The Ertzaintza detects an increase in cases of fraud related to hotel bookings

The Ertzaintza Cybersecurity Coordination Headquarters warned on Tuesday of an increase in cases of fraud related to hotel and rural booking . Cybercriminals have requested money transfers from people who had previously made a real booking  via WhatsApp. Between April and September 2026, 98 reports of such fraud were recorded.

In most cases, the victims made reservations through a platform, although there are also some that have been made on hotel and agro-tourism websites. Initially the victims receive amessage, usually via WhatsApp, in which the cyberoffender speaks on behalf of the hotel or country house, indicating that it is necessary to confirm their stay before they arrive, for which they send a link. 

The message received contains detailed information about the reservation, such as the name of the hotel, the customer, the dates of entry and exit, and the numerical identifier of the reservation. The information is real and obtained by cyber-attack againstthe booking platform, the hotel or the website of agrotourism.

Upon entering the link, the victim is referred to a website that replaces the identity of the establishment, where he is asked to enter personal data such as his name, ID or bank details, and then to make the full payment of the service for which he has been hired.

Recommendations to avoid fraud

The Ertzaintza has published recommendations for those who have received such a message and previously made a reservation:

• Do not enter the link or respond to the message received.
• Check the reservation directly with the accommodation, via official websites or telephones.
• Preferably use another channel of contact with the hotel, such as a phone or email, but never a phone or email that comes in a fraudulent message or is provided by the fraudster.
• Always look at the international profile, whether it matches the reserve country or not.
• Do not provide personal or bank data.
• Block and notify the sender.

If the financial data has been provided, it is recommended to contact the relevant financial institution, and the Ertzaintza requires the public, if they have been victims of this type of fraud, to retain all the evidence they can provide and to go to any police station to file a complaint .