This is actually one of several scams targeting users of Booking[.]com (just calling it “Booking” for the rest of this), a popular site for booking travel (rental cars, hotels, flights, cruises etc). The particular version covered today is specifically aimed at people who have both Whatsapp and have booked on Booking, so I’m calling this the Booking-Whatsapp Travel Scam. Note that there are versions that come in via Booking’s messaging system (sent by compromised accounts), but this article is mostly focused on the version of the scam that comes via Whatsapp.

This scam is where you book a hotel or flight on Booking, and then a scammer reaches out to you on Whatsapp. They reach out to you stating that you have not completed something to do with your card, sends you to a fake website, has you enter your card number and expiration/expiry date, and then tells you you’ll receive two SMSes (which presumably they want you to give them). To make these more convincing, they use information about a trip you’ve booked - either a hotel stay or a flight. Note that you may see a version of this scam even if you don’t use Booking for flights as flight information isn’t that hard to retrieve.

(If you’re wondering about the [.], it’s a common way to avoid the site URL becoming clickable by accident.)

How to protect yourself
First of all, always book on the actual website of the location you’re staying at whenever possible. So if it’s a hotel, book it on the hotel’s website; if it’s a flight, book it on the airline’s website.

Secure your information on Whatsapp in the privacy settings so that scammers can’t locate you by your personal info such as your email. Enable 2-factor authentication on your account.

Be wary of any requests to re-validate payment or personal info. If the message is asking you to go anywhere other than Booking, don’t. Common sense applies here. Reach out to the place you’re staying or the airline to verify any requests.