Cowork recap: when scammers message your guests for payment on your behalf
During our big Hostelworld conference last week (and following it) many of us went into crisis mode when our staff told us they were hearing from confused guests who’d received WhatsApp messages in the hostel’s name, with their real booking details, asking them to confirm their reservation and to pay for their stay. This isn’t something unheard of or new but this time it was global and not isolated to one hostel account being breached! So @Bruno Portocarrero gave his week’s coworking to talk about it and work through it together.
Hostel managers and owners from different countries joined. Some were in the middle of it, some had been through it before, and some hadn’t been hit but wanted to be ready. Even industry partners joined to listen and take hostels’ feedback back to their teams and see how they could support. The hour went fast! Some were comparing notes on what was happening while others shared what had helped for them.
New to this kind of scam? The background is further down.
What came out of the call (and our community chats so far)
No single source. Affected hostels were on different PMSs and got bookings from different channels, and although some speculations were that a check-in tool was attacked there was no clear link found there either.
The pattern was the same everywhere. WhatsApp messages with names, dates and reservation numbers, but no card details. A first message asking to “confirm the reservation”, then the payment request. Sending numbers that changed every few days.
Warning guests early worked. Hostels that emailed every upcoming guest found that most of them checked before doing anything. The template and wording are in the community thread linked below.
Guests who’d already paid can have mixed luck getting it back from the bank. Some said their guests were able to get their money back through their bank while others were refused because they’d entered their card details themselves into a payment portal.
“Do we owe them anything?” was a big debate. If guests fell for the scam, some said they would offer a free night or drinks, some would point guests to their bank and help them report it. Most agreed it depends on whose fault it was, how many guests were hit, and how it would affect business (case by case rather than a set policy).
What hostels want from the platforms: educating guests during the booking process to these scams and how to avoid them if it happens, and keep guest contact details available to properties behind two-factor authentication rather than removing them.
Background: what a reservation hijack scam is
Scammers breach real booking data and contact guests pretending to be the property or the booking platform, mostly on WhatsApp, sometimes by email or SMS. It can start in two ways. Either a property’s own accounts are compromised, usually after a phishing click, or the leak happens upstream, at an OTA, channel manager, PMS or connected tool, and guests’ details get out even though the property did nothing wrong.
This time it was happening worldwide so it was a 3rd party breach that spanned many properties globally. Guests were contacted through several OTAs and through direct bookings. Police in Singapore and the Basque Country issued public warnings, and on 21 October the European Commission opened an investigation into Booking.com over how it protects customers from scams like these. At the time of writing, one PMS provider had told its customers it believed it had found how the data was accessed, but no company had published a statement explaining the whole wave. Since 28 September 2026, Booking.com no longer sends guest phone numbers to connected systems.
Where to go from here
The conversation is continuing in the community thread on what to do when scammers get your guests’ booking details. That’s where operators are sharing updates, templates and what’s working. If this is happening to you, start there, and add what you learn for the next hostel.
Lior is also turning what we learned into a step-by-step guide for hostels on the hostel.consulting office, with ready-to-use templates to go with it.