Hotel Cashback Scam: The 7.5% Refund That Targets TWINT and Bank Accounts

A message from your hotel offers a little money back on a stay you’ve already paid for. It even knows the details of your booking.

The refund sounds like a pleasant surprise, not a problem to solve. Before choosing where the money should go, check where the message takes you.

Overview

A real stay is used to introduce a false refund

The hotel cashback scam promises a 7.5% refund, then steers guests toward counterfeit TWINT and bank-login pages.

The Swiss National Cyber Security Centre’s hotel warning documents this campaign. The goal includes e-banking access and changing the phone number associated with TWINT.

The hotel and the genuine payment services are being impersonated. An accurate booking detail doesn’t give the sender permission to request your banking credentials.

The important exposure is access, not just a card number

The agency describes cloned hotel websites, bank selection, false sign-ins, and requests for authentication approvals. Card-reader codes appear in some reported versions.

It links the convincing booking information to compromised hotel systems. That doesn’t establish a breach at every property or a platform-wide compromise.

The lead image is a fictional interface illustration. Its hotel, booking reference, and sample amounts aren’t evidence from a victim’s reservation.

A refund should not surrender control of your banking

Leave the supplied route and verify the offer with the property using contact details you obtained independently.

• Check the real booking through your usual account or confirmation.
• Don’t enter e-banking credentials on a page introduced by an unexpected cashback message.
• Read the actual purpose of any bank authentication request.
• Tell your bank promptly if you supplied credentials, codes, or approvals.
• Ask about TWINT access and associated phone-number changes, not only card charges.

Why This Offer Can Arrive After You’ve Stopped Worrying

Once a room is booked and paid for, you expect the financial part of the trip to be settled. A small refund may seem uncomplicated.

Unlike a cancellation threat, cashback doesn’t initially demand that you fix a frightening problem. It gives you a reason to cooperate because something good is waiting.

The message may also fit your private calendar. A property name and the correct dates make it feel connected to an interaction you recognize.

That familiarity can make the first button feel less risky than a random promotion. You aren’t being asked to believe in an unfamiliar holiday.

What still needs checking is who controls the new request. A genuine trip and a fraudulent financial instruction can exist at the same time.

Keep your original confirmation as the reference point. The unexpected message should not replace the records and contact route you already trusted.

If someone else arranged the stay, ask them to check through their established booking account. There’s no need to send them the suspicious link to try.

How the Hotel Cashback Scam Works

Step 1: Booking information gives the approach a personal feel

Names and stay details help the sender sound like the property. The request therefore feels like follow-up service rather than an unrelated financial approach.

Personal information is a reason to take the incident seriously, not a reason to obey it. A person can know your reservation without representing the hotel.

Don’t try to establish authenticity by asking for another detail already held in the same booking record. Use a separate communication route instead.

Step 2: Cashback moves the guest onto a hotel-looking website

The supposed offer introduces a new place to claim money. Familiar design helps that destination feel like part of the stay.

A web page can reproduce public branding while using a different address. Look beyond a recognizable building picture or a correctly spelled property name.

If you want the hotel to confirm the offer, use its independently obtained contact. The contact button on the disputed page isn’t an independent reference.

You can ask a simple question: did the property send this cashback request? You don’t need to disclose banking secrets to get an answer.

Step 3: TWINT is offered as a convenient way to receive it

A familiar payment name can make the next choice seem practical. Selecting your own bank may feel like choosing a destination for the refund.

But choosing a bank from a list does not authenticate the page. Anyone building a false form can list legitimate financial institutions.

Pay attention when the task changes from naming a receiving method to signing into banking. That is a much more sensitive action.

The earlier hotel branding cannot authorize that new action. Pause at the transition instead of assuming the bank-looking screen inherited the hotel’s trust.

Step 4: An approval meant for a real login is described as refund processing

The attackers try to use captured credentials while the guest remains occupied. A genuine authentication request may then appear during the false process.

Read the request as the bank presents it. A login, new device, or transaction approval is not merely a formality because a previous page promised money back.

If a code is requested, don’t paste it into the unverified destination or relay it to someone guiding the claim.

For a card reader, the same principle applies. A code generated with your own equipment can still be requested for someone else’s operation.

If anything is unclear, stop and ask the bank through its genuine support channel. Don’t let the person requesting approval interpret it for you.

Step 5: The supposed refund can become control over account settings

You may never have typed a card number. Tell the bank about the login itself, rather than waiting for a card charge to appear.

A phone-number association is particularly important when it helps determine who controls a payment account. Ask the provider to inspect unfamiliar changes after an exposure.

Don’t regard a working app as proof that nothing happened elsewhere. Describe the compromised login and let the financial institution assess access and activity.

If you see an unwanted transaction, preserve its details separately. Protecting access and investigating money movement both matter.

A Small Refund Is Not a Small Permission

The advertised amount encourages you to think about a modest credit. The information being requested can carry much broader authority.

There is a big difference between confirming where a genuine refund belongs and granting access to an entire financial account.

Don’t use the size of the promised cashback to judge the sensitivity of the form. Consider the action the form can authorize.

You also don’t need to prove fraud by finishing the process. Refusing an unverified login is sensible even before any money disappears.

If a page says an approval is required to avoid losing the cashback, let the offer wait. A financial provider can explain a real authentication request independently.

Keep the distinction clear when describing the incident: you expected a refund, but may have supplied information for account access.

That explanation helps support focus on the banking event rather than spending the whole conversation looking for a missing hotel credit.

