Hotel booking phishing scams cost Singapore travellers S$185,000 since January

According to Mediacorp, the Singapore Police Force has recorded at least 148 cases of phishing scams involving hotels and hotel booking platforms since January, with victims losing at least S$185,000 in total.

Fraudsters impersonate hotels or accommodation booking platforms and contact targets mainly through WhatsApp or email. The message tells the victim to verify card details or confirm an upcoming booking.

What makes the message convincing

Some of these messages contain real details of the victim's hotel reservation. That single fact changes the entire interaction. A generic phishing text asks a stranger to trust a stranger. A message with the correct hotel name, correct dates, and correct booking reference asks a stranger to trust something that already looks true.

The scam depends on that detail landing before the victim thinks to check it elsewhere. Once it lands, the rest follows a familiar path: a link, a request for card details, and a reassurance that no money will be deducted. That reassurance is doing work. It answers the one objection a cautious person might raise, and it answers it before the person raises it.

Police said many victims only discover the fraud after unauthorised transactions appear on their card, or after contacting the hotel directly to ask about the booking. Contacting the hotel directly is the same step that would have stopped the scam in the first place. It just happened too late.

The step the scam depends on

The booking detail inside the message is not proof the message is genuine. It is proof the sender has access to the booking somewhere, through the platform, a leaked database, or the hotel itself. A real hotel does not need a link to confirm a reservation that already exists in its own system.

Police advised travellers to verify any message about a reservation directly with the hotel, using contact details published on the hotel's own website rather than anything supplied in the message. They also advised against clicking links in unsolicited messages, and flagged signs that a site may be fraudulent.

Other recommended safeguards include two-factor or multifactor authentication, setting limits on internet banking transactions, and using banks' Money Lock features to stop part of a saver's balance being moved digitally. Anyone who suspects they have been scammed should report the transaction to their bank immediately and inform the authorities.

This is the kind of pattern that automated monitoring is built to catch early: a message that arrives with real personal detail attached, asking for payment information through a link rather than a known channel. Spotting that pattern before the link is clicked is the point.

The public can use the ScamShield app or call the 24-hour ScamShield Helpline at 1799 to check a suspicious message or transaction before acting on it.