking.com says it will never ask you to share card details by email, phone, text or WhatsApp. Check the request yourself: open your booking in the platform's own app or website, or contact the hotel using details from its own website.
Next step: Don't tap the link. Open the booking yourself in the app or website you booked with and check whether it shows a payment problem. If you can't tell, contact the platform through the help section of its app. If you have already entered card details, call your card issuer now.
- Card details
- Booking.com never asks for them by email, phone, text or WhatsApp
- A genuine invalid-card request
- Comes by email and SMS, with 24 hours to update inside your booking
- Police in Japan
- 110 for emergencies; #9110 for police advice
On this page
The message you received, and what to do
| Your situation | What to do |
|---|---|
| A link asks you to re-enter or update your card | Don't tap it. Open the booking yourself in the platform's app or by typing its address, and update a card only if the booking itself asks. |
| Your booking, opened in the app, shows an invalid card | Update the card there, inside the booking. A genuine Booking.com invalid-card request gives you 24 hours. |
| A WhatsApp or chat message asks for your card number | Treat it as fake: Booking.com says it never asks for card details by email, phone, text or WhatsApp. Report it in the app. |
| You're asked to pay by bank transfer or gift card | Treat it as fake until checked: a payment method that isn't in your confirmation's payment policy is a warning sign. |
| You can't tell whether it's real | Contact the platform through the help centre in its app, or the hotel using a number from the hotel's own website, and use the script below. |
| You already entered your card details | Call your card issuer now on the number on the back of the card, ask it to block the card and issue a new one, then change your platform password and turn on two-factor authentication. |
| You lost money while in Japan | Call 110 if it's urgent, or report the loss at the nearest police station; #9110 is the police advice line. |
Sources for this section: Booking.com Connectivity docs: handling payment-related data · Booking.com: Safety tips for travellers · HKCERT: Booking.com phishing alert (15 June 2026)
What has been reported
The points below come from news reports, hotel and company notices and Hong Kong's computer emergency response team. They describe a reported pattern, not every case, and the cause had not been publicly confirmed when we checked.
From around Japan's Golden Week holiday in early May 2026, guests who had booked Japanese hotels through Booking.com received emails and WhatsApp messages saying a card authorisation had failed and the booking would be cancelled unless they updated their details within 24 hours (The Standard, 2 June 2026, citing Japanese media).
Hotel Sunroute Asakusa's notice of 21 May 2026 says some Booking.com guests received WhatsApp messages that "falsely claim to confirm reservations and request guests to enter their credit card information", and that the hotel "will never contact guests directly through messaging applications such as WhatsApp" about confirmation or payment.
J-CAST News counted at least 40 hotel groups or individual hotels that had posted warnings on their websites by early June 2026, and reported that the Japan Tourism Agency had begun checking the facts, including the cause, with Booking.com, the hotels concerned and industry bodies (10 June 2026). It also reported that the Japan Hotel Association issued a warning on 12 June 2026 (15 June 2026).
The Standard reported that Booking.com Japan's preliminary investigation found "no evidence of a direct hack of its backend systems". On 17 June 2026, J-CAST reported that the Japan Hotel Association said it still had not been told how the booking information leaked, and that Booking.com said it was continuing to check with the hotels concerned. We found no published finding on the cause from Booking.com or the Japan Tourism Agency when we checked on 8 October 2026.
The messages can look convincing: HKCERT says they may include real check-in dates and full guest names. A genuine-looking channel is not proof either. In an earlier wave, from late 2023, Japanese and regional media reported that scores of hotels in Japan had been hit by scams in which fraudsters stole the hotels' Booking.com login details and used them to send guests payment demands (Kyodo News via the Bangkok Post, April 2024). Agoda's guidance for hotels describes the same method.
This is not unique to one company. Booking.com's own safety page says this kind of cybercrime "is not new, nor is it unique to Booking.com", and Agoda's partner guidance describes scammers sending guests links to fake sites imitating Agoda's.
A separate incident followed in September 2026. Temairazu Inc., whose TEMAIRAZU system hotels use to manage bookings across several booking sites, said on 28 September 2026 that from late on 21 September guests of several hotels had received suspicious messages by WhatsApp and other messaging apps, email and SMS, and that its investigation had found unauthorised access to its system. It said it could not rule out that some guest information had been viewed or obtained by a third party, that the messages may stem from that access, and that it was still confirming the connection. Its advice is the same as this guide's: don't open the link, enter card details, reply or pay, and check your booking only through the hotel's or booking site's official contact. Hotel Grand Hill Ichigaya's notice of 29 September 2026 says the access took place on 21 September and was fixed on 26 September, and that some guests who booked on or before 21 September for stays from 21 September, and who use WhatsApp, received such messages.
