In this guide · 8 sections
- 01What the SPF advisory of 9 October 2026 says
- 02How scammers get your real booking details
- 03Signs your booking platform account has been taken over
- 04Protect your extranet and email accounts
- 05Train front-desk and reservations staff
- 06What to tell your guests
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Since January 2026, at least 148 cases and S$185,000 in losses have been reported. Hotels should lock down booking platform accounts with app-based 2FA and individual logins, train front-desk staff, and tell guests clearly that you will never ask for card details through a link.
What the SPF advisory of 9 October 2026 says
The SPF advisory on phishing scams involving hotels and hotel booking platforms was issued on 9 October 2026. It reports at least 148 cases since January 2026, with total losses of at least S$185,000.
The guest gets a message that looks like the hotel
Mostly by WhatsApp, sometimes by email, from someone posing as the hotel or the booking platform.
The message quotes a real booking
The SPF notes that some messages contained legitimate booking details, which is why guests trust them.
The guest is asked to 'secure' or 'verify' the booking
A link leads to a phishing page, with a promise that no money will be deducted.
Card details are entered and transactions authorised
Victims only notice when unauthorised charges appear, or when they check in and the hotel knows nothing about it.
The advisory is written for the public, so it tells guests to check with the hotel through official contact details and to call the ScamShield Helpline on 1799. For the business side, the useful question is where the scammers got the real booking details.
How scammers get your real booking details
The SPF advisory does not name a single cause. Booking platforms' own partner guidance explains the most common route: phishing aimed at the property's staff, not the guest.
- Fake platform emails to staff. Booking.com's partner page on phishing and email spoofing says scammers mimic its emails to steal extranet usernames and passwords, using login pages that look real but have a different web address.
- Malware on a front-desk PC. The same page warns that not all phishing steals passwords directly: some emails carry files with malware, spyware or ransomware, so a device that opened one should be scanned.
- Shared logins and SMS codes. One login shared by the whole front desk, with 2FA codes going to one phone, makes it hard to spot misuse and easy for a stolen password to work.
- Third-party tools. Channel managers and property management systems hold the same reservation data, so a weak password there exposes bookings too.
Once inside an extranet account, a scammer can read reservations and, on some platforms, message guests through the platform's own chat. Booking.com says that if it detects suspicious activity on an account, it disables links in messages the property sends to guests, precisely to stop fake payment links.
Signs your booking platform account has been taken over
Booking.com lists these warning signs in its guide to preventing unauthorised use of your account. Other platforms show similar signs.
Check these this week
Protect your extranet and email accounts
These steps come from the platforms' own partner security pages, plus the basics that protect the email inbox those platforms send resets to.
Give every staff member their own login
Booking.com recommends individual extranet accounts instead of shared ones. Remove leavers on their last day.
Switch 2FA to an authenticator app
Booking.com's account security page explains why app-based codes (TOTP) are safer than SMS. Do the same for email: see our MFA set-up guide.
Bookmark the real login page
Staff should open the extranet from a bookmark, never from a link in an email. A password manager helps here, because it will not fill a password on a fake site.
Secure the email inbox first
Password resets go to email. Turn on MFA for the reservations inbox and check it for unknown forwarding rules.
Update and protect front-desk PCs
Keep the operating system and browser updated and run endpoint protection, as the platforms recommend.
Reset passwords on connected tools
If anything looks wrong, also reset the channel manager and property management system passwords.
Our password manager guide covers how to share logins safely when a shift team genuinely needs access to the same tool.
Train front-desk and reservations staff
Most of these attacks begin with a message to staff, so a short briefing goes a long way. Cover three rules: the platform will never ask for your password or 2FA code; open the extranet only from a bookmark; and report any odd login page or attachment straight away instead of trying again.
Booking.com notes that its partner service staff will only ever ask for your property ID, never your password. Put that line on a card at the front desk. Our guide on how to spot a phishing email has examples you can use in the briefing.
What to tell your guests
Guests are the ones who lose money, and they will blame the hotel. A short message in your booking confirmation and pre-arrival email reduces the risk.
- We will never ask you to enter card details through a link sent by WhatsApp or SMS.
- If you get a message about your booking that asks for payment, call us on the number on our website.
- Our official contact details are: [phone, email, website].
- If you think you have been scammed, call your bank immediately and the ScamShield Helpline on 1799.
If guests report a fake message, ask for a screenshot, report it to the platform and check your account for the warning signs above. If your WhatsApp Business number itself was taken over, our guide to recovering a hacked WhatsApp or social media account walks through it.
Do it yourself or get help?
A small guesthouse can do most of this in an afternoon: individual logins, authenticator-app 2FA, bookmarks, a guest notice and a 15-minute staff briefing. The harder part is the email and device side, where one weak mailbox can undo everything else.
Our Security Awareness Training (S$390) gives your team a short, Singapore-specific session on phishing and fake login pages with a one-page policy. Microsoft 365 / Google Security Lockdown (S$590) secures the mailboxes that platform resets go to, with MFA, forwarding-rule checks and admin clean-up.
Frequently asked questions
The Singapore Police Force said on 9 October 2026 that at least 148 cases had been reported since January 2026, with total losses of at least S$185,000. Most victims received WhatsApp messages or emails impersonating hotels or booking platforms and were asked to verify card details through a phishing link.
The SPF advisory does not give a single cause. Booking platforms explain that scammers often phish hotel staff for extranet logins or infect a staff computer with malware, then read reservations. That is why individual logins, app-based 2FA and updated, protected front-desk computers matter so much.
That depends on the facts and is a legal question we cannot answer for you. What is clear is that if personal data in your systems was accessed by an unauthorised person, you must assess the incident under the PDPA, and you should report the account compromise to the booking platform within its stated time frame.
Yes. Booking.com says setting up 2FA is mandatory when registering a partner account, and it may ask you to repeat verification several times within 24 hours. It explains that codes from an authenticator app are safer than SMS codes, because they expire quickly and are created on your device, while SMS codes last longer and can be read by others.
Run updated anti-malware on front-desk devices, reset the email password, then reset the booking platform password, and check for changed details or new users. Report it to the platform's security team within 24 hours and reset passwords for connected tools such as the channel manager or property management system.