A WhatsApp message that already knows your hotel’s name, your exact stay dates, and your real confirmation number is convincing travelers to hand over their card details this summer. Spanish authorities renewed their warning on August 13, 2026, about a scam that traces back to a Booking.com data breach that exposed the details of more than 4,000 travelers in April.

Discover safer travel with HomeExchange
💡
- An April 2026 Booking.com data breach exposed the details of more than 4,000 travelers, including about 300 cases with card information.
- Scam messages use the real hotel name, stay dates, and confirmation number to appear legitimate.
- Spain’s INCIBE and Guardia Civil renewed their warning on August 13, 2026.
- Victims are directed to fake payment pages designed to look like the hotel or Booking.com itself.

A Data Leak Turned Into a Ready-Made Script

The scam traces back to a Booking.com data breach in April 2026 that exposed the personal details of more than 4,000 travelers, including around 300 cases where payment card information was also compromised. Names, email addresses, postal addresses, and phone numbers ended up in criminal hands, giving scammers exactly what they need to sound credible.

How the Message Reaches You

Instead of a generic “your card was declined” text, travelers receive a WhatsApp message referencing their actual hotel name, their real stay dates, and a genuine confirmation number. The message claims there’s a problem with the payment and includes a link to a website designed to look like the hotel’s or Booking.com’s own payment page, where guests are asked to re-enter their card details.

A Second Source of Stolen Details

Investigators have traced the fraud to two separate sources: the April breach itself, and hotel staff accounts compromised separately through phishing or malware. That combination means the scam isn’t limited to travelers who stayed during the breach window, and authorities warn it remains active going into late summer.

Spain’s Warning, Renewed in August

Spain’s National Cybersecurity Institute (INCIBE) and the Guardia Civil renewed their alert on August 13, 2026, confirming the campaign is “still active this summer.” The Spanish consumer group OCU has logged complaints from travelers who lost hundreds of euros after trusting messages that contained accurate stay details.

How to Protect Yourself

Authorities recommend verifying any WhatsApp sender’s number against the hotel’s official contact details, checking that a payment link’s web address matches the legitimate hotel or platform exactly, and never entering card details through a WhatsApp link for an existing stay. Suspicious messages can be reported to the Policía Nacional or Guardia Civil, or flagged through INCIBE’s helpline.

Experience the Authenticity of Travel with HomeExchange

With HomeExchange, you can live that rhythm like a local. Choose from a traditional house, a beachfront villa, or an urban apartment in the heart of a city. Each home offers a unique perspective.

HomeExchange lets you experience true belonging while saving on accommodation costs. Immerse yourself in the local community and enjoy the comforts of a home away from home.

Discover how HomeExchange works