Quick Verdict: Real booking details do not prove a payment message came from your hotel. Open your booking independently and confirm the request before entering card information.
Got a message saying your hotel booking will be cancelled?
Stop at the payment request. A message can quote your name, arrival date and confirmation number accurately and still lead to an impostor’s card-entry page. Do not use its link or reply with payment details just because the reservation information matches.
Open the booking app or website yourself, or locate your original confirmation. Contact the hotel through a number you independently obtain from its official website or that original confirmation. Ask whether the hotel sent this particular request, what payment is due, and how to complete it through its verified process. A deposit or card preauthorization can be legitimate; the question is whether this request is authorized.
What RMS has confirmed
RMS, a hospitality software provider, reported unauthorized access identified October 26, 2026. Its findings identify some guest contact and booking information; RMS says credit-card and payment details were not involved in the accessed data.
The latest incident update we checked, posted November 13 at 04:41 UTC, says the incident remains contained with no evidence of continuing unauthorized activity. Assessment of affected data and customer notifications were still progressing. That is not confirmation that every traveler or booking platform was affected.
RMS’s October 28 security alert and subsequent guidance describe email, text and WhatsApp messages that reuse booking details and ask for payment confirmation. A phishing page can collect a card you enter later even when stored payment data was not part of the original incident.
Check the request, not just the logo
- Compare the payment history. Have your original receipt ready. Ask the hotel to explain any new charge, including its amount and purpose.
- Do not let a countdown decide. A cancellation threat is a reason to verify promptly, not to skip verification.
- Check the destination. A hotel name in a link’s text is not proof of who operates the linked website. Avoid opening it just to investigate.
- Keep evidence privately. Save the message, sender address, date and displayed link for the hotel or your payment provider. Do not post a reservation number publicly.
If you entered card details
RMS advises contacting your financial institution immediately. Explain which details you entered and whether a charge appeared, then follow the issuer’s instructions. Confirm the reservation separately with the hotel; dealing with a suspicious payment does not tell you whether your room remains booked.
Hotel booking scam questions
Does a real confirmation number prove the message is genuine?
No. Reservation details can be copied or exposed. Independently confirm the specific payment request with the accommodation provider.
Does this mean Booking.com or every hotel was breached?
No. The cited incident concerns RMS. It does not establish a breach of every booking platform or identify every affected property.
Can readers help identify new messages?
Yes. Share the wording, sender domain, approximate date and hotel-confirmed outcome, including genuine or resolved requests. Remove names, booking numbers, travel dates that identify you, contact details and payment information. Reader reports are not automatically verified.
Official RMS incident information checked November 14, 2026. This independent guide does not authenticate a particular message or guarantee a booking or refund.
Leave a Reply