- When Booking Details Become Bait: Protecting Guest Trust Before Arrival

A guest calls reception with a worrying question: “I have received another payment request. Is this really from you?”

The booking dates are correct. The property name is familiar. The amount looks plausible. The message warns that the reservation could be cancelled unless the guest acts immediately.

For someone looking forward to a holiday, that combination can be convincing. For the reservations team, it creates an urgent responsibility: help the guest establish what is genuine before they make a payment or share sensitive information.

Recent security incidents affecting accommodation booking services in Southern Africa have brought this risk into sharp focus. Reports in early November described unauthorised access to booking information and warnings that criminals could use those details to impersonate properties or booking services.

The practical lesson for hotels, lodges and guesthouses is clear: payment communication needs the same care and consistency as the booking itself.

Correct booking details do not prove a message is genuine

Guests have good reasons to recognise their travel dates, booking reference and accommodation name. Criminals can use that familiarity to make a fraudulent request feel like a routine part of the reservation.

An October police advisory described messages impersonating hotels and booking platforms, sometimes containing legitimate reservation details. Guests were directed to fraudulent pages to verify card information or secure their bookings, including claims that no money would be deducted.

This means that checking spelling, logos or whether a message “sounds professional” is insufficient. A convincing message can still lead to a fraudulent payment page.

Knowing about a reservation is not the same as being authorised to collect payment for it.

Staff should understand that distinction and help guests understand it too.

Make the legitimate payment process easy to recognise

A guest who knows exactly what to expect is better placed to question an unexpected request.

Review your booking confirmation from the guest’s perspective. It should explain:

The amount payable and when it is due.
Who will collect payment: the property or the booking platform.
The agreed payment method.
How the guest can independently verify an unexpected request.

Use the actual terms of the reservation. Payment arrangements may differ between direct bookings, booking channels and rate plans, so a generic instruction can create confusion.

Keep confirmations, deposit reminders and staff explanations consistent. If payment arrangements change, update the relevant templates and brief the team before using the new process.

Avoid broad promises that your operations cannot support. If your property legitimately uses payment links, explain how guests can verify them independently.

Give guests a safe way to pause

Fraudulent requests often create pressure: pay now, verify immediately or risk losing the booking.

Your communication should give guests permission to stop and check.

A short statement in confirmations and relevant reminders could read:

If you receive an unexpected payment request or a change to payment instructions, please verify it with our reservations team before proceeding. Obtain our contact details independently from our official website, or access your original booking platform directly. A message containing your booking details should still be checked.

That wording gives the guest a clear action without requiring them to become a cybersecurity expert.

Independent verification matters. Calling a number supplied in the suspicious message may simply connect the guest to the person behind it. Security guidance recommends checking through an official website, app or independently obtained property contact details.

Make sure the route you recommend works. Guests need current contact details and a team that knows how to respond.

Prepare reception before the first worried call

“Just ignore it” is an incomplete response when a guest fears losing a reservation.

Give reception and reservations staff a simple process:

Acknowledge the concern. Thank the guest for checking before acting.
Verify the reservation. Follow your normal identification process and review the agreed charges, payment status and recent correspondence.
Check the request. Establish whether it was issued by the property or the party responsible for collecting payment.
Explain the confirmed position. Tell the guest what your records show and what remains under investigation.
Escalate and record. Identify who will investigate and who will update the guest.

Avoid declaring a request genuine simply because it matches an outstanding balance. Equally, do not speculate about the source of a suspicious message.

If you establish that your property did not issue the request, say so clearly. Where a booking platform handles payment, direct the guest to that platform through its official app or website.

The guest should finish the conversation knowing what to do next and who is helping them.

Respond quickly if information or money has already been shared

A guest who has clicked a link or entered card details needs calm, practical guidance.

Advise them to contact their bank or payment provider immediately through an official channel and explain what happened. If account credentials were disclosed, they should also secure the affected account through its genuine website or app. Preserve relevant messages and transaction records for investigation.

Do not ask the guest to send card numbers, security codes, passwords or one-time PINs to reception by email or WhatsApp.

Record the incident using your approved process, restricting access to those who need it. Be supportive, but avoid promising reimbursement or a particular outcome before the relevant parties have assessed the case.

Treat repeated reports as an operational warning

Several guests reporting similar messages should trigger a coordinated response.

Appoint someone to collect the reports, identify patterns and contact the relevant technology or booking partners through verified support channels. Brief every shift so guests receive consistent information.

If a provider issues an incident notice, review its confirmed scope and recommended actions. Decide which guests need communication and what you can accurately tell them.

Avoid forwarding rumours or making blanket claims that everything is safe while facts remain uncertain. Useful communication explains what is known, what the guest should do and where further help is available.

Keep your own records clear and access controlled

Reliable booking records help staff check what the property has actually agreed, charged and communicated.

INNkeeper’s guest-account and front-office functions provide an operational basis for those checks. Record authorised changes to payment arrangements and relevant guest conversations so the next staff member can understand the position.

Those records support an investigation; they do not authenticate an external message.

Alongside clear communication, review staff access to booking and email systems, remove access when employees leave, use strong individual passwords and enable multifactor authentication where available. Keep software updated and make suspicious messages easy for staff to report.

Protect trust before the guest arrives

A guest’s experience begins with the first confirmation, payment instruction and conversation with reservations.

When a fraudulent message enters that journey, your team’s response matters. Clear records, consistent instructions and an accessible verification process help guests make a safer decision at a stressful moment.

Start with one booking confirmation and one practical staff exercise: a guest phones about an urgent payment request containing correct reservation details.

Can your team establish the payment position, check who issued the request and explain the next step?

Guests should never have to guess whether the person asking for payment is entitled to receive it.