Scam breach: Fake “booking failed” texts hit hotel and motel guests
Phishing scammers are using stolen reservation details to send fake “booking failed” messages to Australian hotel guests, threatening to cancel stays unless payment information is reconfirmed.
The scam follows a data breach at accommodation software provider RMS Cloud, whose software is used by hotels, motels, holiday parks, campgrounds and serviced apartments.
RMS is currently investigating the phishing messages. Guest names, contact details and booking information were accessed, but credit card and payment details weren’t compromised.
RMS said the scam messages were being sent by an unknown entity claiming to be RMS or one of its customers.
“The communications quote reservation information, request confirmation of payment details, and may be received via email, text message or WhatsApp,” the company stated.
“We are treating this matter with the utmost urgency, and recognise the concern and disruption this has caused our customers and their guests.”
RMS customers including Reflections, BIG4 and G’day Parks have warned guests.
Reflections sent an email to customers stating: “We are contacting you as a past guest to make you aware our third-party booking system provider, RMS Cloud, has confirmed a global incident.
“Please do not click any links, open attachments, or share payment or personal information.”
Scam reaches beyond RMS properties
Similar messages have been reported by travellers who booked through Booking.com, Agoda and Trip.com.
Perth man Wayne Garrard, 68, told Seven News that a friend who booked through Booking.com received a WhatsApp message demanding he reconfirm his payment details or lose his reservation.
“He actually clicked on the link, and it takes you to the room that you bought on booking.com,” Garrard said.
The friend entered his card details, but his bank flagged an attempted €400 (AU$635.93) charge, which he rejected.
Garrard then received his own message, containing his hotel, dates and reservation reference. “It looked perfect — the booking.com website with the hotel room and everything,” he said. He stopped before entering any information.
“It’s like, how did they get all this information?” he said.
More victims feared
A National Anti-Scam Centre spokesperson said 62 reports had been received over the past three days, with one victim losing more than $300, and warned more cases may be unreported.
Travellers should not click suspicious links or pay through messages claiming a booking has failed, and should contact accommodation providers using independently sourced details.
Victims who have shared financial information should contact their bank immediately.
Scams can be reported to Scamwatch, ReportCyber and IDCARE.
Jonathan Jackson, 30th October 2026
