A WhatsApp message arrives with your full name, your hotel, your exact travel dates — sometimes even the amount you paid. It asks you to "confirm" the reservation or verify your card through a link.
So it must be real, right?
No. A message that carries your correct booking details can still be a scam. Accurate names, hotels, dates and prices prove only one thing: the sender has your booking data. They do not prove the sender is your hotel, your airline or your booking platform. Verify the booking by opening your booking account or the hotel's own website yourself — never through the link in the message.
Two events in October 2026 show how common this has become, on two different continents, in two different languages.
What Happened: TUI Belgium and Singapore, October 2026
Belgium. On 14 October 2026, TUI confirmed a data breach affecting its Belgian operations after customers received fraudulent WhatsApp messages that carried accurate full names, booked hotels and exact travel dates — and in some cases the reservation amount. Reporting by FTN News, citing Dutch news agency ANP, says the company indicated the messages targeted Belgian customers. What TUI has not confirmed matters just as much: whether the fraudsters' data actually came from the breach, whether there was direct system access, how many customers were affected, or exactly which data was taken. TUI's guidance, as reported by FTN: the company will not ask customers to pay for a booked holiday or flight by bank transfer named in an unsolicited message; customers should not hand over their booking number, lead-passenger surname or flight dates; and anyone worried should open myTUI themselves or use official channels. As FTN put it, an accurate hotel name, reservation date or payment amount does not establish that a message is genuine. Belgium's Safeonweb gives the same advice, and Belgian victims who already shared banking details can call Card Stop at 078 170 170.
Singapore. On 9 October 2026, the Singapore Police Force issued an advisory on phishing scams involving hotels and hotel booking platforms: at least 148 cases and at least S$185,000 in losses since January 2026. Most approached victims on WhatsApp or email, impersonating hotels or booking platforms and asking them to verify card details or confirm upcoming bookings — and some of those messages contained legitimate booking details. The phishing pages assured victims that "no funds will be deducted"; victims typically discovered the fraud only after unauthorised card charges appeared and they checked with the hotel directly. SPF's rule: verify with the hotel using the contact details on the hotel's own webpage, never click links in unsolicited messages, and call the ScamShield helpline at 1799 with questions.
Different countries, different operators — same playbook, and in both cases the messages could pass the "do they know my booking?" test.
Why Correct Details Fool People
For years, the standard advice was: a real confirmation includes your booking details, so if the message knows your hotel and dates, it's probably genuine. That heuristic is now the trap.
Booking data leaks. When a platform or agency is breached, reservation records — names, hotels, dates, amounts — end up in scammers' hands, and from there personalising a phishing message is trivial. We covered the mechanism in our piece on the Booking.com breach and how stolen data gets reused. The Singapore advisory explicitly noted that some scam messages contained legitimate booking details, and the TUI case turned on the same fact.
So flip the old rule: correct details are no longer evidence of authenticity — they are the bait. The thing to verify is the channel, not the data.
The 60-Second Check
Before you touch anything in a booking message that asks you to act:
- Don't tap the link, button or number in the message. That includes "unsubscribe" links and any phone number shown in the message itself.
- Open the booking app or site yourself. Type the address or use your own bookmark, log in, and read the reservation there. If the booking is real and needs attention, it will show up in your account.
- If it's a hotel, call the hotel — from its own website. Use the number published on the hotel's official site, not the one in the message. The Singapore Police Force advisory makes exactly this the core rule.
- Ask what's being requested. A real company will not demand a bank transfer or card "verification" over WhatsApp to keep a booking you already paid for.
- Treat "no funds will be deducted" pages as confirmation of fraud. A page whose entire pitch is that entering your card is safe — that's the scam, per the SPF advisory.
If the reservation checks out in your own account and no payment is requested, you're done. If anything in the message asked for money, card details, OTPs or booking references, you now have your answer.
Red Flags Even When the Details Are Right
- A brand-new chat with no history. If you've messaged the hotel or platform before, check the chat history — fraudsters arrive in fresh threads.
- Urgency. "Confirm within 24 hours or your booking is cancelled" is pressure, not process.
- A lookalike domain or sender. One swapped letter in the platform's name is the whole trick.
- Requests for OTPs, booking numbers or the lead passenger's surname. These are exactly the items TUI told customers not to hand over, per the FTN report.
- A payment method that differs from how you originally booked. You paid by card at checkout; nobody legitimate later needs a bank transfer to "secure" the same reservation.
None of these flags fires on the details being right — which is why the channel check in the 60-second list comes first, every time.
Get the weekly scam alerts — new booking and phishing scams, verified before they reach your inbox. Join the newsletter.
If You Already Clicked or Paid
Act on the money first, the report second:
- Call your bank or card issuer immediately. Ask them to block the card, flag the fraudulent charge, and start a chargeback or reversal. Speed matters more than anything else at this stage.
- In Belgium, Card Stop at 078 170 170 is the number to stop card payments, per the FTN report on the TUI case.
- In Singapore, the police advisory directs victims to report to their bank and contact the ScamShield helpline at 1799.
- File a police report in your own jurisdiction — banks and insurers typically want the reference number.
No legitimate "recovery service" can claw the money back for a fee; anyone offering that is running a second scam on the first one.
This Is Not the Same Scam As…
Two neighbouring scams get confused with this one, and the difference is worth 10 seconds:
- Fake travel agents — there, the trip is fake: an agency sells you a booking that never existed. Here, the booking is real and the message is fake. See our guide to fake travel agent scams.
- Booking.com address bait — there, the listing itself is the lie: a wrong address, a landmark photo, a private home. No phishing message required — the trap is in the listing before anyone messages you.
And for the platform-specific variant — fake property-manager WhatsApp threads that pressure you into off-platform payments — see our dedicated Booking.com WhatsApp scam guide. This post is the general rule: any hotel or platform, any channel, details correct or not. The general phishing scams targeting travellers survey covers the wider family, and our 12-step safe booking checklist covers prevention before you pay.
Frequently Asked Questions
Can a WhatsApp message with my real hotel and dates still be a scam?
Yes — that's the entire point of this variant. Correct details show the sender has your booking data, which they can get from breaches and leaks. Verify through your booking app or the hotel's own website, never through the message.
How do I check a booking message without clicking its link?
Open the platform's app or site by typing the address yourself and read the reservation there. For hotels, call the number on the hotel's own website. Singapore's Police Force advisory is explicit: verify using the hotel's own webpage, don't click unsolicited links.
Will a real hotel or tour operator ask me to re-pay or "verify my card" on WhatsApp?
No. TUI's own guidance, as reported, is that it will not ask for bank-transfer payment of a booked holiday via unsolicited messages. "Verify your card to keep your booking" and "no funds will be deducted" pages are the fraud.
What should I do if I already entered my card on the link?
Contact your bank immediately to block the card and dispute the charges — Card Stop 078 170 170 in Belgium, bank plus ScamShield 1799 in Singapore — then file a police report.
Does a data breach mean every message about my booking is fake?
No. Treat every unsolicited message as unverified and verify the channel yourself. Correct details don't make a message real, and imperfect details don't automatically make one fake — the channel is what you check.
What's the difference between this and a fake travel agent?
A fake agent sells you a trip that doesn't exist; in this scam your trip is real and the message about it is a phishing attempt.
This article is general safety guidance, not legal or financial advice. Figures are attributed to the Singapore Police Force advisory of 9 October 2026 and FTN News' reporting of 14 October 2026 on the TUI Belgium case; TUI has not confirmed that the breach supplied the data used in the scam messages.