How to Check the Stay Without Repeating the Banking Process

Open the booking account yourself or locate the original reservation confirmation. Check the property and contact details against the records you already hold.

Ask the hotel about the offer through that established route. An unsolicited message knowing your dates is not the best source for a replacement telephone number.

If the hotel is investigating an impersonation, follow its verified instructions for sharing the message. Don’t send your full banking history or authentication codes.

Check the actual reservation status separately. A fake cashback offer doesn’t, by itself, show that your room was canceled or that a new booking is needed.

For an upcoming trip, explain any genuine payment-method change caused by card protection. Arrange necessary updates only through the confirmed booking process.

For a completed stay, keep the receipt and original payment record. Those records help you ask about a legitimate adjustment without treating the email’s amount as established.

If several guests are involved, warn the other organizer about the exact claim. Avoid circulating everyone’s reservation details in a public discussion.

What to Tell the Bank if You Already Claimed the Cashback

A short timeline is more useful than an assumption that everything is hacked. Start with the hotel message, then describe the screens and approvals.

Identify the bank you selected, any credentials entered, and the type of authentication that followed. Say which details you cannot remember.

Include an approval you declined as well as one you accepted. The bank can compare your account with its records rather than relying on the fake page.

If you entered only a phone number, say that. If you completed a bank login, make that clear rather than describing the incident as merely opening a link.

Ask about access, devices, account changes, and TWINT association. Looking only for a current card charge can miss the reason this particular campaign is dangerous.

Keep any case reference privately. If a new caller claims to be helping, verify that contact through the support route you initiated.

If your usual sign-in no longer works, tell the bank that too. Don’t return to the cashback page looking for a password reset.

A changed telephone number may leave you unable to receive genuine notifications. Ask the provider how to restore the correct contact through its verified recovery process.

When someone helps make the call, stay involved in the conversation. They can describe the hotel message without collecting your live codes themselves.

Keep the bank’s response separate from the hotel’s reply. A property confirming impersonation doesn’t establish that financial access has been secured.

Before closing the case, ask what activity still needs monitoring and how to recognize genuine follow-up. Keep those instructions with your original incident record.

What to Do if You Have Fallen Victim to This Scam

1. Stop the cashback interaction. Close the linked site and end any call or chat guiding the supposed refund.

   Don’t request another code, retry the login, or accept a replacement page to correct an error. Keep the original message for evidence.

2. Contact your bank urgently after a banking disclosure. Use its established app, published contact, or another independently verified route.

   Explain that a hotel cashback offer led to an e-banking sign-in. Report credentials, approvals, card-reader actions, and any observed phone-number change.

   Ask how to secure access and review activity. Do not assume a password change alone addresses devices, settings, or payment-account associations.

3. Use the correct TWINT support route. Identify whether you use a bank-issued TWINT app or TWINT Prepaid.

   TWINT’s official blocking guidance distinguishes these routes. Follow the provider responsible for your actual app, not a general inbox alone.

   Tell support about the fake bank login, not simply a missing refund. Ask whether unfamiliar access or associated contact details need attention.

4. Report financial loss using real account records. Note amounts, currency, recipients, dates, and transaction references for any disputed activity.

   Ask the institution which protective and recovery procedures apply, including reporting deadlines. A fake site’s refund confirmation isn’t proof that money has returned.

   If a card was separately exposed, report it too. Card protection and banking-access recovery may require different actions.

5. Notify the hotel or booking service independently. Ask about your real reservation and report the message without following its supplied support instructions.

   Preserve the sender, destination, existing screenshots, and relevant approvals. Don’t revisit the phishing page just to collect a more complete record.

   Consider a police report after financial loss. Keep private guest information, complete account identifiers, and codes out of public warnings.

6. Check additional software exposure only if relevant. If someone persuaded you to install an app or open a file, explain that separate event.

   Malwarebytes can assist with inspecting unwanted software. AdGuard filters some unsafe web content; neither restores control of a financial account by itself.

   Receiving an email doesn’t establish infection. Match device checks to downloads, permissions, or installations that actually happened.

7. Reject new recovery or correction payments. Don’t pay an unexpected helper to release cashback, repair the login, or retrieve the lost money.

   Continue through your independently established bank and booking contacts. Knowledge of the stay or fraud report doesn’t authenticate a new approach.

Frequently Asked Questions

Does knowing my reservation make the cashback message genuine?

No. Booking information can be misused. Confirm the offer through the hotel or booking account you reached independently.

Why would a hotel refund need my e-banking login?

In this campaign, the refund is the excuse for collecting access information. Don’t enter banking credentials through the emailed claim route.

Can my own bank send a real approval during the scam?

Yes. An attacker may be attempting a genuine login. Read the actual operation and don’t approve it because another page calls it cashback processing.

Should I cancel the hotel room immediately?

First check the real booking with the property. The fraudulent refund message doesn’t establish that the reservation itself is invalid.

What if no card number was requested?

Banking access and TWINT settings can still be exposed. Report the credentials and approvals actually supplied, even without a visible card charge.

Is reporting the phishing website enough after sharing a code?

No. Also seek urgent account assistance from the relevant financial provider. A website report doesn’t automatically secure your personal access.

The Bottom Line

Don’t claim a hotel cashback offer through an unexpected banking link. The documented 7.5% lure can turn a paid stay into an account-access attack.

If you entered banking details or approved a request, contact your bank and TWINT provider promptly. Verify the hotel matter separately through trusted booking records.