SINGAPORE – Since September, at least 30 people have fallen victim to a hotel booking scam with losses that total some $41,000.
The police said that the victims who had made hotel bookings using online reservation portal Booking.com would receive e-mails or messages from Booking.com’s in-app chat function from scammers posing as hotel representatives.
The scammers would request that victims verify and confirm the reservation using a fraudulent link.
The victims would be asked to provide their personal and banking details, after clicking on the link, such as credit card numbers and one-time passwords.
In some cases, the fraudulent websites would even prompt the victims to make payments to confirm the reservation.
The victims only realised they had been scammed when they tried to contact Booking.com or the hotels, or discovered unauthorised transactions had taken place on their bank accounts or credit cards.
One individual said that he experienced this recently too. He bad booked a hotel in Japan and received a message to confirm credit card details or reservation would be cancelled in 6 hours. He stated that it looked legit since it originated from the booking.com website chat itself. The phishing link that was sent had looked exactly like a booking.com website as well. Thankfully he had called up the hotel and they confirmed it was a phishing attempt.
Another said “Received the same message on agoda’s in app chat function from a hotel I made a booking for.” Luckily Agoda’s app blocks external links and the payment could not be made.
The public have been advised by the police to adopt precautionary measures such as adding the ScamShield app and enabling security features such as two-factor authentication (2FA) and multifactor authentication for banks.
Transaction limits should also be set up by people for Internet banking transactions, including PayNow.
Individuals have been urged to always verify the authenticity of information with hotels through their official contact details and to not click on links provided in unsolicited messages. The public is also advised to look out for signs of phishing websites and to never disclose their personal or banking credentials to anyone.
Those who have doubts, or possess information relating to such crimes are encouraged to call the police hotline on 1800-255-0000, or submit the information online at www.police.gov.sg/iwitness
