Imagine you’re planning a weekend in Salzburg or a few days in the mountains. You search for a hotel, open a professional-looking website, recognise the name and see plenty of convincing photographs. There may be very little to suggest that you’ve ended up on the wrong site.
But Austria’s Watchlist Internet is warning travellers about fraudulent websites that copy real hotels' online presence almost one-for-one.
The scammers copy genuine businesses, using their photos, descriptions and sometimes even their real telephone number and legal information.
At first glance, the cloned sites can look legitimate.
What are the fake hotel sites after?
For now, the websites identified by Watchlist Internet appear to collect personal information and not necessarily take payments.
Visitors interested in a room are asked to submit a booking enquiry containing details such as their arrival and departure dates, full name, email address and telephone number.
Watchlist Internet says it isn’t yet known whether victims are subsequently offered fraudulent bookings. But anyone who has submitted their details should be particularly wary of follow-up messages, as the information could be used for other scams.
In a separate case reported by ORF Salzburg, guests of some hotels received convincing fraudulent messages following a data leak at hotel technology provider Seekda. Some were asked for credit card details or to make another deposit.
READ ALSO: Six tourist scams to be aware of in Austria
How can you tell if a hotel website is genuine?
One clue is the domain's age. Watchlist Internet says the cloned sites may imitate hotels that have been operating online for years while using web addresses registered only very recently.
You can check this yourself by copying the domain name - for example, hotelname.com - into ICANN's registration data lookup tool and looking for the date the domain was created or registered, where that information is available. For Austrian .at addresses, nic.at also has its own WHOIS search, although the information shown publicly varies and may not include the original registration date.
A recently registered domain isn't proof that a website is fraudulent. But if a hotel says it has been operating for decades while the web address appeared only a few weeks ago, it gives you a good reason to check further.
It’s also worth taking a close look at the URL. Search separately for the hotel and compare the web address with links from other established sources instead of assuming the first convincing-looking page you find is the genuine one.
Watchlist also recommends looking closely at the site itself. Some copies it has seen are less polished than the originals, and the text may suddenly stop mid-sentence.
Austria’s Chamber of Labour (Arbeiterkammer) advises travellers to research accommodation independently, check reviews and examine the website’s Impressum, or legal notice.
With a cloned hotel site, though, even a convincing Impressum doesn’t prove much on its own. Scammers can simply copy those details from the real hotel.
If something feels off, contact the hotel independently before sending personal details or money. Be especially cautious if you’re unexpectedly directed to WhatsApp, sent a payment link or told to transfer money to an unfamiliar account.
You can also search Watchlist Internet’s database of known fraudulent travel-booking websites before proceeding.
READ ALSO: Police in Austria warn of new FinanzOnline scam targeting online banking users
What if you’ve already entered your details?
Watchlist Internet advises anyone who submitted information through one of the fake sites to be alert for subsequent calls, emails or messages. The next scam attempt may not necessarily have anything to do with the hotel.
If you have already transferred money, contact your bank as soon as possible to ask whether the payment can be reversed and report the fraud to the police.
READ ALSO: Austria warns of surge in scam calls from UK numbers
Comments (2)