Sources for this section: The Standard: Booking.com data breach scare hits Japanese travellers (2 June 2026) · Hotel Sunroute Asakusa: notice (21 May 2026) · J-CAST News (10 June 2026) · J-CAST News (15 June 2026) · J-CAST News (17 June 2026) · HKCERT: Booking.com phishing alert (15 June 2026) · Bangkok Post (Kyodo): Japanese hotels fall prey to phishing scams (April 2024) · Agoda Partner Hub: Cyber-attacks (modified 5 August 2026) · Booking.com: Safety tips for travellers · Temairazu: notice of suspicious messages and unauthorised access (28 September 2026) · Hotel Grand Hill Ichigaya: notice (29 September 2026)
What the booking platforms say
Booking.com: "We'll never ask you to share credit card details by email, over the phone, through text or WhatsApp", and never a bank transfer that differs from the payment policy in your confirmation. Its Customer Service will only ask for your reservation ID and/or PIN.
Expedia: its customer service will never request wire transfers or payment information by text message, ask for account passwords or request gift cards.
Airbnb: it is against policy for hosts to ask you to take a booking off Airbnb; a request to pay by wire or bank transfer "may be a fraudulent reservation"; and Airbnb blocks some messages containing external links.
Agoda: we didn't find a traveller-facing statement of what Agoda will never ask for when we checked on 8 October 2026. Its guidance for hotels warns that scammers send guests links to fake sites imitating Agoda's, so use the same checks and open the booking yourself in the Agoda app or website.
Sources for this section: Booking.com: Safety tips for travellers · Expedia: Tips for outsmarting scammers (23 September 2022) · Airbnb Help Center: Paying and communicating through Airbnb · Agoda Partner Hub: Cyber-attacks (modified 5 August 2026)
Real or fake: how to read a payment message
Genuine card problems do happen. Booking.com's partner documentation says that when a hotel reports an invalid card, the guest gets an email and SMS from Booking.com asking for new card details within 24 hours. A deadline alone doesn't make a message fake. What keeps you safe is where you act: update a card only inside your booking, opened yourself.
Where you enter card details: inside your booking, opened yourself in the app or by typing the site address, points towards genuine. A page reached only through the message's link, or "send your card number here" in a chat, is fake until checked.
How you are asked to pay: a method that matches the payment policy in your confirmation points towards genuine. A bank transfer, a gift card or a method not in your confirmation is fake until checked.
Who contacts you: the platform, or the hotel using contact details it publishes, points towards genuine. A WhatsApp account or personal number, from a hotel that says it doesn't use one, is fake until checked.
The link: if you didn't need one, that points towards genuine. A web address that isn't the platform's real domain is fake until checked; HKCERT advises checking the full address, not the display name.
When you check it yourself: if your booking, or the platform's help centre reached through its own app or website, confirms the same request, it points towards genuine. If neither shows any problem, treat the message as fake.
Sources for this section: Booking.com Connectivity docs: handling payment-related data · Booking.com: Safety tips for travellers · Hotel Sunroute Asakusa: notice (21 May 2026) · HKCERT: Booking.com phishing alert (15 June 2026)
How to check without using the message
Step 1: don't tap the link or reply. Take a screenshot first.
Step 2: open the booking yourself in the app, or type the platform's address into your browser. Check the status, the amount and the payment policy.
Step 3: contact the platform through its help centre in the app or on its website. Booking.com says its Customer Service should only be contacted through the channels listed on its site and apps.
Step 4: or contact the hotel using a phone number or email you find on the hotel's own website, not one in the message. Hotel Sunroute Asakusa sends Booking.com guests back to Booking.com support, so the hotel may redirect you. A simple script: "I booked through [platform], reservation [number], check-in [date]. I received a message saying my card payment failed. Is there any payment issue with my reservation?"
Not every unexpected card entry is fraud: a hold linked to a restaurant booking, for example, can be compared with your reservation.
