Travellers are currently being targeted by fraudulent messages related to holiday accommodation bookings, particularly through WhatsApp, email and other messaging channels.

Spain’s National Cybersecurity Institute, INCIBE, has warned about scams in which criminals impersonate hotels and holiday accommodation providers and contact guests who may already have a genuine booking.

The aim of these messages is usually to convince travellers to verify, confirm or update their booking by clicking on an external link.

How does this type of scam work?

One of the reasons these messages can appear convincing is that they may contain real information related to a booking, such as:

  • The name of the accommodation.
  • The guest’s name.
  • Arrival and departure dates.
  • Booking details.
  • The value of the stay.

However, the fact that a message contains correct booking information does not necessarily mean that it is legitimate.

Fraudsters may use these details to gain the guest’s trust before directing them to a fake website. Once there, the guest may be asked to provide personal information, banking details or card information under the pretext of confirming the reservation.

Signs that a message may be fraudulent

You should be particularly cautious if you receive a message about your booking that:

  • Asks you to confirm your reservation through an unexpected link.
  • Requests your card details again.
  • Asks you to make an additional payment that was not previously agreed.
  • Requests that you change your payment method.
  • Claims that your booking will be cancelled immediately unless you take action.
  • Comes from an unfamiliar WhatsApp number or email address.
  • Directs you to a website other than the official accommodation or booking platform.

A common feature of these scams is urgency. Messages may tell you that you need to act immediately to avoid losing your booking. This is designed to make you react before checking whether the message is genuine.

What should you do if you receive a suspicious message?

Do not click on the link immediately.

Instead:

  1. Check your reservation directly through the official website or app where you made your booking.
  2. Make sure the phone number or email address matches the accommodation provider’s official contact details.
  3. Do not enter personal or banking information on websites opened from suspicious messages.
  4. Do not make any additional payment until you have confirmed that the request is genuine.
  5. Contact the accommodation provider or booking platform directly using its official channels.

Booking platforms such as Booking.com also recommend checking booking details carefully and being cautious of phishing messages that urgently request payment information.

What should you do if you have already clicked on the link?

If you opened the link but did not enter any personal or banking information, close the page and do not access it again.

If you entered card or banking details:

  • Contact your bank as soon as possible.
  • Check your account for any unauthorised transactions.
  • Keep screenshots of the message, telephone number, website and any other relevant information.
  • Report the incident to the accommodation provider or booking platform.
  • Consider reporting the fraud to the relevant authorities.

Guests in Spain can also contact the INCIBE Cybersecurity Helpline on 017 for specialist advice.

Important information for Casasol Holiday guests

If you have a reservation with Casasol Holiday, please take extra care when receiving messages concerning payments, booking confirmations or changes to your reservation.

Please only rely on:

  • Official Casasol Holiday emails ending in @nerjaholidayrentals.com.
  • The official platform through which you made your reservation, such as Booking.com or Airbnb.
  • Casasol Holiday’s official contact channels.

Casasol Holiday will never ask you to make a payment through an unknown email address, an unidentified WhatsApp number or a suspicious external link.

If you receive a message asking you to confirm your card details, make an additional payment, change your payment method or follow an unfamiliar payment link, do not provide any personal or banking information and contact us directly before taking any action.

This notice is preventive and is intended to help protect our guests from fraudulent attempts.

If in doubt, always verify the message directly with us before making a payment or sharing personal information.