Fraudsters Now Use WhatsApp to Scam Rental Guests

Fraud tied to online travel bookings has risen sharply over the past few months, and the method has changed. Criminals are moving away from mass phishing emails and toward WhatsApp messages that quote a guest's actual reservation details - dates, property name, sometimes even the host's name - making the approach far harder to spot as fake.

How the scam actually works

The pattern reported across several markets starts with stolen or leaked booking data, often pulled from a compromised property manager account on an OTA extranet, or harvested through an earlier phishing email sent to the host. Armed with real reservation details, the scammer then contacts the guest directly on WhatsApp, posing as the property or the platform, and asks them to "confirm" a card or pay a deposit through a link that leads to a fake payment page. Because the message references genuine booking information, guests have little reason to doubt it.

What changes for hosts and property managers

Extranet and dashboard accounts are the weak point criminals are exploiting to get at that reservation data in the first place. Hosts should turn on two-factor authentication wherever Airbnb, Booking.com or Vrbo offer it, and treat any email asking to "verify" login credentials or account details as suspect by default. Guests should be told upfront, ideally in a pre-arrival message, that no payment request will ever arrive by WhatsApp or text and that all transactions run through the official platform. Any account activity that looks off - password reset emails not requested, unfamiliar devices, messages sent that the host didn't write - should be reported to the platform's support line immediately, not investigated after the fact.

Why the target has shifted to guests

Platforms have gotten better at flagging suspicious account behavior on the host side, so fraud attempts are increasingly aimed at the person least likely to recognize a fake: the traveler. That shift matters commercially as well as operationally. Chargebacks and disputes stemming from a scam still land on the property's account, and guests who get burned tend to blame the listing, not the criminal who impersonated it. A short, plainly worded warning in the booking confirmation costs nothing and heads off a conversation nobody wants to have after a guest has already handed over card details to a stranger.