A Booking.com or Airbnb message asking you to pay again? How to tell it is a scam

The message looks right. It arrives through the booking app or from what seems to be your hotel, it knows your dates and your name, and it says the payment failed: confirm your card in the next 24 hours or lose the room. This is one of the commonest ways a trip gets ruined before it starts, and the platforms themselves describe it in almost exactly those words. Here is what Booking.com, Airbnb and Vrbo say they will never ask, how to check a request in two minutes, and what to do if you already clicked. Everything below is from the platforms' own help pages and government fraud agencies, checked on 7 November 2026.

What the scam looks like

Booking.com warns that these messages "most often claim to come from the accommodation", and that they "typically come with urgent requests to (re)share payment information in order to retain your booking". Its own example of the wording: "transfer the money to a bank account within 24 hours or the booking will be canceled". They can come through WhatsApp, text, phone or email, not only through the app.

The reason the message knows your booking is that it often really does come from inside the system. Booking.com tells hotels that account takeover is "frequently a result of phishing" of the hotel's own account, and that it "can result in fraudulent transactions and unauthorized access to guest details". Airbnb says fake messages "often have an urgent tone and threaten consequences, like account suspension, loss of a reservation" and can "contain links to fake Airbnb web pages that try to steal your information". Australia's Scamwatch describes "very convincing fake versions of the site" built to collect banking details.

What the platforms say they will never ask

• Booking.com: "We'll never ask you to share credit card details by email, over the phone, through text or WhatsApp." It will never ask for "a bank transfer that is different from the payment policy details in your booking confirmation", and "no legitimate transaction ... will ever need you to pay specifically with gift cards". Its customer service will only ask for your reservation ID and PIN.
• Airbnb: hosts "may not ask or encourage another user to send or receive payments outside of Airbnb", and Airbnb will never call to ask for one-time codes, passwords or payment details. Pay outside the platform and you lose its protection. One nuance: some listings disclose separate charges, such as a hotel deposit, but "all mandatory charges must be included in the listing's price breakdown at checkout".
• Vrbo: "We will never ask you to make a payment outside of our secure system."

How to check a payment request in two minutes

1. Do not use the link or the number in the message. Open the official app, or type the site's address yourself, and look at the reservation there. Booking.com: "you can easily check your reservation status directly on the official website or app." The FTC says the same: "type in the URL yourself; don't click the link."
2. Compare it with your confirmation. The prepayment, deposit and payment method are in the booking confirmation. A request for a different payment, a second payment or a bank transfer is the scam. Booking.com: "Reputable platforms never ask for double payments."
3. Check the whole sender address, not the display name. Airbnb lists the addresses it sends from on its help page and says anything else is not from Airbnb.
4. Ask the platform through the platform. "If in any doubt and before taking any action, contact our Customer Service team" (Booking.com). Use the contact details on the official site, never the ones in the message.

If you already clicked, entered your card or paid

1. Call your bank or card issuer now. Ask them to block the card and stop or reverse the payment. Australia's Scamwatch: "Contact your bank or credit card provider now and tell them to stop any transactions." Speed matters; the FTC warns that once scammers have the money, "it's almost impossible to get it back".
2. Secure your account. Booking.com: "Reset your password ... and make sure to enable two-factor authentication."
3. Tell the platform, through its official help centre, so its security team can act on the property's account. Airbnb takes fake website addresses at airbnb.com/report-phishing.
4. Report it to the national fraud agency: in the US, ReportFraud.ftc.gov; in England, Wales and Northern Ireland, Report Fraud, as the UK's National Cyber Security Centre now directs, with scam emails forwarded to report@phishing.gov.uk and scam texts to 7726; in Scotland, Police Scotland on 101; in Australia, Scamwatch; in Canada, the Canadian Anti-Fraud Centre's reporting system.

If you paid by US credit card for a booking you never got, the 60 day written dispute rule in our guide to what you can claim applies.

Warn the next traveler

If a fake payment message reached you, the useful detail for the next person is which platform, which city and what the message said. Add it to the travel warnings; it takes one sentence.

Sources: Booking.com, trust and safety for travellers, Booking.com, avoiding hotel scams, Booking.com, safety for partners, Airbnb, phishing and spoofed messages, Airbnb, paying outside the platform, Vrbo, smishing and vishing, FTC, what to do if you were scammed, NCSC, reporting scam emails, Scamwatch, Canadian Anti-Fraud Centre.