In this guide 10 sections
At a glance
The short version.
Watch for
- Tickets for a sold-out event offered on social media, a marketplace or a classified site instead of through the official seller or its authorised resale
- A ticket shown as a photo or screenshot rather than in the official app or ticket account
- Tickets priced far below or far above what you would expect, or travel deals far cheaper than comparable options
Already acted?
If you entered card details, call your bank or card issuer straight away, using the number on your card or in its app, and ask for the card to be blocked.
See every recovery stepWhat is changing now
The current pattern.
Big events and busy travel seasons create demand that scammers exploit with counterfeit or duplicated tickets, listings for properties that do not exist and copycat travel websites. Paid search ads can put a scammer’s phone number next to a well-known airline or hotel name. Travellers with genuine reservations also receive messages — sometimes through the booking platform’s own chat, from a hotel account that criminals have taken over — warning that the booking will be cancelled unless card details are verified through a link.
How it works
How the scam unfolds.
When an event sells out, resale offers on social media, marketplaces and classified sites fill the gap. Some tickets are counterfeit; others are duplicates, with the same ticket sold to several buyers, or ‘tickets’ that exist only as a photo or screenshot. Many buyers find out only when they arrive at the venue, long after the money has gone — and payment by bank transfer, payment app, gift card or cryptocurrency is very hard to get back.
Travel scams exploit the gap between what you searched for and who you actually reached. Copycat websites advertise cheap flights, packages and holiday lets — including properties that do not exist or that the advertiser does not own — and ask for a deposit or full payment before arrival. Paid search ads can place a scammer’s number beside a trusted company’s name, and fake ‘customer service’ accounts look for travellers complaining publicly about delays, then ask for booking references, phone numbers or bank details, or send them to a spoofed website.
Another version targets people who have already booked. Criminals obtain a hotel’s login for a booking system through phishing or malware, then contact its guests through the platform’s own messaging, by email or on WhatsApp. Because the message can quote your name, dates and reservation, it feels genuine. The real question is not whether the sender knows your booking, but whether the booking itself — opened through the official app or website — shows any problem at all.
Warning signs
Reasons to stop and verify.
- Tickets for a sold-out event offered on social media, a marketplace or a classified site instead of through the official seller or its authorised resale
- A ticket shown as a photo or screenshot rather than in the official app or ticket account
- Tickets priced far below or far above what you would expect, or travel deals far cheaper than comparable options
- Pressure to pay immediately, or payment only by bank transfer, payment app, gift card or cryptocurrency
- A helpline number from a search ad, or a ‘customer service’ account that contacted you after you posted about a travel problem
- A message about an existing booking that threatens cancellation unless you re-verify your card or pay through a link — even when it quotes your real reservation
Spot the signs
What it can look like.
Highlighted phrases are warning signs; the numbered notes explain each one.
Seabright Harbour Hotel1 (warning sign 1) · in your booking app
Seabright Harbour HotelDear Ms Patel, thank you for choosing us for your stay of 14–17 November (reservation SH-48213)2 (warning sign 2).
Seabright Harbour HotelUnfortunately your card could not be verified, and your booking will be cancelled automatically in 24 hours3 (warning sign 3).
Seabright Harbour HotelPlease re-confirm your card details here: seabright-guestpay.example/verify4 (warning sign 4) No payment will be taken — this is only a security check.5 (warning sign 5)
- A real hotel’s account is not proof
Criminals who obtain a hotel’s booking-system login can write from its genuine account, inside the platform’s own chat. Where a message appears does not tell you who wrote it.
- Correct booking details
Your dates and reservation number make the message feel genuine, but anyone with access to the hotel’s account can see them. Accurate details are not verification.
- A cancellation deadline
The threat to cancel your stay within hours is designed to make you act before you check the booking yourself.
- A link that asks for your card
A separate page collects your full card details. Close the message and open the booking yourself in the official app or website instead.
- Reassurance that nothing will be charged
Whatever the page promises, typing in your card number, expiry date and security code hands them to whoever runs it.
Close the chat and open the booking yourself in the official app or website. If you are still unsure, call the hotel on a number you looked up independently — not one from the message.
Composite example: names, numbers and “.example” addresses are fictional.
Worked example
A realistic pattern, separated into evidence.
This composite example is educational. It does not describe a real person or reproduce a live malicious message.