Sources for this section: Booking.com: Safety tips for travellers · Hotel Sunroute Asakusa: notice (21 May 2026)
Worked example: a message 10 days before check-in
You booked a Tokyo hotel on Booking.com for check-in on 20 November 2026. On 10 November 2026 a WhatsApp message shows your full name, your dates and your hotel, says the card authorisation failed and gives you 24 hours and a link to "verify your card".
Booking.com says it never asks for card details by WhatsApp, so treat it as fake until checked. Don't tap the link. Open the Booking.com app yourself: if the booking shows no payment problem and the help centre confirms nothing is wrong, ignore and report the message. If the app itself asks you to update the card, do it there, inside the booking, well within the 24 hours.
Sources for this section: Booking.com: Safety tips for travellers · Booking.com Connectivity docs: handling payment-related data
If you already entered your card details
Call your card issuer on the number on the back of your card or in its app. Ask it to block the card and issue a new one, and report any charges you don't recognise. Booking.com and HKCERT both give this advice.
Change your platform password and turn on two-factor authentication; Booking.com recommends both. Then tell the platform you may have been scammed: Booking.com says it will pass the report to its Security team.
Keep the evidence: messages, screenshots, links and transaction records (HKCERT).
Plan for the trip (our suggestion): a replacement card may not arrive before you fly, so take a second payment card, and check in the app that your booking still stands.
Sources for this section: Booking.com: Safety tips for travellers · HKCERT: Booking.com phishing alert (15 June 2026)
How to report it
To the platform: use the in-app help or reporting tools. Airbnb asks you to report or flag suspicious messages.
In Japan: for an urgent incident, call 110. The National Police Agency asks people to report actual losses to the nearest police station. For non-urgent advice, #9110 reaches the police consultation line; in Tokyo it connects to the Metropolitan Police Department's General Advisory Center, also on 03-3501-0110 (MPD page updated 6 October 2026). The MPD's English page, last updated in 2017, says the service is available in Japanese, English, Chinese and Korean, but doesn't list hours.
The National Police Agency's online form is in Japanese and asks for your prefecture of residence, so from abroad your home-country route is likely more practical. You can forward phishing emails to Japan's Council of Anti-Phishing at info@antiphishing.jp, or send it a screenshot of a phishing text (Japanese-language site). The Japan Cybercrime Control Center (JC3) takes public reports about malicious online shops, so it isn't the route for a hotel message.
United Kingdom: Action Fraud was replaced by Report Fraud on 4 December 2025. Use reportfraud.police.uk or call 0300 123 2040 in England, Wales and Northern Ireland; in Scotland, report via 101.
France: Cybermalveillance.gouv.fr advises putting a stop on the card with your bank (faire opposition), filing a complaint with the police or gendarmerie, and reporting emails to Signal Spam and texts to 33700. If your card details were used online while the card is still in your possession, you can report it through Perceval (service-public.gouv.fr, via FranceConnect). For advice by phone, Info Escroqueries is on 0 805 805 817 (free, Monday to Friday, 9:00 to 18:30). PHAROS is for reporting illegal online content rather than your own loss.
Germany: use the police Onlinewache portal. For an offence abroad or online, choose the state of your German residential address. The portal is mainly in German, with an English option on its start page. For emergencies, call 110.
Sources for this section: Airbnb Help Center: Paying and communicating through Airbnb · National Police Agency: cyber consultation (Japanese) · Tokyo Metropolitan Police Department: General Advisory Center (updated 6 October 2026) · Tokyo Metropolitan Police Department: help hotline (English, updated 30 March 2017) · Council of Anti-Phishing Japan: reporting (Japanese) · Japan Cybercrime Control Center (JC3) · GOV.UK: Report Fraud, a new service from City of London Police (4 December 2025) · Report Fraud · Cybermalveillance.gouv.fr: Hameçonnage (updated 7 May 2026) · Service-public.gouv.fr: Fraude à la carte bancaire (verified 13 February 2026) · CNIL: Spam, hameçonnage, arnaques · Polizei: Onlinewache portal
Quick checklist before you travel
Note your booking platform, reservation number and payment policy, and save the hotel's phone number from its own website.
Turn on two-factor authentication on your booking account, and never enter card details on a page opened from a message link.
Check every payment request inside the official app or site, save your card issuer's lost or stolen card number, and carry a second payment card.
Sources for this section: Booking.com: Safety tips for travellers
Key facts, checked 18 October 2026
Booking.com never asks for card details by email, phone, text or WhatsApp.
