The host wants a direct transfer: how to protect your reservation

The message can look entirely convincing because it includes your real name, your dates, and the correct price. It claims your card failed, that a deposit is now required, or that the booking will be canceled unless you pay a different way. On Booking.com specifically, criminals sometimes compromise a real property's account and send messages that contain accurate reservation details. Airbnb advises keeping all communication and payment on the platform itself, and Booking.com warns that its own phishing messages can contain convincing, accurate details. Correct details do not prove a request is genuine — that's exactly what makes a compromised-account message dangerous.

What makes this particular scam harder to spot than most is that it doesn't rely on impersonating a stranger — it exploits an existing, already-trusted relationship between you and a specific listing. By the time the fraudulent message arrives, you've likely already exchanged real messages with the host, already have a confirmation number, and already trust the thread. A criminal who has compromised that account, or who is simply pretending to be the host through a near-identical contact method, is borrowing all of that accumulated trust rather than building any of their own. That's precisely why the platform itself — not the conversation thread, however convincing — has to remain the source of truth for anything involving money.

Common versions of this scam

A cheaper deal offered outside the platform removes your booking records and every protection the platform provides. A fake payment page can copy Airbnb or Booking's design almost exactly. An urgent request to switch to a different bank account, with a different beneficiary name than expected, is one of the clearest signals something is wrong. So is an unexpected security deposit that isn't mentioned anywhere in the original booking terms. And in the most convincing version, a compromised property account sends the payment demand through what looks like a completely legitimate, ongoing conversation.

How to verify a payment request

Open the app independently rather than tapping anything inside the suspicious message, and review your confirmation, payment terms, and any charges directly. Don't use the link that was sent to you. Contact support through the platform itself and ask whether the payment being requested is actually authorized. Compare the stated beneficiary, amount, and policy against what the platform shows. Never cancel a legitimate reservation in order to "reactivate" it somewhere else, and never share banking codes or a screenshot of your card for a booking payment.

It's worth remembering that neither Airbnb nor Booking.com ever needs you to leave their system to complete a legitimate payment — every fee, deposit, and charge tied to a real reservation is designed to run through the platform itself precisely so that both guest and host are protected if something goes wrong. Any request that routes around that system, no matter how it's framed, is asking you to trade away the one thing the platform actually offers: a documented, disputable transaction. Keep that single fact in mind and most of the specific warning signs below become easy to recognize on sight.

Warning signs

• Urgency framed around keeping the reservation
• A cancellation threat within just a few hours
• Communication moved to WhatsApp or a private email address
• A request for wire transfer, cash, or cryptocurrency
• A lookalike domain that isn't the platform's official site
• A beneficiary name different from what's expected
• A discount conditional on leaving the platform entirely
• Being unable to reach the property through the original booking channel

This same logic extends to any last-minute change in bank details, even one that arrives mid-conversation with a plausible reason attached, like an account being frozen or a bank switch. A genuine host or property manager has no routine need to change payment details after a booking is already confirmed through the platform, and if one genuinely does, the platform's own support channel — not the message itself — is the only reliable place to confirm that the change is real before you act on it.

If you already paid

Contact your bank immediately and ask about placing a hold or tracing the transfer. Notify Airbnb or Booking through their official support channels right away. Save the confirmation, the full conversation, the beneficiary details, and the original listing information. Report the financial loss to your bank, and never send a second payment to try to "release" or recover the first one — that request is itself part of the scam.

Quick checklist

• Verify any payment request through the platform's own support, not the message
• Never click a payment link sent directly by a host
• Treat urgency and cancellation threats as red flags, not reasons to rush
• Confirm the beneficiary name matches what the platform shows
• Never move a conversation entirely to WhatsApp or private email for payment
• Contact your bank immediately if a fraudulent transfer already went through