Spain Reveals How Real Hotel Bookings Are Being Used to Trap Holidaymakers in Costly Scams

Image generated with Ai

Spain shows the dangers of legitimate hotel bookings being used as a ploy to get vacationers entangled in a scam that can cost them dearly. Firstly, they use names, dates of stay and the booking number to give legitimacy to their messages. Afterward, they encourage the vacationers to book a room, update their credit card information or obtain refunds through a link. However, there is a way to safeguard your plans by confirming any requests from an authorized application or from a contact at the hotel who found out about them.

Real bookings can give false messages a powerful disguise

Many people think a scam starts with a fake hotel or a website that looks suspicious. Yet fraud can also follow a genuine booking. A guest may reserve a real room through a known platform and then receive a message asking them to confirm the stay, update a card or pay again.

The message may include the right hotel name, guest name, dates or booking reference. These details make it harder to doubt the sender. Criminals may have taken the information through a compromised hotel or booking account. They can then use it to contact people who have a stay planned.

Swiss authorities warned in June 2026 about WhatsApp messages that appeared to come from a booking service or hotel. Some claimed there had been an error and offered a refund. Others said the booking would be cancelled unless the guest acted quickly. Both approaches tried to lead people to fake payment pages.

This matters because a real booking is not proof that a later message is real. Travellers may expect updates from a hotel before arrival. Scammers can use that normal part of travel to create fear and urgency.

Spanish police recorded real losses from hotel booking scams

The Ertzaintza, the police force of Spain’s Basque Country, recorded 98 complaints linked to hotel booking scams between April and September 2026. The reported losses topped €57,000.

In the cases described, guests received messages, often through WhatsApp, that asked them to confirm a real stay. The messages included details such as the hotel name, guest name, arrival and departure dates, and booking number. A link led to a fake website that asked for personal or bank details. Victims were then asked to pay for a service they had already booked.

The figures apply to complaints received by this police force during a set six-month period. They do not represent all of Spain, and police did not say that AI was used in these cases. Their value lies in showing how a scam can exploit the information connected to a genuine stay.

The Catalan Cybersecurity Agency issued a separate warning in September. It described a pattern in which one message appeared to come from a booking platform, while a second person claimed to work for the hotel. Both directed the guest towards an external link and pressed them to act quickly.

AI can make fake holiday homes look more convincing

Italy’s central bank has warned that scammers increasingly use AI to make false accommodation offers appear more believable. The tools can help create fluent Italian text, polished images, videos of supposed hosts and copies of booking websites.

That removes some old warning signs. Poor spelling and blurry photographs once made certain fake offers easier to spot. Better written text and sharper images can now hide those clues. A traveller may see a tidy advert, a friendly video and a website that looks familiar, yet still be dealing with a criminal.

The Italian guidance points to other signs that deserve attention. A very low price, pressure to book at once or a request to pay outside the booking platform can all raise concern. A host may also ask for an identity document or a bank transfer before the guest has checked who will receive the money.

AI does not make every scam perfect. It can, however, help criminals produce convincing material more quickly. Europol’s 2026 cybercrime report says generative AI helps criminals personalise messages and impersonations. The report covers online fraud in general; it does not give a Europe-wide count for AI-made travel scams.

That distinction is important. Official guidance confirms that AI can support accommodation fraud. It does not show that AI played a part in every case reported by police in Spain or Switzerland.

A fake refund can put a bank account at risk

The danger may continue after a guest has paid for a room. In October, Switzerland’s National Cyber Security Centre warned about hotel-related messages that offered a 7.5% cashback payment. The offer sent victims to a copy of the hotel’s website, where they were asked to select their bank and enter login details.

The promised refund was a trap. Criminals used the details to try to enter the victim’s online bank account. In some cases, they kept the person busy on the fake site while asking them to approve an authentication request. The victim may think they are confirming a refund, while the approval gives criminals access to the account. Scammers may then try to change the phone number linked to a TWINT account or make payments.

The Swiss warning says these messages can target former guests as well as people with current stays. It also says criminals may know names, email addresses, booking dates and hotel details.

A traveller should treat an unexpected refund link with care, even when the message includes correct details. To check a booking or payment, open the official app or type the platform’s address into a browser. Contact the hotel using a phone number found independently. Do not use a number or link provided in the message being checked.

The EU is examining the role of booking platforms

On 21 October 2026, the European Commission opened formal proceedings to examine whether Booking.com properly assessed and reduced risks linked to fraudulent listings and phishing. The inquiry will look at fake properties, impersonation, the way guest and reservation data are shared with accommodation providers, and the platform’s messaging service.

The Commission will also examine whether paid-for listings are clearly labelled as advertisements. It said users should be able to see who paid for an advert and why it appears in search results.

The proceedings are an investigation. They do not establish that Booking.com broke the law. The Commission says it will continue gathering evidence, including through requests for information, interviews or inspections. Any final decision will follow that work.