A genuine Booking.com invalid-card request comes by email and SMS, with 24 hours to update inside your booking.
Reported wave from early May 2026: at least 40 hotel groups or hotels had posted warnings by early June 2026 (J-CAST).
Cause: no finding published by Booking.com or the Japan Tourism Agency as of 8 October 2026.
Japan: 110 for emergencies, #9110 for police advice; UK: Report Fraud, 0300 123 2040.
Sources for this section: Booking.com: Safety tips for travellers · Booking.com Connectivity docs: handling payment-related data · J-CAST News (10 June 2026) · J-CAST News (17 June 2026) · National Police Agency: cyber consultation (Japanese) · Tokyo Metropolitan Police Department: General Advisory Center (updated 6 October 2026) · Report Fraud
Questions about this guide
The message is in my booking app's chat and shows my booking number. Is it real?
Not necessarily. Kyodo News (April 2024) and Agoda's hotel guidance describe hotel accounts being taken over, so a scam message can sit in a genuine chat and show real booking details. Ignore any link and check your booking's payment section yourself, or ask the platform's help centre.
Do Japanese hotels contact guests on WhatsApp?
Some say they never do, including Hotel Sunroute Asakusa, whose notice of 21 May 2026 says it will never contact guests through messaging apps such as WhatsApp about confirmation or payment. We can't say that for every hotel, so check the hotel's own website or ask the platform.
If I ignore a genuine card request, could I lose the booking?
Yes. Booking.com's partner documentation lets a hotel cancel if an invalid card isn't updated within 24 hours of the email and SMS. That's why you check inside the app quickly rather than ignore the message, and update the card only there.
Will my bank refund fraudulent charges from a fake hotel message?
That depends on your issuer and country. In France, service-public.gouv.fr says payments older than 13 months can't be refunded and a late stop on the card can lead to refusal. Wherever you live, call your bank as soon as possible and keep screenshots and transaction records.
Official pages for this guide
The rules in this guide come from the official pages below. Japan, Booked. does not book or submit requests on your behalf.
- Booking.com: Safety tips for travellers
- Temairazu: notice of suspicious messages and unauthorised access (28 September 2026)
- Hotel Grand Hill Ichigaya: notice (29 September 2026)
- Booking.com Connectivity docs: handling payment-related data
- Expedia: Tips for outsmarting scammers (23 September 2022)
- Agoda Partner Hub: Cyber-attacks (modified 5 August 2026)
- Airbnb Help Center: Paying and communicating through Airbnb
- Hotel Sunroute Asakusa: notice (21 May 2026)
- HKCERT: Booking.com phishing alert (15 June 2026)
- The Standard: Booking.com data breach scare hits Japanese travellers (2 June 2026)
- J-CAST News (10 June 2026)
- J-CAST News (15 June 2026)
- J-CAST News (17 June 2026)
- Bangkok Post (Kyodo): Japanese hotels fall prey to phishing scams (April 2024)
- National Police Agency: cyber consultation (Japanese)
- Tokyo Metropolitan Police Department: General Advisory Center (updated 6 October 2026)
- Tokyo Metropolitan Police Department: help hotline (English, updated 30 March 2017)
- Council of Anti-Phishing Japan: reporting (Japanese)
- Japan Cybercrime Control Center (JC3)
- GOV.UK: Report Fraud, a new service from City of London Police (4 December 2025)
- Report Fraud
- Cybermalveillance.gouv.fr: Hameçonnage (updated 7 May 2026)
- Service-public.gouv.fr: Fraude à la carte bancaire (verified 13 February 2026)
- CNIL: Spam, hameçonnage, arnaques
- Polizei: Onlinewache portal
Read next
- How to correct a hotel booking name in JapanWork out whether you need a spelling correction or a guest change, and prepare a clear request for the booking provider.
- Booking a restaurant in Japan with TableCheckUnderstand reservations, card holds, meal payments and changes so you can plan dinner with a clear budget.
- Emergency numbers and visitor help in JapanFind the right emergency contact or help desk, and know what details to have ready when you reach out.
- Cash or card in Japan: plan your everyday paymentsBuild a practical mix of cash, cards and transport payments for shopping, food and getting around.
