That "confirm your payment" message after you booked: spotting Booking.com phishing

You book a place for next month, close the laptop, and an hour later a message arrives that looks like it came straight from the property. Your reservation is "on hold", and you need to "confirm your payment" or "verify your card" through the link below, or the room will be cancelled tonight. The wording is urgent, the booking details look right, and the link looks almost exactly like the real site. For a second, your finger hovers over it.

That message is the scam, not the booking. This guide does two things, and only two. First, it teaches you to recognise the fake "verify your card after you booked" message before you click — the small set of signs that give it away every time. Second, if you already clicked or paid, it gives you a fast first-aid sequence: the few moves that matter most, in the order that matters. None of this is a promise of an outcome, and none of it is legal advice: it's general information to help you decide what to do next.

Why the timing makes it work

Most online scams rely on a stranger catching you off guard. This one is harder to catch, because it arrives at the exact moment you're expecting a message about your booking — so it doesn't feel like a stranger at all. A few things make it land:

• The timing is perfect. The message comes right after you book, when a follow-up about your reservation is the most normal thing in the world. You're ready to act on it, not question it.
• The details look real. A phishing message often quotes your booking — the property name, the dates, sometimes a reference number. That information can leak when a property's own account is broken into, so the sender isn't guessing; they're reading your real reservation back to you. Booking's own privacy notice names this exact pattern: online fraud "typically involves social engineering and 'phishing' schemes" where "fraudsters pretend to be specific accommodations and request unnecessary payment."
• The fear is specific. "Your room will be cancelled unless you verify in the next two hours" targets the one thing you care about — keeping the booking you just made. Urgency is the engine of the trick: it's there to stop you pausing long enough to notice the link.
• The link is almost right. The address points at a lookalike page — something close to the real name but with an extra word or an odd ending added (a "verify"-style word tacked on, a hyphen where there shouldn't be one, a country code that doesn't fit). It opens a page that looks like the real checkout, and asks for your card.

And it can reach you on any channel a real booking update would: an email, an SMS, a WhatsApp message — even the in-app chat itself, when the property's own account has been broken into and a stranger is now typing from inside it. The channel never proves a message is genuine; only what it asks you to do does.

Every piece looks legitimate on its own. That's why spotting a typo is the wrong defence. The defence that always works is knowing one fact about how real payments move — and the rest of this guide is built on it.

The one fact the scam can't fake

Here is the fact, and it's worth memorising: on Booking.com, a real payment stays inside the platform. You pay through the official app or the official website, on a checkout you reached yourself — never through a link someone sent you, and never by typing your card into a page a chat message pointed you to.

This isn't only good advice; it's how the platform's own terms describe payment. Under the Payment terms (A8), when Booking handles a payment it does so itself, and that payment is the final settlement of what you owe — there's no separate "verification" step where you re-enter your card on an outside site afterwards. The Privacy terms (A10) point the same way: Booking's privacy notice tells you to contact Customer Service if you suspect fraud connected to your reservation, rather than act on a message asking you to "re-confirm" your card. So a message asking you to "verify" your card through an outside link isn't a stricter security check — it's the opposite of how the real thing works.

The same trick also wears a friendlier mask. Instead of "verify your card or lose the room," some messages promise money: "we owe you a refund for your stay — confirm your card details to receive it." It's the mirror image, and the one fact undoes it just the same. A real refund goes back to the card you paid with, handled on the platform's side; it never needs you to re-enter your number on a page a message pointed you to. Whether a message threatens to take the room or dangles a refund, judge it by what it asks you to do — not by how official it looks.

The red flags — a quick menu

You don't need to be technical to catch this. Most fake "confirm your payment" messages carry at least one of these signs, and usually several. Treat any single one as a reason to stop and check:

• It wants your card outside the app. This one sign is enough — the real platform never needs your card a second time through a link, however convincing the rest looks.
• It sets a clock. "Within two hours", "by tonight", "or your booking is cancelled" — the urgency exists only to rush you past the moment you'd notice the link.
• The web address doesn't match. An extra word, a stray hyphen, an odd ending; read it slowly, left to right. Some are very close, so don't rely on catching it.
• It asks for the full card number, the security code, or your password. No genuine booking follow-up needs these typed into a fresh form.
• The tone is off. No greeting with your name, clumsy phrasing, sudden worry about a payment that's already settled.

