The host wants a direct transfer: how to protect your reservation

The message can look entirely convincing because it includes your real name, your dates, and the correct price. It claims your card failed, that a deposit is now required, or that the booking will be canceled unless you pay a different way. On Booking.com specifically, criminals sometimes compromise a real property's account and send messages that contain accurate reservation details. Airbnb advises keeping all communication and payment on the platform itself, and Booking.com warns that its own phishing messages can contain convincing, accurate details. Correct details do not prove a request is genuine: that's exactly what makes a compromised-account message dangerous.

What makes this particular scam harder to spot than most is that it doesn't rely on impersonating a stranger: it exploits an existing, already-trusted relationship between you and a specific listing. By the time the fraudulent message arrives, you've likely already exchanged real messages with the host, already have a confirmation number, and already trust the thread. A criminal who has compromised that account, or who is simply pretending to be the host through a near-identical contact method, is borrowing all of that accumulated trust rather than building any of their own. That's precisely why the platform itself – not the conversation thread, however convincing – has to remain the source of truth for anything involving money.

Common versions of this scam

A cheaper deal offered outside the platform removes your booking records and every protection the platform provides. A fake payment page can copy Airbnb or Booking's design almost exactly. An urgent request to switch to a different bank account, with a different beneficiary name than expected, is one of the clearest signals something is wrong. So is an unexpected security deposit that isn't mentioned anywhere in the original booking terms. And in the most convincing version, a compromised property account sends the payment demand through what looks like a completely legitimate, ongoing conversation.

How to verify a payment request

Open the app independently rather than tapping anything inside the suspicious message, and review your confirmation, payment terms, and any charges directly. Don't use the link that was sent to you. Contact support through the platform itself and ask whether the payment being requested is actually authorized. Compare the stated beneficiary, amount, and policy against what the platform shows. Never cancel a legitimate reservation in order to "reactivate" it somewhere else, and never share banking codes or a screenshot of your card for a booking payment.

It's worth remembering that neither Airbnb nor Booking.com ever needs you to leave their system to complete a legitimate payment – every fee, deposit, and charge tied to a real reservation is designed to run through the platform itself precisely so that both guest and host are protected if something goes wrong. Any request that routes around that system, no matter how it's framed, is asking you to trade away the one thing the platform actually offers: a documented, disputable transaction. Keep that single fact in mind and most of the specific warning signs below become easy to recognize on sight.

Warning signs

• Urgency framed around keeping the reservation
• A cancellation threat within just a few hours
• Communication moved to WhatsApp or a private email address
• A request for wire transfer, cash, or cryptocurrency
• A lookalike domain that isn't the platform's official site
• A beneficiary name different from what's expected
• A discount conditional on leaving the platform entirely
• Being unable to reach the property through the original booking channel

This same logic extends to any last-minute change in bank details, even one that arrives mid-conversation with a plausible reason attached, like an account being frozen or a bank switch. A genuine host or property manager has no routine need to change payment details after a booking is already confirmed through the platform, and if one genuinely does, the platform's own support channel – not the message itself – is the only reliable place to confirm that the change is real before you act on it.

If you already paid

Contact your bank immediately and ask about placing a hold or tracing the transfer. Notify Airbnb or Booking through their official support channels right away. Save the confirmation, the full conversation, the beneficiary details, and the original listing information. Report the financial loss to your bank, and never send a second payment to try to "release" or recover the first one: that request is itself part of the scam.

Variants by channel: where the message actually arrives

The same scam wears different clothes depending on where it reaches you, and each channel has its own tell. Inside the platform's own messaging thread, the danger comes from a compromised host account: the message is technically "real", so the tell isn't the sender but the request itself: a link leading off-platform or a payment method the platform doesn't use. Over email, watch the sending domain rather than the display name; a lookalike address with an extra word or swapped letter carries the entire deception. On WhatsApp or SMS, the tell is the move itself: a legitimate host has no reason to demand that payment discussion leave the platform where both of you are protected. And in the rental-listing version that starts outside any platform: a too-cheap apartment on a classifieds site whose "owner" asks for a deposit to hold the dates: there was never a protected booking to begin with, which is exactly why the price looked so good.

A realistic walkthrough: Priya's beach week

Priya, 34, books a beachfront apartment for a week in June, three months ahead. The host is responsive and friendly, the confirmation email arrives, and she forgets about it. Two weeks before the trip, a message lands in the booking thread itself: "Our payment processor flagged your card – to avoid automatic cancellation tonight, please confirm the reservation through this secure link." The page that opens looks pixel-perfect: same logo, same colors, her real reservation number already filled in. It asks her to re-enter her card and approve a "verification hold".

What saves her is a habit, not suspicion. She closes the link, opens the official app from her home screen, and checks the reservation directly: status confirmed, payment complete, no alerts anywhere. She reports the message through the app's support flow, and support confirms the host's account had been accessed by a third party. The card she nearly re-entered would have been charged within minutes. The lesson she takes away: the app you open yourself is the truth; the link that opens itself is the test. If the platform's own screen shows nothing wrong, nothing is wrong, no matter how urgent the thread sounds.

Prevention habits before and during your trip

A few habits set up before you travel remove most of this scam's leverage. Turn on two-factor authentication on your Airbnb and Booking accounts: compromised traveler accounts get used to harvest reservation details too, not just host accounts. Pay with a credit card rather than a debit card or transfer whenever the platform allows it, since credit card disputes give you a second layer of protection the scam can't easily route around. Before a trip, note the property's phone number from the original listing so you have an independent way to reach a real person if a strange message arrives at midnight before check-in.

Then set one personal rule and tell your travel companions about it: no payment action ever starts from inside a message. Every charge, deposit, or "verification" gets checked by opening the app or typing the site address yourself. Warn whoever books trips in your family – parents booking a first holiday rental are a favorite target, and the person who made the reservation is usually the one who receives the fraudulent follow-up. If a request survives the check against the platform's own screens, it's real; if it only exists in the message, it isn't.

Quick checklist

• Verify any payment request through the platform's own support, not the message
• Never click a payment link sent directly by a host
• Treat urgency and cancellation threats as red flags, not reasons to rush
• Confirm the beneficiary name matches what the platform shows
• Never move a conversation entirely to WhatsApp or private email for payment
• Contact your bank immediately if a fraudulent transfer already went through

Frequently asked questions