How to Spot Fake Booking Confirmation Emails Before You Click
What a phishing booking confirmation looks like
A phishing email pretending to be a booking confirmation will ask you to click a link, download an attachment, or enter payment details — usually by claiming something is wrong with your reservation. The email arrives in your inbox looking like it came from a hotel, airline, or rental car company, but the sender address, links, and urgency are designed to trick you into handing over passwords or credit card numbers.
Real booking confirmations from legitimate travel companies contain your reservation number, dates, and a summary of what you booked. Phishing emails often skip those details or get them wrong. They may ask you to "verify your booking," "update your payment method," or "confirm your identity" — requests that real companies rarely make by email.
The goal is not to steal your reservation. It is to steal your login credentials, payment information, or personal data that can be sold or used for identity theft. Once they have your password, scammers can access your travel account, change your bookings, or lock you out entirely.
Key Takeaways
- Phishing booking emails ask you to click links or enter information, while real confirmations contain your reservation details and rarely ask you to take action.
- Check the sender's email address carefully — scammers use addresses that look similar to real company domains but have small misspellings or different endings.
- Hover over any link before clicking to see where it actually goes; phishing links often point to fake websites that look like the real thing.
- If you are unsure, log into your travel account directly using the company's official website or app, not by clicking a link in the email.
- Real travel companies will not ask you to confirm passwords, full credit card numbers, or Social Security numbers by email.
Red flags in the sender's address
The sender's email address is the first place to look. Scammers often use addresses that are close to the real company name but not quite right. For example, an email might come from "bookings@hotelsupport.com" when the real Marriott confirmation would come from an address ending in "@marriott.com" or a domain Marriott actually owns.
Check the full email address, not just the display name. A scammer can set the display name to "Booking.com" or "United Airlines" while the actual address is something completely different. Most email programs let you see the full sender address by clicking on the sender's name or hovering over it.
Legitimate travel companies use consistent sender addresses for all confirmations. If you have received confirmations from the same company before, compare the addresses. A different sender address for the same company is a warning sign.
How phishing links hide their real destination
A phishing email will include a link that looks like it goes to the travel company's website, but it actually goes somewhere else. The link text might say "Confirm Your Booking" or "Update Payment," but the actual URL is hidden until you hover over it.
Before clicking any link in a booking email, hover your mouse over it (or long-press on a phone) to see the actual web address. If the link text says "Marriott.com" but the address that appears says something like "marriott-verify.ru" or "secure-booking-update.net," do not click it. Real travel companies use their own domain names, not third-party sites.
Phishing links often use slight variations of the real domain — adding extra letters, changing one letter, or using a different ending like ".ru" or ".tk" instead of ".com". These fake sites are designed to look identical to the real ones, but the URL in your browser's address bar will reveal the deception.
Requests that real companies do not make by email
Legitimate travel companies will not ask you to confirm sensitive information by email. They will not ask for your full credit card number, Social Security number, passport number, or account password. If a booking email asks for any of these, it is phishing.
Real confirmations may ask you to log into your account to make changes, but they will direct you to do so through the company's official website or app — not through a link in the email. If you need to update payment information, the company will tell you to log in yourself and make the change in your account settings.
Phishing emails often create false urgency by saying your booking will be cancelled, your payment failed, or your reservation is at risk unless you act immediately. Real companies give you time to resolve issues and do not threaten to cancel bookings over email without first trying to contact you through your account.
How to verify a booking without clicking the email link
If you receive a booking confirmation email and are not sure whether it is real, do not click any links in the email. Instead, go directly to the travel company's website by typing the address into your browser or using an app you have already installed on your phone.
Log into your account using your username and password, then look for your reservations or bookings. If the reservation is there and matches the email, the email was likely real. If there is no reservation, or if the details do not match, the email was phishing.
You can also call the travel company's customer service number — use the number from their official website, not from the email. A real representative can confirm whether they sent the email and whether your booking is in their system.
What to do if you clicked a phishing link or entered information
If you clicked a link in a phishing email or entered your password, credit card number, or personal information, act quickly. Change your password for that travel company's website immediately, using a computer or phone that you are confident is not infected.
If you entered a credit card number, contact your bank or credit card company and report the fraud. They can cancel the card and issue a new one. If you entered your Social Security number or other identity information, consider placing a fraud alert with the three major credit bureaus (Equifax, Experian, and TransUnion) to make it harder for someone to open accounts in your name.
Report the phishing email to the travel company whose name was used in the scam. Most companies have a way to report fraud on their website or through customer service. You can also report it to the Federal Trade Commission at reportfraud.ftc.gov.
How phishing emails get your address in the first place
Scammers send phishing emails to large numbers of people at once, hoping some will have actually booked travel recently. They may have obtained your email address from a data breach, a public list, or simply by guessing common email formats. You do not have to have been hacked for your address to end up on a phishing list.
The fact that a phishing email mentions a real travel company does not mean that company was breached. Scammers choose popular companies like Booking.com, Airbnb, and major airlines because millions of people use them. If you have never booked with the company mentioned in the email, that is a clear sign it is phishing.
Frequently Asked Questions
What if the email has my real reservation number in it?
Scammers sometimes include real reservation details by scraping them from public sources or data breaches. A correct reservation number does not mean the email is legitimate. Check the sender address and hover over links before clicking. When in doubt, log into your account directly through the company's website to verify.
Can phishing emails infect my computer with malware?
Clicking a link in a phishing email can take you to a fake website designed to steal your information, but it will not automatically infect your computer. However, downloading an attachment from a phishing email could install malware. Never download attachments from unsolicited booking emails, even if they look like they came from a company you trust.
Should I unsubscribe from phishing emails?
No. Clicking an unsubscribe link in a phishing email confirms that your address is active and monitored, which can lead to more phishing attempts. Simply delete the email and report it to your email provider. Real travel companies will let you manage your email preferences through your account settings, not through links in individual emails.
What if I booked through a travel agent or third-party site?
Confirmations from third-party booking sites like Expedia or Kayak will come from those companies, not directly from the hotel or airline. Check the sender address against confirmations you have received before from the same site. If you booked through a travel agent, confirmations may come from the agent's email address rather than the hotel's.
How do I know if a website is fake after I click a link?
Look at the URL in your browser's address bar — not the page title or logo. Fake sites often have slightly different URLs than the real ones. Check for security indicators like a padlock icon (though phishing sites can have these too). If you are asked to log in, do not enter your password. Close the browser tab and go directly to the company's official website instead.