In short
Fake holiday deals on social media, hijacked hotel messages and flights that don't exist. How holiday booking scams work, and how to book and pay safely.
Top warning signs: The price is far below similar places or trips; You're asked to pay by bank transfer, gift card, payment app or crypto; A message asks you to re-enter your card or pay again.
First thing to do: If a message asks you to pay again or confirm your card, don't use the link. Open the booking platform's app or website yourself and check the booking there, or contact the platform's customer service.
How the scam works
The most common holiday scams are fake deals: accommodation, flights or package holidays that don't exist, advertised at prices that look like a bargain. In 2024, people in the UK made 6,066 reports of holiday fraud to Action Fraud and lost £11,183,957, an average of £1,844 each. Over half of the reports mentioned social media.
A newer version starts after you've booked. Criminals break into a hotel's or host's account on a booking platform and send guests messages from inside the real app, saying the card failed and the booking will be cancelled unless you pay again through a link. Because the message sits alongside your real booking, it looks genuine. Which? reported on victims of this in 2025.
Other versions include fake travel agents that use the ATOL, ABTA or ABTOT logos without being members, tickets for flights that were never booked, and "free holiday" prizes that need an upfront fee.
Red flags to look for
- The price is far below similar places or trips. Compare with the same dates on well-known sites. A big gap is the lure.
- You're asked to pay by bank transfer, gift card, payment app or crypto. The US Federal Trade Commission says not to pay anyone who insists on these, because the money is almost impossible to get back.
- A message asks you to re-enter your card or pay again. Even inside the booking app. Never share card details through a link or a chat message; check the booking in the platform's own app instead.
- A deadline to pay or lose the booking. "Cancelled in 24 hours" is designed to stop you checking with the platform first.
- The deal is only on social media. No website you can check, no company details, and the "agent" moves the conversation to WhatsApp or DMs.
- Protection logos you can't verify. Anyone can paste an ATOL, ABTA or ABTOT logo on a page. Check the membership number on the scheme's own website.
- The host wants to deal outside the platform. Paying outside the platform means you lose its protection. Real hosts don't need to.
What to do if you get one
- If a message asks you to pay again or confirm your card, don't use the link. Open the booking platform's app or website yourself and check the booking there, or contact the platform's customer service.
- Paste the link or the website into the TapSafely checker to see who owns it and how new it is.
- Book through well-known platforms or travel companies, and keep all payments and messages inside the platform.
- Check a travel company's ATOL, ABTA or ABTOT membership on the scheme's own website, not on the company's page.
- Pay by credit card. Avoid bank transfers, and never pay by gift card or crypto.
- Search the property's address and photos online. The same photos listed elsewhere under another name are a warning sign.
When the message comes from your hotel's real account
In the hijacked-booking scam, the message may really come from the hotel's account on the platform, because criminals have taken it over. That's why the sender's name is no proof. What gives it away is the request: pay again, confirm your card through a link, or do it within hours. Check your booking in the platform's own app, and if in doubt, phone the hotel on a number you find yourself.
Renting a flat for longer?
Long-term rentals have their own tricks, like deposits for places you can't view. See rental scams.
If you already paid or shared details
Act quickly. It makes a difference.
- Call your bank or card provider now, using the number on your card. Ask them to stop the payment or start a chargeback.
- Tell the booking platform straight away through its app or website, not by replying to the message.
- If you entered your booking account password on a link, change it and turn on two-step verification.
- Report it to the official fraud service in your country. Our what to do after a scam page lists them.
- Check whether your travel insurance or a scheme like ATOL covers you, and keep every message and receipt.
More help: what to do after a scam, and where to report it in your country.
How to protect yourself next time
Watch for anyone using your identity
If you shared ID documents, card details or a Social Security number, monitoring can alert you when someone opens credit or accounts in your name.
Free: In the US, a credit freeze at Equifax, Experian and TransUnion is free and blocks most new-credit fraud. Elsewhere, ask your bank and your credit reference agency about fraud alerts.
- Aura Partner link US identity theft protection with credit monitoring and fraud insurance.
Keep security software with web protection on your devices
It blocks many known scam and malware websites and warns about dangerous apps. That matters most if you installed an app or "support" tool someone asked you to.
Free: Keep your phone and browser updated, and leave Google Play Protect or Microsoft Defender switched on. Both are free.
- Bitdefender Partner link Security suite for phone and computer with web and scam protection.
Compare the tools that help, and what each costs
Links marked Partner link may earn us a commission, at no cost to you. It never changes our advice, and the free option always comes first. Affiliate disclosure.
Questions people ask
My hotel messaged me in the booking app asking to confirm my card. Is it real?
Treat it as a scam until you've checked. Don't use the link. Open your booking in the platform's own app or contact its customer service, and never share card details in a chat.
Is a holiday deal on Facebook or Instagram safe to book?
Only if you can confirm the company is real, and you pay in a way you can reverse. Over half of UK holiday fraud reports in 2024 mentioned social media.
How do I check an ATOL or ABTA logo is real?
Look the company up on the ATOL or ABTA website using its membership number. A logo on the company's own page proves nothing.
Can I get my money back after a holiday scam?
Sometimes, if you act fast. Call your bank or card provider straight away. Credit card payments are the easiest to dispute.
Have you had this one?
Tell other people what the message said and how it reached you. It helps someone recognise it before they tap.
No stories yet. Yours could be the one that warns someone.
Official sources and further reading
We check our guides against advice from government agencies and consumer protection bodies.
- Don't let fraudsters trip you up this summer: new alert issued as people look to snap up online holiday deals (ATOL (UK Civil Aviation Authority), with Action Fraud figures)
- Scam alert: why you can't trust that 'Booking.com' message (Which?)
- Avoid Scams When You Travel (US Federal Trade Commission)
