DH has been scammed - any advice on how to get money back

[Welcomehat]

DH booked a hotel via booking.com for a holiday in May. He paid using our Amex card.

A few days later he received an email from ‘booking.com’ saying the hotel did not accept Amex and he had to pay via another form of payment or they’d cancel our room. We’d already booked flights and when we booked this was the last room in the category we wanted. He therefore followed the link to pay for the hotel straight away. He did check Amex and the original payment was still pending so he didn’t question it.

When he paid for the room (a second time) using our bank card the payment link took him into his online banking app to approve the payment, he didn’t question it wasn’t genuine.

He immediately checked the statement online to make sure the money had gone out but the title of the payment was something really obscure which then made him start questioning what had happened. He called the bank immediately and asked them to put a stop on the payment. The bank told him the fraud team finished at 8pm and therefore nothing could be done until the morning and to call back?

He called back the next day and they’ve looked into and basically said it’s a scam not fraud. They’ve asked the company the payment was made to to refund it, and have given them 60 days to do so. They haven’t said what happens if the company refuse to do so? Which I assume they will as they stole it to begin with.

Has anyone else been unfortunate enough to happen to them to? Husband obviously feeling stupid , it wasn’t a small amount of money, about £4,000 and don’t feel confident the bank are going to refund it.

I guess it's up the bank to decide if they want to reimburse you.

You have cancelled the card right?

Scams are very sophisticated these days, but it's a salutary tale of not doing anything outside of the website. But what kind of a bank has a fraud team that clock off at 8pm?! Mine is 24 hours and with good reason. I think you need to sit tight and see what your bank say about the refund - fingers crossed it gets returned ASAP - but then I would be looking to move bank. Sorry to hear this, as I say, scams are so sophisticated, no one needs to feel daft about it, there are just some genuinely evil thieves out there.

Some scams are sophisticated. But this was not one of them.

How did the scammers know you had booked a room by Amex? That’s the worrying part of this. Hope the bank refunds you. And makes it fraud dept open 24/7. Scammers don’t clock off.

I think it’s pretty sophisticated. The scammer knew he had booked a hotel through that website, his contact details, that he had paid by Amex, was able to connect to his bank account etc (I would have fallen for it, but perhaps Im an idiot).

It’s a really common scam when using booking.com- very sophisticated. The scammers use phishing emails to gain access to the hotel’s systems and so are able to see all booking details, some will even message you on booking.com itself. If you google it, “booking.com WhatsApp scam”- you’ll see how prolific it is and it operates globally. I’m not sure what recourse your bank will have, you might have something via insurance due to compromised data from the hotel.

After the 60 days contact your bank again and you can dispute that you didn't receive a refund and they will claim it back for you. They have to give reasonable time for a refund before they can dispute

I had this with booking.com

it was on my credit card so I froze it instantly from my banks app and rang the fraud team who deactivated the card and sent me a new one.

it seemed to have happened to multiple people at that particular hotel as I got an email from booking.com offering to reimburse if any money had been lost (it hadn’t)

I think as your DH did as much as was humanly possible to stop the payment, then the bank are likely to refund him under 'Chargeback' which is why they've given the person the money went to 60 days to get back to them. However, have you also reported it to the police via https://www.reportfraud.police.uk/ ? If not, then you should, and be sure to keep all the relevant emails etc. that you received.

As a matter of interest, was the email address that contacted you as Booking.com, and said that the hotel did not accept Amex and that your DH had to pay via another form of payment or they’d cancel your room, actually Booking.com's proper email address, or was it one of those that had been doctored to something like Bo0king.com?

I received a similar message from a scammer via WhatsApp, who had obtained my booking details from booking.com. The information was genuine, they had my booking number, correct dates I was travelling, room details etc - but there was a slight spelling error in the name of the hotel itself. I also have been using booking.com for ages so regularly get emails or notifications that remind you not to click on any external link or submit payments via third parties, as all bookings on their platform are guaranteed and the hotels or owners won't ask you to go off-site.

Give the bank a chance and hope they refund the money when the 60 days are up. I had an issue last summer while I was abroad - it was my card that was hacked via Apple Pay, and the bank sounded very pessimistic (cautious) about my chances of recovering the money, but 6 weeks later they refunded me in full.

I hope it gets sorted quickly OP - and remember to never ever click on external links, especially if they ask for payment. Booking.com will always communicate via their internal chat and are usually very helpful when there are issues. Be sure to tell this specific accommodation about the scam - they can alert clients and advise everyone to keep a close eye on similar messages.

But how did they manage to get access to your banking app. Surely the security around who the bank lets use this form of payment should be stronger than letting a scammer in.

I've had a similar issue. Booking.com blamed the hotel, the hotel blamed booking.com I received a Booking.com in app message supposedly from the hotel, saying I had to add my card to the booking and they would take a £1 payment to guarantee the booking didn't get cancelled. As it was in app I didn't question it, but as I went to make the £1 payment it popped up on my online banking as 150 euros. Luckily my card blocked the payment before I did. If you google you'll find lots of comments about it.

Have you checked with the hotel to make sure they've not got the payment?

I had the same, booked through booking.com and then a few days later they knew everything, the number of rooms, the dates, the method of payment. I reported it to action fraud and booking .com but no one gave a fuck.

Some posts are kind and understanding. Yours was not one of them.

Sorry this happened.

The problem is sometimes hotels do ask for payments to be made outside of booking.com. At least three times where I’ve paid either paid a deposit or have agreed to pay at property the hotel have contacted me with a separate payment link.

In each case I phoned the hotels directly and they confirmed legitimacy but it’s a pain i) because I use booking.com because I don’t want to actually have to call anyone and ii) the fact that booking.com allow this to happen undermines security

I have had the same. Booked with booking.com and then have received around 6-8 messages via WhatsApp saying that the payment hadn’t gone through and I would need to click on the link to complete otherwise the booking would be cancelled 🙄. What alerted me was the info at the top of the WhatsApp message and the photo - clearly nothing whatsoever to do wth the hotel (think country code Kazakhstan when the booking was in France). I also checked with booking.com and they confirmed it was nonsense. Good luck with getting your money back.

I booked a hotel in the peak district via booking. com and the scammers hacked into the messaging system. I got a message asking for some details and arrival times on the booking. com messenger bit. There was something off about how it was worsened and they wanted you to go to another link to confirm some details etc.

So i emailed the hotel and eventually they got back and said it wasn’t them. Lucky i’m very sceptical so i sussed it but i can see how easily it would be taken as an official message etc as it was on their site! Did report etc.

I rarely use it as hotels own sites seem cheaper anyway but it’s handy for searching and narrowing hotels down etc. I think reading this they have a proper issue with the security of their software/app etc.