Sources and how this guide was checked
Published · Based on official sources · no affiliate links
Official sources
These official sources explain the rules and conditions used in this guide. Live availability and your own booking, admission or service outcome still need to be confirmed for your trip.
- Temairazu: notice of suspicious messages and unauthorised access (28 September 2026)
What this confirms: Says suspicious messages reached guests from late on 21 September 2026, that unauthorised access to its system was found, that some guest information may have been viewed or obtained, and gives its advice to guests.
Last checked - Hotel Grand Hill Ichigaya: notice (29 September 2026)
What this confirms: Says the access occurred on 21 September and was fixed on 26 September, and describes the WhatsApp messages sent to some guests.
Last checked - Booking.com: Safety tips for travellers
What this confirms: Says Booking.com never asks for card details by email, phone, text or WhatsApp, lists what its Customer Service asks for, and gives the password, two-factor and bank advice.
Last checked - Booking.com Connectivity docs: handling payment-related data
What this confirms: Explains that a guest with an invalid card gets an email and SMS asking for new details within 24 hours, and that the property may then cancel.
Last checked - Expedia: Tips for outsmarting scammers (23 September 2022)
What this confirms: Lists what Expedia customer service will never request.
Last checked - Agoda Partner Hub: Cyber-attacks (modified 5 August 2026)
What this confirms: Describes scammers messaging guests through compromised hotel accounts and sending links to fake sites imitating Agoda's.
Last checked - Airbnb Help Center: Paying and communicating through Airbnb
What this confirms: Explains the off-platform rule, the wire-transfer warning, blocked external links and how to report messages.
Last checked - Hotel Sunroute Asakusa: notice (21 May 2026)
What this confirms: Warns of WhatsApp messages asking Booking.com guests for card details and says the hotel never contacts guests that way.
Last checked - HKCERT: Booking.com phishing alert (15 June 2026)
What this confirms: Describes messages with real check-in dates and names, and advises checking the full address, contacting the bank and keeping evidence.
Last checked - The Standard: Booking.com data breach scare hits Japanese travellers (2 June 2026)
What this confirms: Reports the wave from around Golden Week and Booking.com Japan's preliminary finding of no direct hack.
Last checked - J-CAST News (10 June 2026)
What this confirms: Counts at least 40 hotel groups or hotels with warnings and reports the Japan Tourism Agency's fact-checking.
Last checked - J-CAST News (15 June 2026)
What this confirms: Reports the Japan Hotel Association's warning of 12 June 2026.
Last checked - J-CAST News (17 June 2026)
What this confirms: Reports that the Japan Hotel Association had not been told how the data leaked.
Last checked - Bangkok Post (Kyodo): Japanese hotels fall prey to phishing scams (April 2024)
What this confirms: Reports the 2024 wave in which stolen hotel logins were used to send guests payment demands.
Last checked - National Police Agency: cyber consultation (Japanese)
What this confirms: Says to report losses to the nearest police station, to call 110 in an emergency, and explains the online form, where you choose the police of the prefecture where you live.
Last checked - Tokyo Metropolitan Police Department: General Advisory Center (updated 6 October 2026)
What this confirms: Gives #9110 and 03-3501-0110 for non-urgent police advice in Tokyo.
Last checked - Tokyo Metropolitan Police Department: help hotline (English, updated 30 March 2017)
What this confirms: Says the advisory service is available in Japanese, English, Chinese and Korean.
Last checked - Council of Anti-Phishing Japan: reporting (Japanese)
What this confirms: Explains forwarding phishing emails and sending screenshots of phishing texts.
Last checked - Japan Cybercrime Control Center (JC3)
What this confirms: Takes public reports about malicious online shops.
Last checked - GOV.UK: Report Fraud, a new service from City of London Police (4 December 2025)
What this confirms: Announces that Report Fraud replaced Action Fraud on 4 December 2025.
Last checked - Report Fraud
What this confirms: Gives online reporting and the phone line 0300 123 2040 for England, Wales and Northern Ireland.
Last checked - Cybermalveillance.gouv.fr: Hameçonnage (updated 7 May 2026)
What this confirms: Advises opposition with the bank, a complaint to the police, Signal Spam and 33700, and gives Info Escroqueries on 0 805 805 817.
Last checked - Service-public.gouv.fr: Fraude à la carte bancaire (verified 13 February 2026)
What this confirms: Explains Perceval reporting via FranceConnect when the card is still in your possession and the 13-month refund limit.
