How to keep your personal data safe when booking travel online

A booking site asks for your card number, your address, sometimes a copy of your passport. Most of the time, that is a normal part of buying a flight or a hotel room. Sometimes it is not, and the site exists only to take your details and disappear. This guide shows how to spot travel booking scams before you pay.

You do not need to become a security expert to know how to book travel safely online. You need a short list of checks that take two minutes, done before you type in your card number, not after.

How to tell a real booking site from a fake one

A few checks, done together, tell you more than any single one on its own.

Check the web address carefully. Travel booking scams often use web addresses that look almost right: an extra word, a swapped letter, a different ending such as .net instead of .com. Read the address slowly before you trust it.

Check how long the site has existed. You can look up when a domain was first registered using ICANN Lookup. It is a free tool from the organisation that oversees domain names worldwide, at lookup.icann.org. Say a well-known travel brand’s website shows a registration date only three months ago. That is a strong sign you are on a copycat site, not the real one. Privacy rules hide some registration details, but the registration date itself usually still shows.

Check for real contact details. A legitimate travel company publishes a phone number, a postal address, and a way to reach customer service that is not just a contact form. If you cannot find any of this, or the only contact is a personal email address, treat that as a warning sign.

Search the company name plus the word scam or reviews before you book, especially if it is a company you have not used before. This takes thirty seconds and surfaces problems other travellers have already run into.

Be wary of prices that are far below every other site. Genuine travel companies do not usually undercut the market by a huge margin. If one site’s price looks wrong compared to everywhere else, treat that as a reason to slow down before you book.

What HTTPS tells you, and what it does not

You will often see advice to look for the padlock before entering your card details. This advice needs updating.

Google Chrome, the world’s most used browser, removed the padlock icon in 2023. Google replaced it with a different icon because its own research found that most people misunderstood what the padlock meant. Apple’s Safari and Mozilla’s Firefox still show a padlock. Whether you see one at all now depends on which browser you are using.

Here is what matters: a web address starting with https:// (rather than just http://) means the connection between your browser and the website is encrypted. That is a real, useful thing. It stops someone on the same public Wi-Fi network from reading what you type.

What it does not mean is that the website itself is trustworthy. Sites behind travel booking scams can and do use HTTPS. It is free and easy for anyone to set up, criminals included. So treat HTTPS as a baseline requirement, not a guarantee. Never enter card details on a site that does not have it. But having it is not proof you are safe either. Use it alongside the other checks above, not instead of them.

Paying safely: card or bank transfer

This is the one decision that affects what happens if something goes wrong, and it matters more than which specific card you use.

If you pay by credit or debit card, you generally have a route to dispute the transaction with your bank. This applies if the goods or service never arrives, or is not what the seller promised. This process is a chargeback. It is available through Visa and Mastercard’s own scheme rules. That is why banks in South Africa, Australia, New Zealand, the UK, and Canada all offer some version of it.

If you pay by direct bank transfer (EFT), the money is harder to get back once it clears. For years, banks in most countries treated this the way they would treat cash, gone once sent. That is starting to change in some markets, covered in the next section. Either way, if a travel agent or unfamiliar site asks you to pay by direct bank transfer instead of by card, treat that as a serious warning sign on its own. The same warning applies to tech support scams, which often demand gift cards or bank transfers.

How card protection against travel booking scams varies by country

A market-specific note on card payments, because this differs by country and is worth knowing:

• In the UK, a credit card payment between £100 and £30,000 gives you Section 75, an extra legal protection. Your card provider becomes jointly responsible with the seller if something goes wrong, including if the company goes bust before you travel. This protection does not apply to debit cards.
• In Australia, New Zealand, South Africa, and Canada, chargeback protection is generally available on both credit and debit cards. It comes from the card network rather than a credit-specific law. Canada also has some province-specific protections layered on top for credit cards. Your bank’s own chargeback or dispute terms will confirm exactly what applies to your card.

In every market, paying by card remains the safer default when you have the choice. It gives you an immediate dispute path, rather than depending on whether your country’s newer bank-transfer scam rules happen to cover your situation.

Bank-transfer scams: the rules are changing

Several of these countries have introduced, or are introducing, new rules on scam refunds. These make banks responsible for refunding scam victims even when the payment was a bank transfer rather than a card. This is recent and worth knowing, since it does not match older advice that a bank transfer is simply unrecoverable.

