Earlier this year, Booking.com confirmed that unauthorized parties had accessed some guests’ booking details. Cybersecurity firm Norton calls the scam “reservation hijacking”: criminals pretend to be the hotel and use a real booking as the hook, to get guests to pay for a reservation problem that doesn’t exist.Norton’s warning is that real booking data makes these scams far more convincing. When a message names the right hotel, the right dates and the right contact details, it feels like routine customer service.

That’s the uncomfortable truth about reservation scams today: correct information is no longer proof that a message is genuine. When fraudsters can quote your guest’s name, dates and hotel back to them, tone, channel and consistency are often the only signals guests have left.

We’ve seen how easily this can happen. Ahead of a trip to France, one of our own team members received a WhatsApp message from an unknown number about his hotel booking. The hotel name and dates were right, and it asked him to follow a link.

“I completely understand why so many people click those links. Everything looked right, from my dates to the hotel’s name. But the tone felt off. It simply didn’t sound like the French hotel I had booked.”

He didn’t click. The wording and the unfamiliar sender didn’t match the hotel he had chosen. If every message a guest gets from you sounds the same and comes from the same recognisable sender, one that breaks the pattern stands out. Here’s where we would start:

Sound like yourself, every time
Use the same tone, wording and sign-off across your booking confirmation, pre-arrival message and everything after.

Stick to a recognisable channel
Choose a main channel for pre-stay communication and use it consistently, so a message from somewhere else feels out of place.

Tell guests what to expect
Say in your booking confirmation which messages will come, from where and when.
A guest who gets something different knows to stop and check.

Protect your own accounts
Many of these scams start with a phishing email to hotel staff. Remind your team to use strong, unique passwords stored securely, turn on two-factor authentication, and never open links or attachments from outside your booking systems.

Good communication doesn’t only help guests check in faster. It helps them trust that the message in their inbox is really from you.