The single safest habit beats checking any of these: don't act on the message at all. Close it, open the official app or website yourself — not through the link — and look at the reservation directly. If something truly needs your attention, it will be there. If the reservation is fine, the message was the scam. When you're unsure, Booking's own advice is to contact Customer Service and ask, rather than click.

The message quoted my real booking details — doesn't that mean it's genuine?

No — and that's the cruel part. Scammers often have your real reservation data, because a property's own account can be broken into and the details read straight off your booking. Correct details prove nothing about who sent the message. Judge it by what it asks you to do: a request to pay or "re-verify" your card through an outside link is fake no matter how accurate the booking details look.

If you already clicked or paid — the fast first-aid sequence

Let's be honest about this part, because pretending otherwise wouldn't help you: money sent to a phishing scam is hard to get back. There's no guaranteed recovery, and anyone who promises one isn't being straight with you. But the speed of your next moves genuinely matters, and the order below puts the time-sensitive ones first. Several can run at the same time — start the bank call, then work the rest while you wait.

This is a recovery sequence, not a complaint ladder. You're not climbing from one body to the next; you're firing off a short burst of actions as fast as you can.

One more move that isn't urgent but helps the next traveller: if your reservation data was used to target you, leave an honest, factual review as a fair public warning. Booking lets anyone report problematic content for a case-by-case review, and a plain note — what the message said, that it came right after booking — is the kind of thing that protects the next guest. Keep it truthful and specific, not a rant.

Is asking my bank to review the charge a guarantee I'll get the money back?

No. The protection that comes with paying by card is a real route, and raising it fast gives you the best chance — but there's no guaranteed recovery on money sent to a scam. That honesty is the point: act quickly, keep the evidence, and treat a refund as possible, never promised.

Why card beats transfer, and where the rules sit

Two everyday protections stand behind you here, and it's worth knowing where each is strong and where it isn't.

The first is the protection that comes with paying by card. When a charge leaves your account, your card almost always has a dispute route — you can ask your bank to review it. For a stay that wasn't delivered or a charge you didn't agree to, that route is genuinely strong. For money you were tricked into sending to a scammer, it's weaker and slower, and the outcome is never certain — but it still exists, and it's still worth using fast. The short version: paying by card keeps a door open that paying by bank transfer or cash closes.

The second is the consumer and data-protection rules that already exist — the everyday rules that say your personal data should be handled with care, and that a platform can't sign those duties away in its small print. Booking's terms accept as much: mandatory consumer protections take priority over its own conditions (A19, A20). We're not a law firm and won't quote statute numbers at you, but the safety net is there. If your booking data was exposed and used to target you, you can read more in your own words — the network of European Consumer Centres publishes plain-language summaries country by country, and your national fraud-reporting service and data-protection body explain how to report a leak.

The property's account was hacked, not mine — whose problem is this?

It's still worth reporting it from every angle. Tell your bank about the charge, report the message to Booking so it can act on the compromised account, and flag a data exposure to the data-protection body. None of these is a guaranteed refund, but together they build a record — and a record keeps the question open instead of closing it.

If money did move and you want a clear, dated record — the message you received, when it arrived, what you did next, and a written request to your bank to review the charge — that's the part we can take off your hands: 2refund turns your answers into a clear request that's yours to send.

The cases in this article are illustrative composites, not real client records. We build them from the patterns we see again and again across the disputes we help with, because we can’t share real customers’ booking details. The stories are invented; the way they play out is true to our experience.

This article is general information, not legal advice. We’re a self-help tool, not a law firm. Rules, fees and deadlines change and vary by country, so always check the policy attached to your own booking and your local consumer protections.