Singapore police warned on 9 October that scammers impersonating hotels and online booking platforms have cheated victims out of at least S$185,000 across 148 cases since January, frequently opening WhatsApp chats that quote genuine reservation numbers to coax card verification.
The variant matters for a city hosting the Formula 1 weekend: travellers juggling Marina Bay hotel stays and late-night flight changes are primed to tap “confirm booking” links on mobile. Victims told investigators they were asked to secure rooms or update card details through phishing sites that promised no charge would post; unauthorised transactions appeared minutes later.
How the lure works
In many reports, messages mirrored legitimate booking confirmations, including dates and property names scraped from earlier breaches or public itineraries. Victims entered card numbers on fake portals, sometimes approving one-time passwords they believed were authorising a zero-dollar hold. Only when front desks reported no payment on arrival did the fraud surface.
Police reiterated the ACT framework—Add ScamShield, Check via the 1799 helpline, Tell friends—and urged callers to verify hotels through numbers listed on official websites, not reply threads.
Overlap with other October advisories
The hotel wave sits beside separate police notices on social-media shop ads and Lalamove “buy for me” gift-card jobs. The common thread is outsourced trust: a familiar brand logo, a real-looking reference code, and urgency while the victim is in transit.
What banks and platforms are doing
Major issuers have tightened step-up authentication for hospitality merchants, but phishing that harvests credentials directly bypasses those controls. Booking platforms told CNA they are accelerating sender verification on e-mails; WhatsApp remains the weak link because personal messages lack the same domain authentication.
Practical steps before check-in
Travellers should call the hotel switchboard using the number on the official site, read URL domains character by character, and refuse to “reconfirm” cards over chat apps. Corporate travel desks in the CBD issued fresh reminders on Friday as haze and grand prix road closures already strained schedules.
Anyone who shared card data should freeze the card through the bank app, file a police report for documentation, and keep booking e-mails for dispute teams. Recovery is uneven, but early reports help Cyber Command link mule accounts used to launder hospitality fraud across the region.
Business travellers on corporate cards should alert finance teams immediately so treasury can push chargeback codes aligned with card network hospitality categories. Small boutique hotels near the race circuit said they fielded extra calls on Friday from guests verifying whether a WhatsApp message truly came from front desk staff.