Fake booking messages: how to protect yourself

What happened

From 22 October 2026, a malicious third party gained access to booking information managed by elloha, the booking software used by many accommodation and activity providers. The intrusion has been identified and stopped.

Depending on the case, this information includes the guest's first and last name, phone number or email address, and the dates and amount of the booking. No bank details were exposed.

The risk

This information is being used to send fake messages in the name of the properties. They quote the details of your booking and ask you to “confirm” or pay for your booking by clicking a link that leads to a fake payment page. This is a phishing attempt aimed at obtaining your bank card details.

In recent weeks, many travellers across Europe have received fake WhatsApp messages impersonating their accommodation and quoting genuine booking details: never trust a payment link received by message.

Our recommendations

• Never pay or enter your card details through a link received by WhatsApp, text message or email.
• If in doubt, contact the property directly using its usual contact details (official website, booking confirmation).
• If you have already paid through a suspicious link, contact your bank immediately to block your card and request a refund of the transaction.
• Report suspicious messages: in WhatsApp, use the “Report” function; forward a text message received in France free of charge to 33700; elsewhere, use your country's reporting service.

What has been done

The fraudulent access has been blocked and the vulnerabilities fixed. A criminal complaint is being filed. Your booking remains valid: you do not need to do anything.

elloha will never ask you to pay for a booking through a link sent by WhatsApp or text message.