Our daily scam attempt for today.
I wake up in the morning and see a WhatsApp message saying I need to confirm my hotel booking for our upcoming trip. The name is right, the hotel is right, the dates are right. And then you start reading the message and see that it stinks.
The original version was a post in Hebrew on X, published August 26, 2026.
How did I know the booking message was fake?
- The booking number: it's my phone number. They had the booking details but not the booking number itself, so they pasted the only field they did have and hoped nobody checks.
- The link led to
travel.pay-id9349.com, not tobestwestern.com. Classic credit card harvesting, wrapped in "you won't be charged, it's just a verification check". - The WhatsApp sender is just some random person, not BWH, and also different from whoever signed at the bottom of the message.
Where did they get my booking details?
I checked with Claude and it wrote that BWH announced a breach in May that covered bookings from October 2025 to April 2026. My booking is after that date, after they took down the compromised system.
There's a chance that whatever leaked there didn't stop leaking in April.
The rule for hotel bookings
If you have a hotel booking this year, the rule is simple: no hotel will ask you to verify a credit card through a link in a message. Go to the website directly.
I sent them an email with the whole story. Curious what they'll answer.
Another one from the same week, a fake Cloudflare check my mom ran into: ClickFix: The Fake Cloudflare Check That Asks You to Press Win+R.
FAQ
Do hotels ask you to verify your credit card through a link in a WhatsApp message?
No. No hotel will ask you to verify a credit card through a link in a message. Go to the hotel's website directly.
How can you tell a hotel booking confirmation message is a scam?
In my case three things gave it away: the booking number was my phone number, the link led to travel.pay-id9349.com instead of bestwestern.com, and the WhatsApp sender was a random person who didn't match the name signed at the bottom of the message.