Last checked - CNIL: Spam, hameçonnage, arnaques
What this confirms: Explains Signal Spam, 33700 and the role of PHAROS.
Last checked - Polizei: Onlinewache portal
What this confirms: Lets you report a crime online to the police of your German state, with an English option on the start page.
Last checked
About this guide
Message says your Japan hotel card failed? Check in the platform's own app: Booking.com won't ask for card details by message. If you've paid, act now.
Checked against platform, hotel, police and government sources on 18 October 2026. This page explains a reported pattern; it can't tell you whether one particular message is genuine. Japan, Booked. is independent, this page has no affiliate links, and it isn't legal or banking advice.
How we checked this
Sources and limits of this guide
These dated notes clarify what is confirmed by official sources—and what you still need to verify yourself.
If columns are cut off, scroll sideways. Keyboard: focus the table, then use Left/Right Arrow keys.
| Question | What we found | Where it comes from | What this means for your trip |
|---|---|---|---|
| Will Booking.com ask for my card details by message? | No. It says it will never ask you to share card details by email, phone, text or WhatsApp. | Booking.com: Safety tips for travellers | Update a card only inside your booking, opened yourself. |
| Can a real request have a 24-hour deadline? | Yes. When a hotel reports an invalid card, Booking.com emails and texts the guest to update it within 24 hours, and the hotel may cancel if it isn't. | Booking.com Connectivity docs: handling payment-related data | Check inside the app quickly rather than ignoring the message. |
| Has the cause of the 2026 messages been published? | Not when we checked on 8 October 2026: neither Booking.com nor the Japan Tourism Agency had published a finding. | J-CAST News (17 June 2026) | Treat any payment message as suspect until you check it yourself. |
| What should I set up before I travel? | Turn on two-factor authentication, and check any payment request inside the official app or site. | Booking.com: Safety tips for travellers | Save the hotel's phone number from its own website, and carry a second payment card. |
Based on official sources, linked below.
Guide updates Reviewed
When this guide was checked and what changed
- First published
- Last checked
- Check again by
- What we checked
- Booking.com, Expedia, Agoda and Airbnb pages, Hotel Sunroute Asakusa, Temairazu and Hotel Grand Hill Ichigaya notices, HKCERT, news reports from The Standard, J-CAST and the Bangkok Post, Japanese police and anti-phishing pages, and UK, French and German reporting services, checked 18 October 2026.
- Latest update
- : Rechecked on 18 October 2026: added the September 2026 Temairazu incident from the company's notice of 28 September 2026 and Hotel Grand Hill Ichigaya's notice of 29 September 2026, softened the April 2024 report of earlier hotel account takeovers to 'scores of hotels' because the figure could not be verified, and moved the source for the #9110 police advice line to the Tokyo Metropolitan Police Department page. Other dated facts were unchanged.
The date above reflects when these checks were last run. If an individual source was rechecked later, you’ll see that date next to it below. Other copy edits are listed in the update history.
Who edits this guide
One editor looks after this guide
Japan, Booked. is run and edited from Japan. The same editor checks the Japanese and English sources, writes the traveller-facing guidance and keeps the correction history up to date.
What changed
Update history
- Scheduled recheck
Rechecked on 18 October 2026: added the September 2026 Temairazu incident from the company's notice of 28 September 2026 and Hotel Grand Hill Ichigaya's notice of 29 September 2026, softened the April 2024 report of earlier hotel account takeovers to 'scores of hotels' because the figure could not be verified, and moved the source for the #9110 police advice line to the Tokyo Metropolitan Police Department page. Other dated facts were unchanged.
- Scheduled recheck
Rechecked on 11 October 2026: the dated facts in this guide were compared with their primary sources. Nothing had changed.
- Situation table
Added a “your situation, what to do” table, using only facts already in this guide. No facts were rechecked, so the review date is unchanged.
- First published
First published: the reported 2026 wave of fake hotel payment messages, what Booking.com, Expedia, Airbnb and Agoda say, how to tell real requests from fake ones, what to do if you entered card details and how to report it in Japan, the UK, France and Germany, checked against official pages on 8 October 2026.
If an operator, organiser or product changes in a way that affects the guide, we check it again sooner. Reader reports help us spot what to investigate, and we verify them against current official information before publishing. Read our update and corrections policy. See every guide's review schedule. Suggest an improvement to this guide.