Spot Phishing Emails & Fake Refunds After Travel Hack

Updated 4 November 2026 · Standard formula, shown below

After a travel booking data breach, scammers flood inboxes with fake refund offers and urgent account alerts. This guide teaches you to recognize the red flags, verify legitimate communications, and avoid falling for refund scams.

What You’ll Need

Access to your email inbox (the one used for booking)
A web browser to check the official travel company website
Your booking confirmation number (if you have it)
A phone to call customer support if needed

Step-by-Step

Check the sender’s email address carefully. Scammers often use addresses that look similar to the real company’s domain (e.g., support@booking-confirmation.net instead of support@booking.com). Hover over the sender name to reveal the full address. If the domain is misspelled or uses a public email service (like Gmail or Yahoo), it’s likely a scam.
Look for generic greetings. Legitimate travel companies usually address you by name in emails. If the email starts with “Dear Customer” or “Dear Traveler,” it’s a red flag, especially if it claims to be about a refund or account issue.
Examine the language and tone. Phishing emails often create a sense of urgency: “Act now!” “Your refund will expire in 24 hours!” “Your account will be closed!” Legitimate companies rarely use such pressure tactics. Also watch for poor grammar, awkward phrasing, or unusual punctuation.
Hover over links before clicking. Move your mouse over any button or link to see the destination URL in your browser’s status bar (or on mobile, press and hold the link). If the URL doesn’t match the official company domain, do not click.
Check for suspicious attachments. Legitimate refund notifications rarely include attachments. If an email asks you to open a PDF or spreadsheet to “claim your refund,” it’s almost certainly a scam. Never download attachments from unsolicited emails.
Verify the refund amount. If the email mentions a specific refund amount, log into your booking account on the official website (type the URL manually, don’t use the email link) and check your booking details or payment history. If the amount doesn’t match, it’s fake.
Contact the company directly. If you’re unsure, call the official customer support number from the company’s website (not from the email). Ask if they have sent a refund notification and verify the details.
Report and delete. If you determine the email is a phishing attempt, report it to your email provider (use the “Report phishing” option) and to the company if they have a designated abuse address. Then delete the email permanently.

Common Mistakes

Clicking links in a hurry. Even if an email looks legitimate, always hover and verify the URL. A single click can install malware or lead to a fake login page.
Trusting the sender name. Scammers can spoof the display name to show “Booking.com” or “Expedia,” but the email address behind it is different.
Providing personal information. Legitimate companies already have your payment details. They will never ask you to confirm your credit card number, CVV, or password via email.
Calling the number in the email. Scammers often include a fake support number. Always use the number from the official website.
Ignoring your own booking details. If you didn’t request a refund, or if the refund amount seems random, that’s a huge red flag.

Tips

Enable two-factor authentication on your email and travel accounts to add an extra layer of security.
Use a password manager to generate and store unique passwords for each site.
Check the official travel company’s social media or website for announcements about data breaches and their recommended steps.
If you receive a suspicious email, forward it to the company’s official phishing reporting address (often listed on their site) and then delete it.
Keep your browser and antivirus software up to date to help block known phishing sites.

Troubleshooting

What if I already clicked a link or entered my details? Immediately change your passwords for that account and any other account using the same password. Contact your bank or credit card company to monitor for fraudulent charges. Run a security scan on your device.

What if the email looks legitimate but I’m still unsure? Don’t rely on the email. Go directly to the company’s website by typing the URL in your browser, log in, and check for any notifications or messages in your account dashboard. You can also call their official support line.

What if I missed a real refund because I deleted the email? Log into your travel account and check your booking status. If a refund was issued, it should appear in your payment method within a few business days. If not, contact the company directly.

What if the scammer already used my payment info? Contact your bank or card issuer immediately to dispute any unauthorized charges. They can issue a new card and help you reverse the charges.

Frequently Asked Questions

How can I tell if a refund email is real?

Check the sender’s address, look for your name in the greeting, verify the refund amount matches your booking, and contact the company directly through their official website or phone number.

Should I call the number in the email?

No. Scammers often use fake support numbers. Always use the number from the official company website.

What should I do if I already clicked a phishing link?

Disconnect from the internet, run a security scan, change your passwords (especially for email and financial accounts), and monitor your accounts for suspicious activity.

Can scammers spoof the official company’s email address?

Yes, they can spoof the display name, but the actual email address (the part after the @) will be different. Always check the full address.

Will a legitimate company ask for my password or credit card details via email?

No. Legitimate companies never ask for sensitive information like passwords or full credit card numbers via email. They may ask you to log in to your account, but never to reply with this info.

How do I report a phishing email?

Use your email provider’s “Report phishing” option, and also report it to the company being impersonated (check their website for a security or abuse contact). Then delete the email.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.