Sold-out festival tickets appear in a fan group at face value
- 01The opening
A festival sells out within minutes. That evening, a member of a fan group on social media offers two tickets at face value because they ‘can’t go any more’. The seller replies quickly and sends a screenshot of the tickets.
- 02The escalation
Several other people are interested, the seller says, so the tickets will go to whoever pays first. They ask for a bank transfer to avoid fees and promise to send the tickets as soon as the money arrives.
- 03The decision point
A fair price and a friendly reply make the offer feel safe. But a screenshot shows only that a ticket existed at some point; it does not show that this person still controls it, or that it has not been sold to others as well. The deadline and the hard-to-reverse payment remove the chance to check.
Independent verification
Test the request without using its evidence.
These checks deliberately move the decision away from the person, link, number or account that introduced the request.
- 01
Find the official seller from the event itself
Go to the event’s, venue’s or artist’s official website to see who sells tickets and whether there is an authorised resale service. If you use another reseller, confirm the date, venue and seating plan on the official site too.
- 02
Open the booking yourself
If a message mentions a problem with a reservation, close it and sign in to the booking platform, airline or hotel through its official app or a web address you type yourself. Check whether the booking shows any payment issue there.
- 03
Take contact details from records you trust
Use the number in the official app, on your booking confirmation or on the company’s website typed in directly. Scroll past paid search results, and find social media accounts through the company’s own website rather than by searching.
- 04
Check the place and the business
For a holiday let, compare the listing across several sources and confirm the address exists. Search the business or property name with words such as ‘scam’, ‘review’ or ‘complaint’, and read the cancellation terms before paying.
Prevention
Make the next attempt harder.
- 01
Know where you will buy before tickets go on sale
For events you care about, note the official seller and any authorised resale service in advance, so a post in a fan group is not your only option once the event sells out.
- 02
Pay by credit card where you can
Credit cards can offer dispute and refund protection, while money sent by bank transfer, gift card or cryptocurrency is very hard to recover. Keep confirmation emails and receipts until after the event or trip.
- 03
Save trusted contacts before you travel
Install the airline’s or booking platform’s official app and keep your confirmation emails. If plans go wrong, you will already have a reliable route instead of searching for a number in a hurry.
- 04
Keep travel problems out of public replies
Scammers look for posts about delays and cancellations and reply as ‘customer service’. Contact the company through its app, its website or an airport desk, and never share booking or bank details on social media.
If you already acted
Protect access and contact the real provider.
- If you entered card details, call your bank or card issuer straight away, using the number on your card or in its app, and ask for the card to be blocked.
- If you paid for tickets, a stay or a ‘verification’, ask your card issuer or bank whether the payment can be disputed, stopped or recovered — the sooner, the better.
- Sign in to the booking platform, airline or ticket account through its official app, check the booking and change the password if you typed it into a linked page.
- Save the post, listing or message, the sender’s profile or number, any ticket images and your payment records before anything is deleted.
- Report the seller, listing or message to the platform where it appeared, and report the fraud to the police or your national fraud reporting service.
Common questions
Short answers to real doubts.
How do I know if concert tickets on social media are real?
You usually cannot tell from the post. A photo or screenshot shows that a ticket existed, not that the seller still controls it or has not sold it to someone else. Check the event’s or venue’s website for the official seller and any authorised resale service. If you still buy privately, be wary of pressure to pay quickly and of requests for bank transfer, gift cards or cryptocurrency, and pay by credit card where possible.
Can a scam message come through the booking app itself?
Yes. Criminals sometimes obtain a hotel’s login for a booking system and message its guests through the platform’s own messaging, as well as by email or WhatsApp. The message may include your real dates and reservation number. Instead of using any link in the message, sign in to your booking yourself or call the hotel on a number you looked up.
Is the phone number at the top of search results the real airline or hotel?
Not necessarily. The first results can be paid ads, and scammers have used ads that put their own number beside a well-known company’s name. Use the number in the official app or on your booking confirmation, or type the company’s web address yourself.
I entered my card details on a booking ‘verification’ page. What should I do?
Contact your bank or card issuer immediately, using the number on your card or in its app, and ask for the card to be blocked. Then check the booking through the platform’s official app or website and report the message to the platform. If money was taken, report it to the police or your national fraud reporting service.
What to do if money was sentSources
Official guidance used for this article.
Stop & Verify summarises these sources for general education. Reporting routes and legal protections vary by location.