• United Kingdom: mandatory reimbursement has applied since 7 October 2024. If a fraudster tricks you into transferring money to them, your bank must generally refund you within 5 business days, up to £85,000. The exception is if it can show you acted with gross negligence.
• New Zealand: a bank-led scheme took effect on 30 November 2025. Banks may reimburse you up to NZ$500,000 if your bank failed to meet its own scam-prevention commitments and you took reasonable care. This scheme is voluntary rather than required by law, and more conditional than the UK’s, so a successful claim is less certain.
• Australia: a comparable law, the Scams Prevention Framework, has been passed but is being phased in through 2026 and 2027. At the time of writing, it was not yet fully in force. Ask your bank directly what currently applies.
• Canada and South Africa: neither country has a broad reimbursement scheme like this yet. Banks in both are under growing regulatory pressure to introduce one. For now, though, your bank is unlikely to refund a bank-transfer scam automatically.

If you are in the UK or New Zealand and you paid by bank transfer, ask your bank specifically about its scam reimbursement scheme when you report the loss. These are recent changes, and not every bank raises them on its own.

Travel booking scams to recognise

These patterns do not change much from year to year. That is why they are worth knowing rather than memorising a list of specific current scams.

Urgency. Phrases like “only 2 seats left at this price”, countdown timers, pressure to book in the next few minutes. Genuine availability and pricing do not usually depend on you deciding in the next sixty seconds.

Contact you did not initiate. An unexpected email or text saying there is a problem with a booking, a customs fee to pay, or a prize you have won, with a link to click. If you were not expecting it, go to the company’s website directly by typing the address yourself, rather than clicking the link.

Requests to pay outside the platform. Say you are booking through a recognised platform, and the host or agent asks you to pay them directly. Paying outside the platform removes its protections. New Zealand’s Netsafe specifically warns against this for accommodation bookings.

Being asked to set up a new payment method just for this purchase. Gift cards, cryptocurrency, or wiring money through a transfer service are difficult or impossible to reverse. A legitimate travel company has no reason to ask for these as a primary payment method.

What a legitimate travel company will never ask for

Road Scholar is a good example of what a legitimate, well-established operator looks like.

A few things hold steady regardless of which company or country you are dealing with.

• They will never ask for your full banking password or PIN. Not by phone, not by email, not by text.
• They will never ask you to read out a one-time PIN (OTP) that your phone just received, to verify a booking. If someone asks for this, hang up. A genuine company never needs the code your bank sent you.
• They do not need your date of birth or ID number to sell you a flight or hotel booking. If a site asks for this kind of detail beyond what the company needs to issue tickets, that is worth questioning.

If you have been caught: reporting travel booking scams

Act on two fronts at the same time: your bank, and the official body in your country.

Contact your bank or card provider first, and do it quickly. Ask about a chargeback if you paid by card. If you paid by direct bank transfer, ask the bank whether an urgent recall is possible. There is no guarantee it will work, but the sooner you report it, the better the chance.

Report it to your country’s official fraud reporting body. Reporting does not always get your money back. It does help the authorities track patterns, and it can support your bank’s investigation.

• United Kingdom: Action Fraud, actionfraud.police.uk, or 0300 123 2040
• Australia: Scamwatch, scamwatch.gov.au
• New Zealand: Netsafe, netsafe.org.nz, or 0508 638 723
• Canada: Canadian Anti-Fraud Centre, antifraudcentre-centreantifraude.ca, or 1-888-495-8501
• South Africa: report to SAPS, and if banking details or your ID were involved, contact the South African Fraud Prevention Service (SAFPS) for protective registration

Before you book: a checklist against travel booking scams

• Read the web address carefully before entering any details
• Check the domain’s registration date if it is a company you have not used before
• Confirm the site has a real phone number, address, or live support
• Make sure the address starts with https:// before entering payment details, but do not treat this alone as proof of safety
• Pay by card rather than direct bank transfer wherever you have the choice
• Never read out a one-time PIN to anyone, even someone who says they are from your bank
• If something pressures you to decide in the next few minutes, that pressure is itself a reason to slow down

Two related articles worth reading. See how to use Google Maps offline so you are never lost without data, and how to set up an eSIM before your trip so your phone works abroad.

Before you book an international trip, check your passport’s expiry date. Our guide explains when to renew your passport.

If you often book with the same airline or hotel group, its loyalty programme can lower the cost of later trips. See using loyalty points and rewards to cut travel costs.

For more step-by-step help with your phone and apps, see our Tech for Travelers guides.

Get new guides by email

Enter your email to get new SeasonedRoamer guides when they publish.