The inquiry gives the European story a wider focus. Travellers may ask whether a listing is real. They can also ask how their booking details are protected and what happens when a hotel account is misused. These are questions for platforms, accommodation providers and regulators.

A booking platform connects guests with many properties. That can make travel planning easier. It also means a problem with an account or message system may affect more than one guest. The Commission’s inquiry puts those risks under formal review.

Different European figures measure different kinds of harm

Europe does not have one official statistic that ranks countries by AI travel scams. The figures available measure different things. The Basque police number covers complaints to one police force over six months. Switzerland’s figures cover reports of cyber incidents across many sectors. Neither is a count of all European travel scams.

The Swiss NCSC received 27,128 voluntary cyber incident reports in the first half of 2026, down from 35,727 in the same period in 2025. It said fraud remained a major problem and described attacks as increasingly targeted and sophisticated. The figures cover many kinds of cyber incidents, not only travel fraud.

A separate report by the European Central Bank and European Banking Authority said payment fraud across the European Economic Area reached €4.2 billion in 2024, up from €3.5 billion in 2023. It said many fraudulent credit transfers involved criminals manipulating customers into making the payment themselves. These are payment-fraud totals across the economy. They do not measure travel scams, AI use or losses in 2026.

The figures show why writers should state what each number covers. A rise in one local complaint category cannot be compared directly with broad banking data. Nor can a fall in all cyber reports prove that travel scams have fallen.

Online bookings matter to Europe’s tourism economy

The scale of online accommodation helps explain why booking security is a travel issue. Eurostat reported that travellers spent 258.8 million nights in EU short-term rentals booked through Airbnb, Booking or Expedia between April and June 2026. That was 5.3% more than in the same quarter of 2025.

Those figures count guest nights, not bookings, scams or people harmed. They should not be used to suggest that popular destinations have higher fraud rates. They do show how many stays depend on online platforms.

A large digital market gives travellers choice and makes it easier to compare places to stay. Yet a booking may also create personal data that must be handled safely. Guests share names, dates, contact details and payment information. Hotels and platforms need to protect that information, while travellers need clear ways to check whether a later request is genuine.

The risk also affects honest accommodation providers. A fake listing can damage trust in a destination. A stolen hotel account can turn the hotel’s name into part of a criminal message. If a visitor loses money or arrives to find no room, the harm can spread beyond one booking.

Travel fraud takes more than one form

Not every accommodation scam involves a fake message after booking. Some criminals create false adverts for homes that do not exist. Others copy real photographs, make fake booking websites or collect deposits and disappear.

Italy’s Guardia di Finanza reported an investigation into a criminal group suspected of carrying out more than 1,600 scams, worth about €575,000, from 2022 to 2025. Investigators described false holiday-home adverts on social media and fake payment terminals linked to accommodation businesses that did not exist. The case remained under investigation, and the authorities stressed that the suspects were presumed innocent until a final judgment.

In the United Kingdom, the Civil Aviation Authority reported a prison sentence in September 2026 involving a man who ran travel firms while barred from acting as a company director. One firm had sought official ATOL approval, but its application did not proceed. The regulator advised travellers to check whether a travel provider is properly licensed and whether a holiday is ATOL protected.

These cases show that travel fraud can involve false homes, fake companies, stolen card details or account takeovers. They should not all be described as AI scams. Each has its own method and evidence.

Travellers can reduce risk by checking through trusted channels

French government advice says travellers should be wary of urgent messages that ask for bank details or payment after a booking. A message may threaten to cancel a stay unless the guest acts quickly. The government advises people to access their booking through the platform’s official home page rather than using a link in a suspicious message. It also recommends keeping confirmation emails and checking that the amount charged matches the reservation.

Italian guidance recommends booking, paying and messaging through the platform where the property is listed. Travellers should be wary if a host asks for direct bank transfers, large deposits or quick payment outside the site. They can also check whether the property’s photographs appear elsewhere and review how long the host profile has been active.

If a message claims that a booking has a problem, travellers should check it through the official app or website. They can contact the hotel using details found independently. They should not share one-time codes or approve a bank request unless they understand what it authorises.

If someone has already entered card or bank details on a suspicious page, Swiss authorities advise contacting the bank or card provider promptly. Travellers should keep messages and payment records in case they need to report the incident.

Europe’s travel scam story is about trust and proof

Hotel scams in Europe highlight a new threat facing travelers as technology makes fraud detection difficult for travelers because fraudsters can construct a fraudulent listing or message based on the actual vacation experience. Firstly, they lure travelers with attractive rates. Secondly, they use booking information to ask for credit card information or payments. However, the fraud could be lurking before, during and even after a traveler’s stay at a hotel. Several investigations have been conducted by European authorities who point out why it is important for travelers to verify all communications via the official app or hotel verification contacts.